That square QR barcode on the poster? Check it's not a sticker

Re: Devil's Advocate

There's nothing wrong with QR codes, as such. If anything, they are working perfectly.

The problem is, was, and always has been browsers that do not act on the COMPLETELY UNTRUSTED DATA that they receive from the network in the proper fashion (i.e. trusting nothing, and checking everything).

It's like saying that a sticker that says "Stick your head in a gas oven" is dangerous. It might be. But only if you blindly and trustingly follow its instructions without question no matter what the content.

The fix here is not to stop using QR codes - it's to stop using browsers that are so full of "features" that visiting a URL becomes a dangerous gamble. At absolute worst, the browser should do one of those "This page is taking up too much CPU time, do you want to stop it?" messages. It should not crash, try to download, steal data or otherwise exploit your machine. And it's nothing to do with making a "perfect" secure app, which doesn't exist, it's about being sensible with the data you're given, i.e. not running scripts, plugins, triggering downloads, etc. by default.

I use Opera and when we have a "dodgy" URL come up in my workplace (a school), I often have to trace it back to the original user. This usually means going to the server logs and copy/pasting suspected bad URL's from them to check their content. Although I run it in a VM in those instances (no use ASKING for trouble), Opera, by default, just doesn't let you do anything stupid and has the least number of vulnerabilities published for it (and has had since about Opera 3.5). I can literally just copy/paste a known exploit URL in there and 99.9% of them won't work (because they rely on Java, ActiveX, or some other junk) and the ones that "try" to work by triggering downloads, running executables, opening lots of pages, etc. or even crashing the browser I can easily cancel before they can do any damage.

And even then, they can't jump out of the virtual machine even if I just used IE and double-clicked everything. If you can do that in a VM, you can push also that separation-while-enjoying-full-functionality down to the application (the VM is nothing but an application).

There's nothing wrong with QR codes that isn't also wrong with bookmarks/favourites, URL's in your IM, URL's themselves(!), URL shortening services or just about any method to transfer a URL (e.g. that "bump-together" junk that's in smartphones now). The problem is in browsers that don't treat untrusted HTML data off a network as exactly that - untrusted.

We need a new profession: professional naysayer.

Feck off, that's my job. I don't need the competition, mate.

Re: Rickrolling

We're no strangers to love

You know the rules ... and so do I

A full commitment's what I'm ... thinkin' of

You wouldn't get this from any other guy

I just wanna tell you how I'm feeling

Gotta make you ... understand

Never gonna give you up

Never gonna let you down

Never gonna run around and desert you

Never gonna make you cry

Never gonna say goodbye

Never gonna tell a lie and hurt you

We've known each other ... for so long

Your heart's been aching, but ... you're too shy to say it

Inside we both know what's been ... goin' on

We know the game and we're ... gonna play it

And if you ask me how I'm feeling

Don't tell me you're to ... blind to see

Never gonna give you up

Never gonna let you down

Never gonna run around and desert you

Never gonna make you cry

Never gonna say goodbye

Never gonna tell a lie and hurt you

Never gonna give you up

Never gonna let you down

Never gonna run around and desert you

Never gonna make you cry

Never gonna say goodbye

Never gonna tell a lie and hurt you

Oooooooooh ... give you up

Oooooooooh ... give you up

Never gonna give never gonna give

Give you up

Never gonna give never gonna give

Give you up

We've known each other ... for so long

Your heart's been aching, but ... you're too shy to say it

Inside we both know what's been ... goin' on

We know the game and we're ... gonna play it

I just wanna tell you how I'm feeling

Gotta make you ... understand

Never gonna give you up

Never gonna let you down

Never gonna run around and desert you

Never gonna make you cry

Never gonna say goodbye

Never gonna tell a lie and hurt you

Never gonna give you up

Never gonna let you down

Never gonna run around and desert you

Never gonna make you cry

Never gonna say goodbye

Never gonna tell a lie and hurt you

Never gonna give you up

Never gonna let you down

Never gonna run around and desert you

Never gonna make you cry

Never gonna say goodbye

Never gonna tell a lie and hurt you

The pron industry and crims, the two biggest drivers of web technologies.

Re: Same old, same old...

we use a QR code to allow quick access to our company wifi - scan the code on your device and voila - connected.

There are some other uses - like embeded vcards on the back of you buisness cards to allow quick digitisation of the contacts details.

Re: Same old, same old...

It's also a very convenient way to point smartphone users at app (or other) downloads from a PC browser.

The QR reader I use shows the decoded data and waits for the user to choose what to do with it. In theory safer than a traditional hyperlink because you always see the unobfuscated content before accepting it, something you actively need to check with a hyperlink.

You still need some way of assessing the trustworthiness of the exposed link but that's true for any link. Seeing a sticker slapped on a poster is a pretty big clue not to trust it though.

Re: Same old, same old...

I don't know of an example where the presence of a QR code is anything more than advertising, so it's worth avoiding on general principles anyway.

Y'know, I'd never really thought of that. There may be other uses for them, for sure, but most of the time, in all my comings and goings, the vast majority of QR codes I see have been in the context of advertising.

I did it a couple of years ago when QR codes first appeared. My QR code just redirected to a website that had the message "stop buying useless crap"

Re: Symantec and The Reg on the ball as usual

Recently I tried to find the original date of a TV show that quoted a report of incautious young people using nutmeg as an hallucinogen. (It actually is, apparently, but it's less fun than some other ones - but you can buy it in supermarkets.)

But I couldn't tell when - because it's a story that keeps coming up again and again.