Re: Recognising (or not) QR codes

On 4 Jul 2025 18:30:16 GMT, Stefan Ram wrote :

  If just one QR code out of a hundred is bad, that means you
  have a one percent shot at running into a malicious one.
 
  Security is all about checking everything in a group, since
  you never know which ones might be sketchy. Like, here in
  Berlin, if you show up to a concert with a bag, some guy is
  going to look through it. Even if hardly any bags have anything
  they shouldn't, they still have to check every single one.
 
  I really don't have any hands-on experience with QR codes, and
  I barely know how they work, but I figure they just hold URIs
  that get opened up. That would make them active content.
 
  Letting stuff run without the user doing anything is risky,
  kind of like letting macros go off in a doc file as soon as you
  open it. Imagine if every time you downloaded an exe, it just ran
  right away. That would be a nightmare!
 
  So, if that's actually how QR codes work, that needs to be
  fixed. When you scan a QR, it should just show you the text
  and let you copy it if you want. If you decide to open it
  as a URI, that should be your call.

Your example is spot on the money, as is your approach to security.
And your point of view seems to me to be sensibly logical & reasonable.

While my initial posts to this thread prove I don't usually deal with QR
codes, many people already mentioned in this thread that if the QR code
resolves to a URL, it's no different than any other URL on your system.

They all mentioned to Joerg that whether or not that URL is "active"
depends on how the user has set up their phone once it resolves the URL.

Does the phone ask the user to manually approve "going to" that URL?
Or does the phone just automatically "go to" that URL?

I don't know really, as I said from the start I was only helping out the OP
by suggesting QR code readers that I had tested long ago & didn't fail.

I suspect it depends on how the user sets up the system to act on URLs.
But I'll let those who actually use QR codes in daily use answer that.