HN Explorer

Show HN: Scan QR codes to check in guests registered via Google Forms (workspace.google.com)

115 points by komlan ↗ HN
Hi HN!

I made a no-code platform for creating physical data collection apps, using QR codes [1]. It does not yet have a self-service config UI though, which limits adoption.

That's why I recently released a Google Forms™ add-on for QR code check-in, based on the platform. This focused use-case makes it easy to provide a fully self-service config UI.

How it works:

1. Create your Google Form as you normally would [2]

2. Activate the add-on if you hadn't already [3]

3. Craft a confirmation email to be sent to each form responder

Upon each form submission, the add-on will send a PDF with a unique QR code (a V4 UUID) to the responder.

Have guests present this code at the event, and record check-ins in bulk using the included QR scanner.

See here [4] for more information, or try the Google Sheets™ version [5] (which doesn't send email).

[1] https://admin.trak.codes/

[2] https://forms.google.com/

[3] https://workspace.google.com/marketplace/app/qr_code_ticket_...

[4] https://blog.darkaa.com/qr-code-pass-per-response-google-for...

[5] https://workspace.google.com/marketplace/app/qr_code_pass_fo...

67 comments

[ 18.1 ms ] story [ 143 ms ] thread
alaskamiller
What's cool also is that this is from the West African tech scene.
komlan
Busted! Curious what gave it away, my username?
davidjfelix
4th link to blog has a link to homepage. Homepage lists country in the footer.
komlan
Ah indeed ;)
dylan604
that's pretty good that someone went past your original link and looked at more of what you were doing. looks like the effort pays off!
komlan
Indeed; I didn't expect this level of interest, to be honest. The HN demographics didn't seem to match my target market.
etewiah
Awesome! You should be proud of this. I grew up next door in Ghana and I am delighted that someone from Togo is doing this. Well done.
komlan
Thanks tchalé ;) Btw, my parents never managed to decide if they were Togolese or Ghanaian
oh_sigh
Is there actually an international West Africa tech scene? Or is it nation by nation?
komlan
Mostly nation by nation, but key hubs like Nigeria/Ghana (English) and Senegal/Ivory Coast (French) draw other countries in, due to the presence of a larger pool of investors.
afandian
Just a reminder to anyone using Google forms that you may exclude non-Google customers.

My child’s school uses them and it often the forms ask for a login. Google doesn’t necessarily respect your choice to make a form public.

komlan
Indeed. This happens when the form is configured to collect "verified" emails.

A form can use a custom field (doesn't require login), user input managed by Google Forms (named "Email", doesn't require login), or the google email of the user ("verified" email, requires login).

This add-on supports every one of these options.

afandian
Thanks, that’s good to know.
unmole
> exclude non-Google customers.

There are literally dozens of them! /s

afandian
When you’re running taxpayer funded public services for millions of people that adds up.
rahimnathwani
I love the README/Overview on the linked page. It's really clear what this is for, why it's better than other solutions etc.
mlhpdx
I like this for the “sum is greater than the parts” aesthetic, which keeps the door open to so many applications.
komlan
Thank you!

The main platform is currently used by national post offices (physical mail tracking), health organizations (biological samples), banks (fixed assets tracking), manufacturing plants (parts inventory tracking), etc.

QR codes make it easy to avoid data-entry errors in quite a large set of use cases with physical objects.

samstave
This is WONDERFUL.

EDIT: nto "But for use for" -- I meant "But in ADDITION" --

But - for tool/item/inventory management in a garage.

Get a cheap label printer [0], create a form of your tools/inventory with a matched set (code on tool, code on location of tool home) - Tool home has a QR code that leads to a tab in the sheet with all the tools that live in that location, container.

Put airtags on the high-value tools, with links in the sheet to those.

but scan a code on a tool - and it tells you tool details, including owner, home, whatever data properties you like.

If you like barcodes/QR codes and GIMP - You will love BarTender (seagull Software [1])

It allows you to make ANY type of barcode you want, QR code, badge, etc etc.

Its AMAZING [Free*] software. (You only pay a cheapo $500 lic if you have a high volume printer for printing thousands of product labels fast - eles; its a super powerful free program with an utterly amazing and knowledgable supprt staf f (no affiliation)

Here is a test I did making "Card Carrying Conspiracy Theorist" badges based on a comment from someone saying they were one. THe QRs go to the /r/ profile - as does the bar code.

The image can be set as a template then do a merge for pics and employee data from a sheet....

https://imgur.com/a/eyAxpcb

(I like Guilloche designs (the swirly woven bits you see on money)) and so I used that motif - but the QR code placement and calc is automatic via Bartender.

I made a bunch of labels for a cannabis company - and I tied the QRs through a tinyURL which did all the geocoding of the QR scanning so that we could send product to a particular place, and then track where and how many people scanned the QR (the QR went directly to the lab test reports for the makup of the cannibis, CBD, etc...

So, then you could measure which market the CBD or THC were drawing most interest - and see how sales were vs scanning.

anyway - QR codes get a bad wrap. They are lame for menues - but a goot idea is to scan a QR code, then just have a folder of scanned links for purusal later - as opposed to launching safari when I clearly dont ue safari. :)

[0] https://www.amazon.com/qr-code-printer/s?k=qr+code+printer&p...

[1] https://portal.seagullscientific.com/downloads/bartender

---

>>>scan a QR code, then just have a folder of scanned links for purusal later

These get submitted to a personal GPT and it develops a learning module for you on your home portal which then gives you the run-down of all it has learned from that location QR or Context QR or Porduct QR.

But without a sticker - it will use either:

1. handheld laser engraver of the QR

2. an AI derived location based on meta data

3. an AI location based on image analysis

(forgive me if I am snowballing too much on HN, but I truly believe we are at an inflection point with a velocity that is being masked from us - SAs and his Ilk are not giving the fold the truth.)

komlan
Wow, happy to find another QR code enthusiast here! They simplify a lot of things, indeed.

Great use case! I did a tool inventory management use case once, with the underlying platform [1].

It starts with generating QR codes for sticker papers [2], from the app. Those never expire and are all different (v4 UUID). You can then assign a QR to any new item, then scan it for registration in the app, specifying room, drawer, etc. (and gps, picture, etc. if needed).

You can browse tools per room, drawer, etc., and scan anytime to record an update. Each tool gets a history trail.

You can even make data-entry easier by making special QR codes for drawers; scanning them fills some form fields with presets, so you don't have to manually select stuff and make mistakes.

I mostly see use-cases where other people scan a QR you made, but there are use cases where the QR codes are only ever scanned by you and your staff.

[1] https://admin.trak.codes/ [2] https://share.darkaa.com/!9DXEQQTg2z/trak-qr-codes-demo-hn.p...

samstave
The QR code, use, whatever isnt the problem to solve to. Its resolution.

This has always been a psychological issue with Humans and Signage.

Signage is a HUGE FUCKING DEAL (If you have ever had to some up with a signage policy for a Hospital with thousands of addressible spaces, where a certain population of 'stake holders' (nurses) are involved - getting naming/numbering correct in a large space where ALSO robots need to understand the convensions... that is south fast.

I have a bunch of solutions on this matter - if you really want to deep into coding... (I orignially designed a coding schema for Lucas Letterman which was shot down by the head of ILM engineering as "the worst Idea He had ever seen" to later incorporate that into his networking duties as head of networking at goog)

Anyway -- I am totally pro QR - but with GPTs, I feel like we are finally at the cusp to leverage them in a meaningful way.

(and for the downvoters - the schema I came up with for ILM was proposed in 2003, He didnt take the reigns at G until ~2008) - If GPT had been involved in some of my design projects- that would have been game changing, thus I propose that the most disruptable industy right now (aside from day trading) is construction.

Tons of models - but a model doesnt reflect real-world encounters/interactions/success...

(Honestly I dont know what to share, vs what to build.

onetimeuse92304
The issue is, at least for me, I consider all QR codes as unsafe. Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late. So you can't do the equivalent of inspecting the link before you click it.

Recently we were in a restaurant which required scanning a QR code to get served (for some reason asian restaurants like doing this). The codes were labels attached to the menu. I told the waitress "I can't scan the codes because I don't know who put the QR codes there". She told "the codes lead to their website". I told her "I don't know that, it takes a moment to print a label that looks exactly the same to my eye". She told me "it would then not point to their website". I respond if she knows what MITM attack is. She responded "if you can't afford a phone we should leave and go somewhere else".

The funniest is those QR codes left at random in public. I imagine scanning these is like finding a random pendrive and putting it in your computer.

abraae
> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late

What are you so scared of? It isn't the 90s where by tricking someone into following a dodgy link their windows machine was instantly pwned.

simon_acca
Remote code execution vulns are still routinely discovered, for example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4199...
EduardoBautista
I've never heard of this domain before, so I shouldn't click on it because vulnerabilities in the browser are still routinely discovered.

Sorry for the sarcasm, but if you trust clicking on links in a browser, QR codes should be fine as well.

fiddlerwoaroof
Yeah, if your threat model involves not trusting links, you should be disabling JavaScript and CSS by default and probably not browsing the web in the first place. Libpng and other libraries frequently have fairly critical bugs that are a bigger concern than MitM attacks.
ianbutler
Trust me when I say randos aren’t dropping modern 0days on restaurant menus. Not when a novel attack can fetch millions through brokers.
simon_acca
Not only do I agree with you, but I don’t think anyone would be able to tell an attack was imminent if they were to see the URL anyway. I was just providing facts to the comment above that didn’t seem to think RCE are a thing anymore.
ianbutler
Makes sense, my phrasing was poor I should have made that a more general statement not directed at you necessarily. I think the average techy has through some combination of general news like this and just enough technical know how formed an unrealistic threat model for themselves.
simon_acca
> the average techy has through some combination of general news like this and just enough technical know how formed an unrealistic threat model for themselves.

amen :)

simon_acca
There’s apps that just scan the qr code into a text field no matter what its content is, then you can inspect the URL manually.

Unfortunately there’s a deeper problem in this security model, in that only a tiny tiny fraction of the web’s userbase knows how to assess a URL, and even experts can easily struggle

precommunicator
> So you can't do the equivalent of inspecting the link before you click it.

Of course you can. Use an application that allows it.

EduardoBautista
> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late.

iOS shows the domain if it is a URL and you have to tap it. It's no different from tapping on a link on a website, which I would say is more insecure since you don't even get the domain info before tapping.

chatmasta
There are less privacy assurances when opening a QR code, since it can encode a URL with precise physical information embedded within its query parameters (like "table number" at a restaurant, for example). That kind of information isn't available to the typical website.

(FWIW, I actually wish more table QR codes did contain these parameters - why do I need to enter the table number in the form after navigating to the online menu? I hate these things btw...)

dweekly
This is true, but also mostly moot, sadly, due to the pervasive use of URL shorteners for QR code services.

So instead of seeing a nice hover-over of "SuperDeliciousItalian.com/menu", as often as not it will be "qr.to/f2CrS" or somesuch.

So exposing the URL encoded in the QR code doesn't provide all the information you need to assess its validity or safety.

hnlmorg
That’s a risk with any and all hyperlinks. There’s nothing unique to QR codes with that.
dylan604
while that's not exactly unique, it is something specific to QR codes. the longer the URL, the more complex the QR code will be. the more complex, the larger the block will need to be to ensure "scanability". most of the online free QR code generators I've seen have all recommended using a shortner. now, maybe they are trying to do that to collect all of the metrics they can by recommending a service that offer or get kickbacks from the shortening service.
hnlmorg
An attacker is far more likely to hide behind puny code or a misleading subdomain like microsoft.com.orders.com because that adds more legitimacy than a url shortener.

Professional uses of QR in advertisements would use URL shortening on their own domain, eg https://o2.com/trainpromo2 as that way they can demonstrate authenticity as well as owning the telemetry themselves.

Table service in restaurants don’t need to worry about data density because they have their customers literally sat at the table with the QR code in hand (it doesn’t get any easier to scan a code than like that).

If you’re dealing with a restaurant small enough not to have anyone manage the design then you can also bet that restaurant isn’t worth the effort targeting for this kind of attack. Think about what it would entail:

1. Having someone physically visit the restaurant

2. Measure that QR code so that you know the dimensions of the sticky label you want to print

3. Now visit that restaurant dozens more times to replace the existing QR codes. Each time hoping you get a different menu and/or table

4. Pull of this replacement in a short enough time so that people don’t report that their QR code does something different before you’ve captured enough devices (whatever your attack might be).

5. Hope that the owners don’t notice that the QR codes are now stickers (eg they don’t sit flush on the menu)

6. And hope that they don’t refresh their menus regularly. Which might even just happen because someone spilt the QR code / kids have drawn on it accidentally/ etc

7. And all the while, hope that you don’t get caught. Because restaurants will usually have cameras up. You better also not pay for your meal on card too.

It’s such an inefficient yet also high risk and short lived attack that it’s just not all that likely anyone would bother.

I do get the concern about opening up random websites, but rather than singling out QR codes specifically and letting everything else rot, I suggest we look at the root cause of the issues here. And that root cause isn’t QR codes.

dylan604
you do realize that a QR code "attack" doesn't have to be malicious, yeah? it could be some gorilla PR campaign of something like a local band essentially rick rolling the users. or sending them to the menu of the competing restaurant up the street. or goatse. or or or...

at that point, it could just be someone that printed up a bunch of stickers and plastered them on anything they could find. people love jokes. like unscrewing the salt/pepper shakers before they leave the restaurant type of asshattery. you really just need to get off this white knighting of the QR code and be a little more creative in your thinking of what could go wrong.

at this point, i'm just trying to keep going to make it look like this reply's length is worthy of what ever rabbit hole you went down in some vain attempt at trying to prove a point.

hnlmorg
> you do realize that a QR code "attack" doesn't have to be malicious, yeah? it could be some gorilla PR campaign of something like a local band essentially rick rolling the users. or sending them to the menu of the competing restaurant up the street. or goatse. or or or...

They can do that already just by placing their logo, or whatever, instead of a QR code.

Plus whether it is malicious or not, it’s still hugely inefficient given all the other points I raised.

> at that point, it could just be someone that printed up a bunch of stickers and plastered them on anything they could find. people love jokes.

Again, nothing about this needs to be a QR code

> like unscrewing the salt/pepper shakers before they leave the restaurant type of asshattery.

And yet nobody suggests you shouldn’t use salt and pepper shakers at a restaurant. So why are QR codes suddenly “dangerous” if they’re at the same level of “asshattery”?

> at this point, i'm just trying to keep going to make it look like this reply's length is worthy of what ever rabbit hole you went down in some vain attempt at trying to prove a point.

I was giving you a breakdown as to why people don’t do the kind of QR attacks / jokes that you seem to assume are common place rather than just saying “nice theory but that doesn’t happen in the real world”. There’s no need for you to be snarky.

dylan604
> They can do that already just by placing their logo, or whatever, instead of a QR code

What in the world are you on about? Just slapping a logo on top of a QR code suggests to me you’ve lost the plot. The point is to hide your attempt at subverting the “attack”. You’re specifically trying to get the person to go to some other site in the normal process of scanning a QR code. Covering the original QR code with a logo would be obvious some subterfuge is at hand, and totally defeats the purpose. How is that not obvious to you?

> I was giving you a breakdown as to why people don’t do the kind of QR attacks / jokes that you seem to assume are common place rather than just saying “nice theory but that doesn’t happen in the real world”. There’s no need for you to be snarky

No, this is you: https://xkcd.com/386

hnlmorg
Dude chill out. we are just having a discussion. That’s literally the point of forums.

https://news.ycombinator.com/newsguidelines.html

dylan604
Again, you've lost the plot. Now, you're no longer even discussing anything but referencing the rules.

what discussion are you actually wanting to have, because you've now changed it 3 times

hnlmorg
I’ve consistently been talking about how QR codes are not dangerous. The last post was just asking for you to tone down the ad hominem attacks.

I’m happy to discuss QR codes with yourself but I only if you can be civil. Otherwise why would I want to chat further if you’re just going to be rude in all of your comments?

[deleted]
(comment deleted)
t_mann
Many URL shortening services actually do offer a way of inspecting the URL before loading it. And the issue of URL shorteners is in no way specific to QR Codes (they originated on Twitter, where they are still most commonly used by my observation, even though the reason for doing so has gone away). QR Codes are usually used to point to content on your own domain, so you can control the URL, hence very little reason to use shorteners, which would likely cost you a few visitors.
komlan
It depends on which app you are using to scan the codes. For Trak [1], the main use case is to scan QR codes you made yourself (or someone from your company made). The scanner simply rejects anything it doesn't recognise as a valid (app-specific) code.

[1] https://admin.trak.codes/

jddj
There are open source QR scanner apps on F-Droid which actually make you tick a box saying "I've checked the above URL and I want to visit that website" before they will open the browser.
Grazester
My QR code scanner shows me the content of the QR code. This is my Google Pixel phone btw
ImportOllie
If you consider all qr codes unsafe then use a tool to check them don't lecture the waitress on man in the middle attacks...
hnlmorg
Not only is this the wrong place to vent your annoyances with QR codes (it’s tangential to the Show HN) but you honestly come across as an unpleasant customer if that’s how you interact with your restaurant servers (you could have just said “my camera is broken, do You have an address I can type instead”).
ho_schi
I see some valid points.

    1. A restaurant should   provide a menu printed on paper or a panel. Sometimes pictures are used.
    2. Verbal communication serves that purpose also well. And friendly manner.
    3. Some cameras don’t  display the read input properly. Input is always in error until it is validated. Here is user validation required.
    4. You don’t need to invent excuses like “my camera is broken, I forgot my phone, Bad eyesight…”.
    5. You don’t have to carry around a camera, a cellular access terminal and a computer (consider this as description of a smartphone) with you.
    6. The website can load arbitrary data with JavaScript and mine Bitcoin in a sandbox. It is not safe because it will drain the battery.
I like QR-Codes. They are analog and digital at same time, printed on paper and machine-readable and nobody ruined it with incompatibility. If possible the payload is printed as ASCII aside the codes.

PS: Similar. To provide a common base, prevent exclusion of unwanted customers and prevent against malicious data processing some jurisdictions require cash payment options.

llamaInSouth
Android 14's camera shows you the URL and doesn't load it right away...
chickenpotpie
IMO this is paranoid behavior and not healthy. Part of existing in society is having reasonable trust that just because someone can take advantage of you in a moment, doesn't mean they're going to. You're getting in an argument with a server because of your fear that a local hacker printed out a sticker, walked into your local restaurant, seamlessly put the sticker onto the table, didn't get caught, you just happened to sit at the exact table they picked, and whatever vulnerability they're trying to exploit is compatible with the exact device you have. Thats not going to happen.

Scan the QR code, dude.

kybernetyk
Aren't there apps that just show the embedded text inside a QR instead of just opening the URL in a browser?
dylan604
Hopefully, the Googster doesn't pull the rug out from under your feet and decide to deprecate whatever product(s) you are using of theirs. It is always something to keep in mind with using anything from G as a central part of your offerings.
komlan
Spot on. Fortunately, the underlying platform itself is independent of Google.

The Forms and Sheets add-ons are just customer acquisition channels, just like our Zapier integration [1]. These mostly use our API, and very little of our UI (mostly the scanner).

[1] https://zapier.com/apps/trak-qr-automation/integrations

allynalford
I like this
komlan
Thanks, please don't hesitate to get in touch when you do try it!
digitcatphd
Kudos for the simplicity and efficacy of your solution
komlan
Thanks, please get in touch when you do try it!