this post was submitted on 23 Sep 2024
210 points (97.7% liked)
Privacy
32130 readers
1125 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
scanning a random qr code has to be this generation's plugging in an unknown usb drive.
I mean, unless somebody is burning browser zero days on random public QR codes I'm not too worried.
Browser zero days are some of the most valuable exploits in existence, so I highly doubt it would happen in practice
It's easier to take precautions though. You probably don't have an insulated USB port or throwaway host device but handling QR codes safely just takes basic tech and skill.
Important advice:
Recommendations:
I think today's generation's equivalent is free Wi-Fi networks. Kids without mobile data in an area without an established public network will connect to just about any open one unless the SSID includes "LaserJet" or similar.
If it's one of these QR codes at a restaurant for ordering, the parameters could possibly be necessary to properly connect your order to your table, depending on how they're set up.
Then it's not a tracking parameter of course.
WiFi and cellular networks as well. Using cellular data without some kind of tunneling for traffic/dns is nuts IMO.
I keep meaning to look more into how qr codes work. I always wondered if there were possible attack vectors if a bad actor exploited a flaw in the decoding of the image. My mind went to a zip bomb for no apparent reason (a tiny file that unzips to a massive amount of data on disk)
That is very decoder-specific. The most common QR reader apps are the Camera app on iPhones and Google Lens for Android so you'll want to target one of these (though Google Lens might be using cloud processing for that). There probably won't be any exploits in the image processing part but you obviously can write arbitrary data (including ASCII control characters such as CR, LF, null) into the "data" part of the QR code, as the encoding mode and data length is stored in the first 4+(n*8) bits of where data would be instead of null byte termination. Normally, the data is then right-padded with repeating
0xEC11(or not) and then error correction follows (number of bytes in the error-correction part is defined by the size and ECC mode indicated in another region).You just don't open the link
You would at least be able to examine the link first.
That's why this.