Ask HN: What's a security risk you think people should be more aware of?
Here's mine: QR codes. They're a terrible idea, especially when there's no URL attached. They remove someone's ability to verify that yes, this is the correct site, and are easy to bypass - a scammer can literally just put a different QR code over the intended one, and ta-da! Done.
20 comments
[ 3.2 ms ] story [ 65.8 ms ] threadI don't think it's really much of a risk because an attacker has to not only go to a physical location and replace the QR code, but they need to make some kind of replacement website that looks genuine to fool someone.
It's actually harder to pull off than a credit card skimmer.
Example: QR codes at a restaurant, I need to put the QR codes on every single menu (how am I going to do that discreetly without visiting the restaurant multiple times?) and then I also have to create a functioning website that mimics the restaurant's website. And then what happens when the customer doesn't get any food when the order via QR code and the server doesn't see any order being placed? Everyone involved would be immediately suspicious.
And given the fairly muted, simple, design of many websites that require you to enter financial data, and the lack of information on what it should look like, then it would be relatively easy to create a website that mimics the correct website.
Don’t think too fondly of Verizon’s short retention schedule though, they sell your location to data brokers.
Yet this is the underlying design that Linux, Windows, MacOS are all based on.
We have ways to default to NO authority, and still make computers just as easy to use, but we don't do it. Because it would require reconfiguring everything, and porting a lot of code to new OSs.
I do rather agree that using QR codes from untrusted sources is not a smart way of entering URLs. It makes sense for wifi codes or payloads _within_ some trusted app, but as a way of hitting whatever URL someone has obfuscated into an unverifiable QR code... not so much.
There are a lot more boomer generation people out there that fall for this every day than complicated or highly technical scams. There should be PSA’s shown during Jeopardy! and Wheel Of Fortune commercial breaks that simply state: “The IRS will never call you. Neither will the USPS. Microsoft won’t either. They won’t text either. If you get something that says your computer is hacked and to call that is also a SCAM. Turn it off immediately and take it to a local professional.”
Edit to add: I know all of us in here will end up being the “local professional”, be nice and help the elderly.
I do feel like a PSA would be a good measure; we lose enough to fraud that it may pay for itself. I don’t think we’ll see one, though. That would be a tacit admission that the government has completely lost control of a key communication technology.
On Linux this is less of an issue. They'll usually come back after a few hours asking for help with a driver.
"Do you have rewards?"
"Oh, yes. My number is 555-555-5555", the customer blurts out loud while there's 10 people behind them.
I imagined the person walking out and getting hit with a "Thank you for shopping at Macys. Here's $500 on us!" text message. I think most would definitely fall for this, especially if they just left the store.
People not locking their computers before they leave their desks also drives me crazy.
I’ve even seen this in screen recordings that are permanently published on Video platforms.
It’s a gold mine for social engineering attacks.