• Lovable Sidekick
    link
    fedilink
    English
    06 months ago

    Does anybody configure their phone to automatically scan photos for QR codes and visit the links?

    • @LibreMonk@linkage.ds8.zone
      link
      fedilink
      12 months ago

      Not sure but I think QR codes that hold wi-fi creds would more likely be automatically processed by phones. Seems like an adequate attack surface. Maybe dodgy creds could overflow or do some kind of DB attack. Or even legit creds could lead someone to connect to a malicious hot-spot captive portal that the attacker carries.

    • @zurohki@aussie.zone
      link
      fedilink
      English
      06 months ago

      When my phone’s barcode reader app sees a web link, it fetches the page’s title to display next to the actual link. So it is going to that web server and fetching resources by itself. Even though it isn’t actually rendering the page and running javascript, it might be exploitable.

      • Lovable Sidekick
        link
        fedilink
        English
        06 months ago

        But that’s the barcode app - is it always running, looking for barcodes in all the photos you take? Because there are already shirt with giant barcodes on them - presumably just artistic with no meaning, but who knows?

        • @Malfeasant@lemm.ee
          link
          fedilink
          16 months ago

          I have a shirt with a QR code that goes to a Rick roll. It doesn’t work nearly as well as I’d hoped. Even people trying to scan it have a hard time, forget about anyone scanning it unknowingly. Mr. Astley did in fact let me down.

  • @HikingVet@lemmy.sdf.org
    link
    fedilink
    06 months ago

    Except if they were halfway intelligent they wouldn’t have it go automatically to the site.

    And when you do this and something goes really wrong criminal charges get laid.

    • @HalfAHero@lemmy.world
      link
      fedilink
      16 months ago

      Can we just get a website that plays a soundbite at full volume screaming about how they person is bad at privacy practices, maybe with Korn in the background for maximum embarrassment?

    • Krafty Kactus
      link
      fedilink
      English
      06 months ago

      I’m not sure if you could actually get criminal charges for this unless you were hosting the malware in which case that’s another issue. It would essentially be the same as walking around with a website URL on your shirt. The observer is responsible for typing in the URL or scanning the code and what they decide to do on the website that follows.

          • @HikingVet@lemmy.sdf.org
            link
            fedilink
            06 months ago

            I don’t know about the states, but here in Canada the government takes the position “ignorance of the law is not a defence”.

            • apotheotic (she/her)
              cake
              link
              fedilink
              English
              16 months ago

              You’re not being ignorant of the law - you’re being ignorant of the weird computer square printed on the shirt you thrifted

                • @LibreMonk@linkage.ds8.zone
                  link
                  fedilink
                  12 months ago

                  “Malice” implies intent. Accidents are not malicious. Neglect in the worst case. So certainly any charges could not be based on malice.

                • apotheotic (she/her)
                  cake
                  link
                  fedilink
                  English
                  0
                  edit-2
                  6 months ago

                  Christ you’re a cordial fellow

                  I was, I thought quite clearly, having a joking poke. Obviously “didn’t know lol” isn’t a defense.

      • @HikingVet@lemmy.sdf.org
        link
        fedilink
        06 months ago

        Not if it incites violence, causes harm or any of the other carve outs in the first amendment of the USA.

        I am aware that the post is supposed to be funny, and you are most likely making a joke, but this is the internet and these sort of disclaimers tend to be necessary.

        • @LibreMonk@linkage.ds8.zone
          link
          fedilink
          12 months ago

          A smart attack would be coupled with a clear message. Have the malware clobber them with anti-evil messages and just like that you have a sound free speech defense.