Quishing

QR codes just aren't made for security. They shouldn't be used anywhere security is required.

I get what you're saying but it's at least a little bit funny that they are regularly used for security in the form of scan to login (e.g. Steam), verify your session (e.g. Matrix), etc. Of course these are in a closed ecosystem so the QR code itself is not the security. But I just found it funny you said that when 90% of my QR code usage is for security.

no, please dont give more leverage for these people to put more invasive apps on my phone

Well, by using a QR code you don't have to invent your own 2D system, as blackjack and hookers aren't really necessary.

Just make your own URI protocol, and encode any signature in the link. Bonus if you can register your protocol in Android or IOS, but I don't know if this is possible.

This is how our COVID vaccination certificate QR codes worked

Many QR codes today are designed to be scanned in a general QR app and then launch their specific app. Not sure how the markup works exactly, but I’ve seen it work like that.

Okay and what happens when I overwrite that qr code with one that points to downloadvirus.com? How is a client supposed to know that the qr code isn't supposed to be here?

You pay CAs for certificate issuance, not for signing. You could sign all the QR codes in a city with a single CA-issued certificate as long as the standards for it were all accepted.

You can't use public keys to sign anything. You need the private one.

This seems to be a gross misunderstanding of public key cryptography. Public keys allow you to verify an existing signature is valid and made by the correct entity, but they absolutely don't allow you to forge a signature: that's actually what they are designed to prevent.

They show you a tiny pop up with some of the URL. Not all of it. You click that and it goes right to it.

Yup, modern security at its finest. Normie's don't stand a chance.

I wish email clients would do something similar, especially for Formatted links.

Open up a big popup that shows the full sender address, the full link, and underline/color any numbers so its clear AMAZ0N.com is b.s.

I just like his music

What app you using that gave you that preview?

What app is that?

XcQ - no click for you.

Due to the limited amount of information stored in QR codes, it's generally a shortened URL, so usually that doesn't tremendously help at informing where you are supposed to end up.

If you're trying to do something unique, that you don't normally do, which IMO is the entire use-case of QR codes (go here to do the thing), and you're expecting.... Say, a website for paying for parking, then.... It wouldn't be hard for an attacker to create their own mock-up of the site, grab the URL and feed it through a shortener, and encode that into a QR code, printed on stickers, that they them plaster over the legit QR codes.

Unless you're looking at the URL, and let's face it, most people don't, the sites are similar enough that they are just handing their credit card info over to an attacker, thinking they're paying for parking.

Of course, that's just one of many examples.

Personally, I don't generally trust anything I scan. Most of the time, the QR code has a website name printed next to it, and I'll scan the QR, because if it works and goes where I want to end up, so much the better, so I will follow the link, and if it lands at any URL that isn't what is displayed on the label with the QR code, I back out and type in the URL by hand.

I expect exactly zero users to have the same caution and attention to detail.

How though? You can still get TLS certificates for fake websites. Why do you think you couldn't properly sign a fake QR code?