Re: Recognising (or not) QR codes

Chris Green <cl@isbd.net> wrote:

OP here. Yes, I've installed Google Lens (easiest option) and now I
can scan QR codes.

I have an 8-year old old Android 8.0.0 phone that has the Google search
bar as a widget on the home screen.  At some point, it got updated to
add a camera icon.  I tap on that icon, and use it to take a snapshot of
something.  I've used it to identify plants.  It can also read QR codes.

My concern is a QR code can contain a URL.  Those are sometimes used to
prevent typos by users to define a URL to a web site, or, I suppose, to
add convenience of not having to enter a string into an address bar of a
web browser.  In any case, the QR scanner could just open a web browser
to the URL without prompting the user to tell them to where the QR code
points.  You could end up going somewhere you don't want to go, or
somewhere malicious.  QR codes can be produced by anyone, and I've seen
them online, too. 

I use a QR scanner app that shows the content of the QR code BEFORE ever
going anywhere; i.e., you get told what is the content, and if a URL
then you see it before you choose to use it.  Since the app focuses on
scanning QR codes instead of taking pictures of anything and then trying
to identify what's in the pic, it auto-focuses on a QR image.  I just
tried it: load the QR scanner, point the camera at something with a QR
code image, and the app detects where is the image, locks in on it, and
captures it.  Then it shows the content.  Makes it easier to get the
phone at the right distance for its camera to get the image in focus,
and then takes a pic without me having to move the phone a bit while my
fingers manage to tap a button to take a pic.  Auto-locking onto the QR
image also lets me know it found one rather than taking a pic and hoping
the QR image was fully within view and right-distanced to be in focus.

While Google Lens got embedded into the Google search bar widget, so
that is also usable for scanning QR codes, and taking pics of other
stuff to identify, a dedicated QR scan app might be more convenient, and
perhaps safer.

Alas, with Kaspersky discontinuing their QR scanner app back in 2022,
it's not on the Google Play Store site anymore.  If I lost it, like
uninstall to find it was no longer available to reinstall, or for a new
phone setup, I'd have to find another QR scan app that first shows me
the content of a QR code rather than conveniencing me by automatically
loading a URL into a web browser to go their without asking first for
permission to go there. 

Trend Micro has one at the Play Store.  It will pause to show the URL
(if that is what the QR image contains), and prompt if you want to go
there.  It also indicates if the target site is evil, but I suspect it's
just using Google's SafeBrowsing API to check reputation.

I didn't have any handy QR coded stuff around my home to check if any
contained URLs.  Mostly they were text strings used to identify the
product, like a QR image in the product label on some tools.  As such, I
didn't bother to test if Trend's QR scanner was better or worse than the
defunct QR scan app by Kaspersky, or if Google Lens (embedded into the
Google search bar widget) is safe for QR codes containing URLs (i.e., ig
Google Lens "shows before go").

Never assume a QR code is safe.

However my comment still stands about places that say "just scan the
QR code" without pointing out that you might have to install a program
for this to work.

When you told someone you drove to work, do you bother to describe to
them what type of vehicle you drove, or its brand and model?  That info
is not germaine to the topic of you driving to work unless the topic
involves describing the vehicle rather than you drive instead of walk,
bicycle, motorcycle, or bus to work.  The instructions probably also
don't mention you have to turn on your phone.  Can't possibly describe
everything without easily losing your audience, or have a pearl of
wisdom lost in a sea of bivalves.