Probably not as lucrative but I could envision people pranking others by replacing QR codes that take them to a "shock" site with obscene loud sounds but I do not know what would be considered shocking or obscene by today's standards. Perhaps this is already a thing.
Restaurants are also planting QR CODES in restaurants that steal your data, but the FBI isn't warning anyone about it. Just stick to physical menus. That way, nobody collects unnecessary data about you and your devices, and best of all you can make sure that you're getting the same prices and options as everyone else.
An increasing number of restaurants don't have physical menus anymore. "Just scan the QR code" the waiter says, as blithely as you say "Just stick to physical menus". Just nothing. These are societal-level changes, same as not accepting cash or requiring an app to pay for parking. It's easier for the business and 90% of consumers will go along with it. Too bad for everyone who gets hacked or doesn't have a smartphone or can't get a credit card.
Requiring hardware to order a meal at a restaurant is classist period. We all think everyone has a QR code readable device and a credit card so it's no sweat. I have those things but not always on me and it is laughable when I can't order something because of it. Paper menus, cash, and paper ballot counting. If someone in certain situations can't accept cash, I understand that.
And I had this man-in-the-middle idea first time I saw QR menus, but, instead, the bad actor DOES make the dish nextdoor so the customer is fine!
Its also such a worse user experience. Reading a menu off a smartphone screen is like having the menu printed out for you on post it notes. The big thing is great. I can see everything of the entire category at once in one skim. The mental load is minimal, which makes for easier conversation than when its mobile menus, and everyone sits there in silence with a craned neck.
I've had this happen. Then I told them I don't have a smartphone. In some cases the restaurant will then provide a tablet and in others suddenly paper menus are available. It hasn't happened yet that a restaurant decided to forego a bunch of income on account of my not having a smartphone, so maybe just say you don't have one and see what happens next?
This is also a perfect case for "voting with your feet". If it doesn't work to claim you have no way of viewing the QR code menu, turn around and walk out the door. (Obviously, this is more difficult to do with large groups but it's something which could be decided on beforehand, especially with smaller groups.)
I agree that on balance, they'd like the data. However, if people demand this, and one of the two (my vote would be Apple) responded to that, then I would think competitive edge would matter more than the marginal benefit of having menu browsing data.
(After all, the restaurants and credit card companies already have your purchase data.)
Not trying to start a bar fight, but I stopped paying attention early on when they were sending (easily misled?) people ways that didn't exist at their peril, and that sort of thing — I'm assuming that's all straightened out?
I don’t use it for navigation but I don’t recall any times when I learned that it’s wrong while using it for information about local businesses. That should be enough for the “QR menu only” flag at any rate.
(I only started using it the past 2-3 years, for what it’s worth. More to the point of your question, I would assume its quality of directions is at least “usable” given the accuracy of other things. Still an assumption.)
Menu browsing data is just what they're limited to right now. What they really want is to use the information on your device to get data about you like your income level, your past purchase history, even your demographics, and use that data to set individual prices for you. That way when you order a cheeseburger they can charge you more than the person who ordered a cheeseburger sitting next to you.
Discriminatory pricing is already used in some markets based on nothing more than what browser or OS you use. Apple/Iphone uses are sometimes charged more on the assumption that they have more money to spend.
The amount of data collection going on gives them huge opportunities to go much much deeper and companies have been experimenting with it and trying to push the public into accepting it for many years.
Right now, one of the biggest problems they have is that consumers (rightly) find discriminatory pricing offensive, but that's already shifted a lot with people mostly accepting that certain people should be given different prices than others because of who or what they are so long as it's presented as a reward for loyalty. Grocery stores that only offer "discounted" prices to loyalty card holders is one example the public has already swallowed.
The push for people to use their own devices in order to see a price or even what is offered for sale isn't something they're going to stop unless we constantly push back stronger.
I did this at a local place recently. It wasn't even a nice/fancy/new place, quite the opposite on all accounts. I just said we don't fiddle with our phones during meals, and requested a paper menu. They said no, and we left.
At minimum, they could have some kind of 'board' like sandwich shops, right? Having nothing but a QR code on a slip of paper taped to a table is ridiculous.
Lots of restaurants now have no menus, no register, and you can only order via phone. It's awful, but also so ubiquitous that walking out is pointless.
I haven't ever seen that myself, but if it is so ubiquitous where you are, I'd argue that walking out is anything but pointless, and that in fact it has become necessary.
Companies will abuse us to whatever extent we allow them to. Stop enabling them and their behavior. As long as you are capable of finding food somewhere else, you should do exactly that. If you don't exercise that option now, you may lose it entirely.
I have no problem with a restaurant knowing that an Android user (me) looked at their menu. Beyond that, there's very little they would know about me from reading their menu. What data do you think they are stealing by visiting a link to read a menu??
This is such an obvious vulnerability. It blows my mind that out here in SoCal - especially post-COVID LA-proper, you'll often encounter restaurants only providing menus via QR code.
Between that practice and the increasingly common outright refusal to accept cash, every time I visit friends in Santa Monica it's become an exceptional experience just to get a morning espresso using cash and no smartphone.
Yeah. It's honestly just really weird and a bit cringe.
I started to choose holiday destinations based on whether it's like, a normal business environment. This began during coronavirus, but now with the whole cashless thing becoming sticky it's become a seemingly permanent choice.
This is common here in Austin too. I don't usually mind; paying on my phone from the table is more convenient for everybody than waiting in a line to order, and if you're with friends you don't have to figure out splitting the check
But I'll definitely start giving the QR codes a closer look before scanning now
Yes, increasingly some places just don't maintain a print menu of any kind anymore.
At least in one case I was referred to an illegible chalkboard which I guess is better than nothing, even if it was incomplete. But being near-sighted it's preferable to hold a paper menu... Even if it's just some low-brow unlaminated printout I'd be satisfied! But nope, welcome to the future.
Nowadays if I find myself in such a place and they at least will accept cash for payment, I'll just make them describe the menu verbally. Maybe if enough of us generate that amount of inconvenience for them they'll get a clue and learn how to use a printer.
It's like it's part of their trendy/hipster image to not have menus and do everything through a phone. Part of how they appeal to a younger demographic perhaps? I think that's the visible aspect, but the deeper motive is more about invading customers' privacy by getting hooks into their phones. Then on the cashless side it's discriminatory and rooted in mistrust of employees handling cash...
Anything that requires the use of a smartphone discriminates a bit against the large group that is the most reliable voting block in most western democracies: people over 70. Yes, lots of them have and fluently use smartphones, but plenty of them don't, and most smartphone interfaces are awful for anyone with less steady hands and diminishing near vision.
To me, this is a coordination problem: how to get very technical privacy enthusiasts working together with older people who only wish to be allowed to keep getting around their normal worlds in a way they fully understand. We want what we want for very different reasons, but what we want ends up being effectively the same things.
> awful for anyone with less steady hands and diminishing near vision
You are obviously right when it comes to lack of steady hands, but diminishing near vision is no reason not to use a smartphone. In fact, speech synthesis is what kept blind people mostly functioning in this new world. IOW, if you no longer can see the screen, turn on your smartphones screen reader. Android and Apple both have them built in these days, so you dont even have to buy anything extra.
> the deeper motive is more about invading customers' privacy by getting hooks into their phones
They just do it because it's easier. No menus to print and update every week or however often. Out of salmon today? Just take it off the menu with a few clicks. It's easier for the same reason that most of us would write a letter in Vim or Emacs or Word or whatever and not on a typewriter.
I dislike this trend as I almost never carry a phone and even if I did an A4 menu seems loads easier than a 6 inch screen, and any half-way decent restaurant should just print a menu because it's not that hard or costly, but there is no secret motive here beyond that it's just a bit easier for restaurants.
They were definitely already pushing cashless pre-COVID, but COVID green-lighted a lot more of it in the name of flattening the curve by being "contactless".
The same rationale was being used to push the QR codes and deprecating paper menus.
COVID-19 is a master class of "never let a good crisis go to waste".
BTW it wasn't strictly about keeping homeless out, it's also to prevent theft of the register by staff. This is definitely not a one-dimensional issue. But I do think the discrimination against the homeless facet is all the cities need to outright ban the practice for their licensed public-serving businesses.
Staff would also prefer not counting cash and having to be responsible. My first job in high school was at Dunkin and I hated having to count $2000 worth of coins and bills at the end of my shift. I'd gladly break a $50 or $100 bill for people so that it'd be easier to count at the end of the day. One day my drawer was $100 short and thankfully the manager believed me. Protocol is for each staff to have their own drawers and swap them in/out but in practice everybody shares drawers making accountability more like whomever the manager dislikes that week.
Homeless people should just buy a prepaid debit card and top it up at supermarkets. Cash has no place in a modern society.
Cash is an anonymous form of payment, it is secure and untraceable. Anyone can get it and it is not associated with anyone in particular. It doesn't just have a place in modern society, as long as we live in a money system, to protect the privacy of citizens it is necessary that we use cash.
I know there are activation fees but I didn't know there are per-transaction fees. A system like Bangkok's Rabbit cards would be better (no fees beyond the fee for getting a card) or Japan's SUICA cards. They are transportation cards that also get accepted at convenience stores and some restaurants and you can top them up at any train stop.
In my country your worthiness to get a homeloan goes down for even a few dollars worth of lotteries tickets on your bank statement. Same with alcohol or cigarettes.
So because of some bullshit, trifling adolescent inconveniences you had with cash, you now neatly enclose yourself off into a categorical belief that cash "has no place" in society. Never mind how the prepaid cards you speak of only encourage more parasitic fees and costs to the most basic aspects of living for poor people, or how the fundamental privacy of paying for daily things without having all your choices registered and judged by cold, remote, closed systems is something to applaud. But none of those matter details right? The important thing for how the world should work is your own little bubble of personal comfort.
A rather disgusting number of people on this site share these kinds of narrowly elitist ideas of how the world should work, based purely on their own privileged experiences and notions.
Many businesses dislike cash because it's just a hassle. It takes more time to charge and give change, you need to make sure you have change, employees can steal it, you can be robbed, you need to count it, you can make errors, you need to bring it to a bank.
I'm not from the US so I'm a little bit hesitant to push back too strongly on this as I can't speak to the situation there, but from my experience homeless people don't really factor in.
I don't begrudge a place not dealing in cash, but the no paper menu thing is really annoying, and I find surprising unanimity among my friends about this. I am currently in NYC but visit LA regularly.
DailyMail? Why are these low-effort articles posted on hacker news?
Also,
> Instead of taking you to an online menu or checkout, the links instantly download malware onto your device, stealing your location and personal information
How is that supposed to work? Specifically on iOS?
There's unfortunately a large subset of HNers that find rags like DailyMail, New York Post, and ZeroHedge reputable. Makes it really important to check the source before engaging.
NYPost is in a liminal spot; for example, if it's saying something happened in NYC, that thing likely happened in NYC, in my experience. Its commentary on said event can likely be ignored if it's the kind of event that gets right-wing voters riled up, but it doesn't just make shit up. It's not Breitbart or something lol, and if the issue isn't a political hot topic, I don't know if one needs to avoid it
IIRC, you can put entire binaries in QRCodes, and some have shown this by putting the game 'snake' in a QRCodes, such that if you point your camera towards the QRCodes with the camera on, it will start the game automatically. Fun... but yes, potentially an avenue that can be misused.
Did that article seriously never once link or present the primary source they are reporting on? I feel as though I know less now than I did before I started it, and not in a 'the world is so much larger than I knew' way.
Ok, taking this story at face value _despite_ it being from the Daily Mail...if your phone can "instantly download malware onto your device, stealing your location and personal information" without any prompting or further user action by simply visiting a URL, that seems like something the FBI should be warning device manufacturers about instead of the average person.
"QR codes scary and bad!" isn't a very productive line of discussion.
That article is stunningly light on actual substance, other than "you can generate QR codes with this repo" with a link to a repository that doesn't exist anymore. The best case they give for "issuing commands" is encoding a WiFi access point into a QR code. So you can encode a URL, or you can encode your WiFi data, because the data in a QR code is _literally text strings_. You could _possibly_ stick some malicious Javascript in it, but again, if your device is allowing JS to randomly exfiltrate data from your phone through your browser, something worse is going on.
The actual statement from the FBI on this subject says "While QR codes are not malicious in nature, it is important to practice caution when entering financial information as well as providing payment through a site navigated to through a QR code." So the danger is really visiting malicious URLs, which was the entire point of my previous post.
It's funny how info travels. A local news site did a story about fraudsters covering up the "scan to pay" qr codes on parking meters with qr codes that take you to a fraudulent site. Totally plausible.
They throw in an unsourced assertion at the end that maybe hacking is possible. That then becomes the focus of this daily mail article.
I guess the assumption is that people just click "sure" when asked for location info "because whatever". I don't use these QR codes, but so many things apps and websites seem to ask for it, it probably doesn't stand out as much as it should. And especially in a situation where you're distracted by your friends or that exciting date or whatever after a beer or two I could imagine me doing that as well to be honest. I'm not stupid, but I'm also not on 100% alert all the time.
Not that I don’t implicitly trust a tech article on the Daily Fail, but are there any documented cases of this actually happening? The article was very light on specific details.
About a month ago we saw very similar headlines that turned out to be misleading. The FBI posted a warning about juice jacking. The FBI left off that there's no evidence it has ever happened and their post was only based on a 2019 press release by another agency stating that the hack might be possible.[1]
This article is source to a local news article.[2] The assertion that scammers could use QR codes to deliver malware is the only fact in the article without a citation. The security expert they interview is warning about phishing pages, like a sticker on a parking meter that leads to a fraudulent payment site.
It's also odd they cite only to "the FBI". These articles tend to cite either to a specific FBI spokesperson or to a specific FBI office. It's possible the journalist took the interview with the security expert and merely found something on some FBI website in order to get the better headline.
Whether or not this particular thing is true, everyone should automatically downvote Daily Mail articles when they see them unless they’re specifically looking for fun celebrity tabloids to read.
It’s not a good news source.
Find the story written by a better publication and link to that.
Love the newish square payment flow where you're handed a receipt with a QR code that directly takes you to a payment page. use apple pay and you're out in 20 seconds!
No idea how they know if you're dine and ditching though. Saw several places with this in NYC in march. Have only seen it at El Techo and Freekeh in SF.
80 comments
[ 4.1 ms ] story [ 140 ms ] threadAnd I had this man-in-the-middle idea first time I saw QR menus, but, instead, the bad actor DOES make the dish nextdoor so the customer is fine!
That said, it only works if enough people do it and if the feedback actually gets back to the restaurant owners.
I would love to see “had QR menu” as a label on Apple and Google Maps so that I’d know not to bother with the restaurant in the first place.
What % of pages would you guess load from a QR code without Google Analytics?
(After all, the restaurants and credit card companies already have your purchase data.)
Not trying to start a bar fight, but I stopped paying attention early on when they were sending (easily misled?) people ways that didn't exist at their peril, and that sort of thing — I'm assuming that's all straightened out?
I don’t use it for navigation but I don’t recall any times when I learned that it’s wrong while using it for information about local businesses. That should be enough for the “QR menu only” flag at any rate.
(I only started using it the past 2-3 years, for what it’s worth. More to the point of your question, I would assume its quality of directions is at least “usable” given the accuracy of other things. Still an assumption.)
Discriminatory pricing is already used in some markets based on nothing more than what browser or OS you use. Apple/Iphone uses are sometimes charged more on the assumption that they have more money to spend.
The amount of data collection going on gives them huge opportunities to go much much deeper and companies have been experimenting with it and trying to push the public into accepting it for many years.
Right now, one of the biggest problems they have is that consumers (rightly) find discriminatory pricing offensive, but that's already shifted a lot with people mostly accepting that certain people should be given different prices than others because of who or what they are so long as it's presented as a reward for loyalty. Grocery stores that only offer "discounted" prices to loyalty card holders is one example the public has already swallowed.
The push for people to use their own devices in order to see a price or even what is offered for sale isn't something they're going to stop unless we constantly push back stronger.
At minimum, they could have some kind of 'board' like sandwich shops, right? Having nothing but a QR code on a slip of paper taped to a table is ridiculous.
Companies will abuse us to whatever extent we allow them to. Stop enabling them and their behavior. As long as you are capable of finding food somewhere else, you should do exactly that. If you don't exercise that option now, you may lose it entirely.
Between that practice and the increasingly common outright refusal to accept cash, every time I visit friends in Santa Monica it's become an exceptional experience just to get a morning espresso using cash and no smartphone.
https://www.youtube.com/watch?v=wd4YgudTcnM
I started to choose holiday destinations based on whether it's like, a normal business environment. This began during coronavirus, but now with the whole cashless thing becoming sticky it's become a seemingly permanent choice.
What??
> increasingly common outright refusal to accept cash
Well, those two things alone are excellent reasons for me to avoid going there.
But I'll definitely start giving the QR codes a closer look before scanning now
At least in one case I was referred to an illegible chalkboard which I guess is better than nothing, even if it was incomplete. But being near-sighted it's preferable to hold a paper menu... Even if it's just some low-brow unlaminated printout I'd be satisfied! But nope, welcome to the future.
Nowadays if I find myself in such a place and they at least will accept cash for payment, I'll just make them describe the menu verbally. Maybe if enough of us generate that amount of inconvenience for them they'll get a clue and learn how to use a printer.
It's like it's part of their trendy/hipster image to not have menus and do everything through a phone. Part of how they appeal to a younger demographic perhaps? I think that's the visible aspect, but the deeper motive is more about invading customers' privacy by getting hooks into their phones. Then on the cashless side it's discriminatory and rooted in mistrust of employees handling cash...
What is the vector for privacy invasion beyond the normal for visiting a website? Is there a company offering pay for access here or something?
To me, this is a coordination problem: how to get very technical privacy enthusiasts working together with older people who only wish to be allowed to keep getting around their normal worlds in a way they fully understand. We want what we want for very different reasons, but what we want ends up being effectively the same things.
You are obviously right when it comes to lack of steady hands, but diminishing near vision is no reason not to use a smartphone. In fact, speech synthesis is what kept blind people mostly functioning in this new world. IOW, if you no longer can see the screen, turn on your smartphones screen reader. Android and Apple both have them built in these days, so you dont even have to buy anything extra.
Trendy and hipster would be opposite of that
They just do it because it's easier. No menus to print and update every week or however often. Out of salmon today? Just take it off the menu with a few clicks. It's easier for the same reason that most of us would write a letter in Vim or Emacs or Word or whatever and not on a typewriter.
I dislike this trend as I almost never carry a phone and even if I did an A4 menu seems loads easier than a 6 inch screen, and any half-way decent restaurant should just print a menu because it's not that hard or costly, but there is no secret motive here beyond that it's just a bit easier for restaurants.
The same rationale was being used to push the QR codes and deprecating paper menus.
COVID-19 is a master class of "never let a good crisis go to waste".
BTW it wasn't strictly about keeping homeless out, it's also to prevent theft of the register by staff. This is definitely not a one-dimensional issue. But I do think the discrimination against the homeless facet is all the cities need to outright ban the practice for their licensed public-serving businesses.
Homeless people should just buy a prepaid debit card and top it up at supermarkets. Cash has no place in a modern society.
Cash is an anonymous form of payment, it is secure and untraceable. Anyone can get it and it is not associated with anyone in particular. It doesn't just have a place in modern society, as long as we live in a money system, to protect the privacy of citizens it is necessary that we use cash.
It's expensive to be poor and the vultures are even more on you ripping you off.
Obligatory addition: https://whatever.scalzi.com/2005/09/03/being-poor/
In my country your worthiness to get a homeloan goes down for even a few dollars worth of lotteries tickets on your bank statement. Same with alcohol or cigarettes.
A rather disgusting number of people on this site share these kinds of narrowly elitist ideas of how the world should work, based purely on their own privileged experiences and notions.
I'm not from the US so I'm a little bit hesitant to push back too strongly on this as I can't speak to the situation there, but from my experience homeless people don't really factor in.
Also,
> Instead of taking you to an online menu or checkout, the links instantly download malware onto your device, stealing your location and personal information
How is that supposed to work? Specifically on iOS?
Or one that runs in a browser: https://github.com/ingSlonik/QR-Snake
Opening a URL automatically would depend on how your camera/scanner app is configured.
Is there a reason to be distrustful because it's foreign?
From whose perspective is it foreign?
"QR codes scary and bad!" isn't a very productive line of discussion.
https://hackeracademy.org/how-to-hack-using-qr-codes/
a nontrivial amount of effort has been applied to this topic
The actual statement from the FBI on this subject says "While QR codes are not malicious in nature, it is important to practice caution when entering financial information as well as providing payment through a site navigated to through a QR code." So the danger is really visiting malicious URLs, which was the entire point of my previous post.
They throw in an unsourced assertion at the end that maybe hacking is possible. That then becomes the focus of this daily mail article.
https://news.ycombinator.com/item?id=35809719
FBI warns hackers are eating your children.
FBI warns (highly unlikely thing).
How about the media actually find out how often X is happening before parroting government and corporate press releases?
This article is source to a local news article.[2] The assertion that scammers could use QR codes to deliver malware is the only fact in the article without a citation. The security expert they interview is warning about phishing pages, like a sticker on a parking meter that leads to a fraudulent payment site.
It's also odd they cite only to "the FBI". These articles tend to cite either to a specific FBI spokesperson or to a specific FBI office. It's possible the journalist took the interview with the security expert and merely found something on some FBI website in order to get the better headline.
[1]: https://slate.com/technology/2023/04/free-public-phone-charg...
[2]: https://abc-7.com/news/cover-story/2023/05/01/fbi-warns-of-q...
It’s not a good news source.
Find the story written by a better publication and link to that.
No idea how they know if you're dine and ditching though. Saw several places with this in NYC in march. Have only seen it at El Techo and Freekeh in SF.