undefined | Better HN

0 pointsHenryBemis6y ago0 comments

I don't want the camera to "think", I want it just to take photos. Otherwise someone can spread small stickers with QR commands/URLs and your phone is trying to connect to www.sex-pills-malware.com/download-nasty-file.html

XKCD's bobby tables comes to mind. Sanitize your inputs. If you point & click and you immediately process what your camera sees, there is great risk in that.

I want a photo to be a photo. If I want to scan a QR code for the purpose of scanning a QR code, I use some special app (and Ι block it's Wifi/3G connectivity to enusre the QR app will not leak what Ι just photographed).

Edit: I follow the Steve Gibson school of thought. I want the "thing" to do the "thing", and nothing but the "thing". Camera should do camera-ing (adjust camera-related-attributes). QR app should do QR-app-things (show me in clear text the QR code and ask me what do I want to do with it)(register WiFi, visit a website, etc).

0 comments

2 comments · 2 top-level

alias_neo6y ago

Without trying to be funny, perhaps you should use a camera then and not a phone, to take photos? You're already in the realm of your device doing many more things than "the thing".

As for scanning automatically, no camera app based scanner I have witnessed performs any action in response to finding a QR without user input. Of course this could still happen accidently or by the QRs content finding some vulnerability.

At the end of the day, I think QR scanning in the camera is the obvious solution to non-hacker-news-browsing-people, and to make it go mainstream it needs to be accessible.

In spite of the above, I still agree with you, and use a barcode scanner from f-droid myself.

lozf6y ago

IME the screen just shows a link icon when it detects a qr code, when the user taps the icon, the URL is displayed, and then the user taps again to browse to it / download / accept settings etc.

j / k navigate · click thread line to collapse