1import{j as e}from"./index-0qbe4j-K.js";import{P as t}from"./prose-CP3GO64z.js";import{L as a}from"./react-vendor-CuqwDvgQ.js";function o(){return e.jsxs(t,{children:[e.jsx("p",{children:'Everything security training taught people about links stops working at a QR code. "Check the URL before you click" assumes a URL you can see - and a QR code is a link with the text removed.'}),e.jsx("h3",{children:"The one defence, disabled"}),e.jsx("p",{children:"Reading a domain backwards from the first single slash is the check that catches most phishing. A printed square offers nothing to read. You point a camera at it and the destination is revealed after you have already committed."}),e.jsx("p",{children:"Most phone cameras now preview the URL before opening it, which helps - but the preview is small, truncated, and appears at the exact moment you are expecting to be taken somewhere. It is the weakest possible moment to be asked to evaluate a domain."}),e.jsxs("p",{children:["Every trick from"," ",e.jsx(a,{to:"/learn/how-a-malicious-link-hides-in-plain-sight",children:"how a malicious link hides in plain sight"})," ","still applies inside that square, and the homograph ones are worse: you cannot inspect a character you never see rendered."]}),e.jsx("h3",{children:"Where the codes come from"}),e.jsx("p",{children:"The practical attack needs no technical skill. A sticker goes over the code on a parking meter, a restaurant table, or an EV charger. The replacement leads to a convincing payment page. Nothing was hacked; something was covered up."}),e.jsx("p",{children:"A physical code in a public place has a threat model closer to a flyer under a windscreen wiper than to a link on a website. Treat it as a claim by whoever last had physical access."}),e.jsx("h3",{children:"They do more than open pages"}),e.jsx("p",{children:'A QR code can carry a WiFi network with its password, an email or SMS pre-addressed and pre-written, a contact card, or a TOTP seed. Scanning can therefore join a network, prepare a message, or provision a second factor - none of which look like "opening a link".'}),e.jsxs("p",{children:["The TOTP case is the one worth pausing on: a 2FA setup code contains the shared secret in plain text, which is why a screenshot of one is a credential. That is covered in"," ",e.jsx(a,{to:"/learn/what-a-2fa-qr-code-contains",children:"what a 2FA QR code actually contains"}),"."]}),e.jsx("h3",{children:"What to actually do"}),e.jsxs("ol",{children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Prefer typing the domain."})," For anything involving payment or credentials, the address bar is right there and takes five seconds."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Read the preview properly."})," Check the registrable domain, not that the string contains a familiar brand name somewhere."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Look at the physical code."})," A sticker over printed material, a peeling edge, a code on a different substrate to the sign it sits on - all worth a second glance."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Be suspicious of urgency."}),' "Scan to avoid a fine" is the same lever as "your account will be closed", pointed at a camera.']})]}),e.jsx("h3",{children:"If you are the one generating them"}),e.jsxs("p",{children:["Point QR codes at a domain you control, not a shortener - a shortened link is unverifiable by definition, and it means you cannot change the destination without reprinting. Use the"," ",e.jsx(a,{to:"/tools/qr-studio",children:"QR Studio"})," to generate them locally, which also keeps a WiFi password or a TOTP seed off a third party's server."]}),e.jsx("p",{children:"And print the URL underneath. It costs a line of text and gives the person the check you would want them to make."})]})}export{o as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.