How would you make an arbitrary QR code have a verifiable signature?
I can see a system where you have to scan the QR code in a specific app for that purpose (e.g. a dedicated QR code payment app which approved businesses sign up to, which either includes or remotely queries a database of valid endpoints). At that point though, where you’re requiring a dedicated app anyway, you may as well invent your own 2D code system with blackjack, hookers and signing. But yeah, I don’t understand how this would work otherwise. QR codes just aren’t made for security. They shouldn’t be used anywhere security is required.
QR codes just aren’t made for security. They shouldn’t be used anywhere security is required.
I get what you’re saying but it’s at least a little bit funny that they are regularly used for security in the form of scan to login (e.g. Steam), verify your session (e.g. Matrix), etc. Of course these are in a closed ecosystem so the QR code itself is not the security. But I just found it funny you said that when 90% of my QR code usage is for security.
I mean, generating a one time QR code for login is one thing. It’s the equivalent of a one time password. But a permanent QR code is not that. They still aren’t inherently secure, but they can be used in situations where showing a code in plain text would be just as secure.
Well, by using a QR code you don’t have to invent your own 2D system, as blackjack and hookers aren’t really necessary.
Just make your own URI protocol, and encode any signature in the link. Bonus if you can register your protocol in Android or IOS, but I don’t know if this is possible.
If you’re running a public service, you should have a key that’s trusted by a CA anyway. So why couldn’t you, especially for qr codes that link to an https site, embed a signature in that qr code that verifies that the person that owns parkyourcar.com’s private key also created the code you just scanned? Just like signed pdfs?
Okay and what happens when I overwrite that qr code with one that points to downloadvirus.com? How is a client supposed to know that the qr code isn’t supposed to be here?
Well, because it won’t be signed by a trusted CA for that task. Like if CAs had a category of certificate issuance that applied here (the standardisation issue) then it would be easy to spot a fake (which wouldn’t be correctly signed). Alternatively, you could take the European approach of having everything government related (like public street parking, though Europe mostly uses apps for that, not signed QR codes) rely on government entities and those in turn on a national set of government CAs.
A verifiable signature could be created but the use of public keys lets malicious actors to sign using the same key
This seems to be a gross misunderstanding of public key cryptography. Public keys allow you to verify an existing signature is valid and made by the correct entity, but they absolutely don’t allow you to forge a signature: that’s actually what they are designed to prevent.
Find yourself a QR scanner that gives you a preview of what the code is before sending you to the open web.
I like this one, found it on F-droid. “QR Scanner (PFA)” https://github.com/SecUSo/privacy-friendly-qr-scanner
For example, the QR code sirico@feddit.uk posted (it can scan from a saved picture too) shows me this;
Wait, do normie phone, just, instantly open an untrusted website? The camera on LineageOS has a “scan” mode where it shows the data of scanned QR codes before you make an action.
Yup, modern security at its finest. Normie’s don’t stand a chance.
I wish email clients would do something similar, especially for Formatted links.
Open up a big popup that shows the full sender address, the full link, and underline/color any numbers so its clear AMAZ0N.com is b.s.
I remember thinking this years ago when I saw a QR code for paying for parking. I don’t want to buy a printer though, otherwise I would have printed one to link here.
Voyager (wefwef). Great app. Just realized they’ve got newer link
It’s Voyager (formerly wefwef). It’s a Lemmy clone of Apollo but also works on Android which is pretty cool
For some reason this didn’t really occur to me.
I don’t see QR codes as a potential attack vector… At least, I didn’t… Until now.
It’s weird because I’m usually the one pointing out issues with everyone else’s plans… I didn’t realize I still had blind spots on this. Oh well, I’m only human.
It’s not like the code will straight up send money somewhere the moment you scan it. Can they even do more than open an app or a website? The default scanner with my Pixel doesn’t even open it without first telling you where it’s going.
Due to the limited amount of information stored in QR codes, it’s generally a shortened URL, so usually that doesn’t tremendously help at informing where you are supposed to end up.
If you’re trying to do something unique, that you don’t normally do, which IMO is the entire use-case of QR codes (go here to do the thing), and you’re expecting… Say, a website for paying for parking, then… It wouldn’t be hard for an attacker to create their own mock-up of the site, grab the URL and feed it through a shortener, and encode that into a QR code, printed on stickers, that they them plaster over the legit QR codes.
Unless you’re looking at the URL, and let’s face it, most people don’t, the sites are similar enough that they are just handing their credit card info over to an attacker, thinking they’re paying for parking.
Of course, that’s just one of many examples.
Personally, I don’t generally trust anything I scan. Most of the time, the QR code has a website name printed next to it, and I’ll scan the QR, because if it works and goes where I want to end up, so much the better, so I will follow the link, and if it lands at any URL that isn’t what is displayed on the label with the QR code, I back out and type in the URL by hand.
I expect exactly zero users to have the same caution and attention to detail.
