Re: Recognising (or not) QR codes

On Fri, 4 Jul 2025 19:47:51 +0100, Andy Burns wrote :

   So, if that's actually how QR codes work, that needs to be
   fixed. When you scan a QR, it should just show you the text
   and let you copy it if you want. If you decide to open it
   as a URI, that should be your call.

 
Despite what Vanguard said, I'm not aware of any QR app that
automatically visits a URL, or connects to a wifi SSID, or calls a phone
number *just* because you scanned one of those types of QR code ... it's
akin to saying mice are dangerous because you can click links with a mouse.

No, out here, mice are dangerous 'cuz they carry the hantavirus, which,
unfortunately for us, has a 1/3rd mortality rate, which is scary.

Thanks Andy for answering that question since we all learn from each
others, and since I, personally, have little experience with QR codes.

I suspect you "can" set up a QR-code-reading app to "automatically" visit
the URL, but, before I even say it, I realize how absurd that would be in a
typical environment (although in some vetted environments, it could be set
up to automatically visit the site - such as in store-management tasks).

With that in mind, and knowing nothing from Joerg (or Vanguard) is
balanced, I would say what I do on Windows & Android is I set up the
*default* web browser to be something that does NOT auto-visit links.

For example, Tor browser is my default web browser on all platforms.
My Tor browser is set up NOT to connect when it's brought up.

This means no URL has a chance of executing automatically that way.

(Of course, malicious code can choose any browser, I guess, but even then,
I don't have any of the normal browsers on my phone so maybe not for me.)