Do you use QR codes or do you avoid them?

[joblakely@mastodon.social]

@staringatclouds no worries! It became a surprisingly long thread. Lots of great replies.

[blogdiva@mastodon.social]

@JoBlakely like the plague. i absolutely avoid them by all means necessary. they are the most unsecure shit ever.

[joblakely@mastodon.social]

@AnguaDelphine
That’s an awful and harmful thing to report all as phishing because most of the time it isn’t phishing. Especially when you see arguments in thread about it being an accessibility issue.
I get the concerns, and you can choose to not use them, but to report them without knowledge of if they are real or fake is just inconsiderate to others who are trying to be more accommodating, not cause harm.

[miss_rodent@girlcock.club]

@JoBlakely Generally avoid them unless I know who is sending it to me, why, and what it's supposed to point to, all in advance of the interaction with it.

[leberschnitzel@existiert.ch]

@JoBlakely 12 years ago I tried to make an app to rate clubs, that used qr codes and had 0% scan rate.
Later turned into an app where you can swipe of you like or dislike events near you and automatically join a chat with the people that also swiped that they like the event, to plan meeting new people or find people that you've seen at an event, but it never got out of the dev phase.

[qgustavor@urusai.social]

@JoBlakely I love QR codes and I find it weird why people don't like them: in most cases they are just URLs in a format that's easier to consume.

If you know how to spot a bad or a good URL (which can be anywhere, in a SMS, in a Mastodon toot, in printed media) you don't need to be afraid of QR codes.

"But my phones opens them immediately!" Uninstall whatever bloatware you have installed and use SECUSO's QR Scanner instead (or some iOS equivalent).

"But 0-days!" they are just URLs. If you worry about 0-days you need to worry about all the other ways people can access URLs.

"But if someone places a phishing URL"... see, it's a phishing URL, there isn't a "phishing QR code", that's a phishing problem. Check them!

QR codes are amazing. The dead of the power user is horrid.

[qgustavor@urusai.social]

@JoBlakely That being said, in my country QR codes become the equivalent of "here's my payment address", so, for the unlucky of hackers, phishers and marketing teams, everyone and their dog are not opening QR codes in their "camera" app anymore, they are opening just in their trusted bank app (although Google Wallet supports those too), that only recognizes payment address QR codes.

I noticed it in a bus terminal: EVEN the staff there said "you shouldn't scan this QR code, it will not work!" because they tried scanning it from their bank apps instead of scanning using a general purpose QR scanner.

No wonder QR code menus are becoming rarer and rarer here. I guess staff now needs to explain how to use QR code readers to people, then they just print the menus like the good old times.

[jspath55@chaos.social]

@JoBlakely I read the replies to figure if the question was about consuming, or producing, QR codes. I do both.
Yes, I preview the URL for what I scan.
Yes, I create flyers that have QR codes for people to register for events, or access an online map.

[joblakely@mastodon.social]

@jspath55
Ah. Yes. My poll was somewhat unclear. Thanks for your clarification. I produce them on my own promotions, but have yet to consume them.

[catsalad@infosec.exchange]

@JoBlakely No, it's just text that says "No, I don't use QR"