That square QR barcode on the poster? Check it's not a sticker

http://www.theregister.co.uk/2012/12/10/qr_code_sticker_scam/

by tankenmate • 14 years ago

38 42 14 years ago

theregister.co.uk

I was chatting to a friend recently about how if QR Codes had taken off a bit more than they have (in terms of general population penetration, so your 50 year old parents would know what they are), that they'd become a pretty decent way to use for miscellaneous hijinks/spamming/attack vectors. Especially when that Samsung Android bug was discovered that could trigger the reset code, that in the wild would have been something crazy.

jeffehobbs• 14 years ago

Spam is a best case scenario -- unexpected porn would be a more eye-searing experience. I remember this trick from the good ol' days of Slashdot.

meaty• 14 years ago

Yes in London we've had Goatse QR codes deployed, much to the amusement of the deployer I imagine :)

froo• 14 years ago

Guerilla Marketing possibility by hijacking other people's ads?

jiggy20112• 14 years ago

Maybe, but a company doing this could probably look forward to some strongly worded letters from the lawyers of the company who bought the poster space.

edent2• 14 years ago

I wrote about this a year ago http://shkspr.mobi/blog/2011/12/how-to-prevent-qr-hijacking/

It's already happening - on a small scale. QR codes are really popular in the UK, but I've only seen this sort of "sticker attack" once.

anu_gupta• 14 years ago

> QR codes are really popular in the UK,

I don't think that's accurate, at least for values of "really popular" that I understand.

indiecore2• 14 years ago

Good argument for customizing your QR code a little bit. Likely anyone who's going to do this will just print off a big pile of black and white perfect squares. If you design your media so that looks weird to people that's a single passive thing that will help protect your customers.

ohwp• 14 years ago

Another thing is that most apps show the Unicode URL:

  * User confirms he likes to open the url https://www.gооgle.cоm ('о' != 'o')
  * https://www.xn--ggle-55da.xn--cm-fmc/ is opened

andrewaylett• 14 years ago

Did you check xn--ggle-55da.com? Google's already registered it :). Some TLDs have restrictions on which IDNs can be registered, specifically to avoid this kind of spoofing...

tankenmate• 14 years ago

And in fact all new gTLDs will be required to have a policy to limit this kind of thing.

franze3• 14 years ago

well, it seems a very un-economic strategy, because

you need to invest in

  a) physical items (paper, glue)
  b) human workforce
  c) transportation (you need to get around town)

and also

  I) nobody uses QR codes

  see http://www.google.com/trends/explore#q=qr%20code%2C%20qr%2C%20&cmpt=q and
  http://www.google.com/trends/explore#q=qr%20code%2C%20qr%2C%20mail&cmpt=q

i run a quite popular create and read QR code website http://miniqr.com, and well let's say i won't get rich (for this sideproject)

mail spam works because it's cheap to distribute, physical QR-codes - not so much.

konstruktor• 14 years ago

On the other hand, targeting can be very precise using this technique. Think bank advertisements.

Cogito• 14 years ago

nobody uses QR codes

http://picturesofpeoplescanningqrcodes.tumblr.com/

(this has been posted on other QR code threads before, but is always relevant)

Spoygg• 14 years ago

Hahahaha :) Did not come about this one until now :)

franze3• 14 years ago

if you really want to see people scanning QR codes, there is a website for that http://replycam.com/browse.php has a few thousand or more qr codes (http://miniqr.com/reader reused the http://replycam.com flash webcam), should count them sometime.

apathetic• 14 years ago

it's empty. Did they mean it to be this way?

nwh• 14 years ago

I actually did do this once to a particular area of advertising. I took the time to make unique codes for each one replaced, and routed the requests past my own server to record each hit. The idea was simply to find out how much they get used, as a lot of clients seem to insist on having them as the only call to action on their advertising.

In the end there were about 20 proxied URL on an extremely high traffic footpath.Either people noticed the edges of the sticker (unlikely), or absolutely nobody in my area wanted to scan any of those suckers.

ortusdux• 14 years ago

I wonder if there is a possible system where google goggles could replace QR codes, like a physical adwords. The advertiser submits their ad, google slaps a 'official google ad' watermark in the corner for orientation, and pairs the image with the desired url. QR codes already assume that the user has internet access. Users are much more friendly to the idea of holding their phones up to a billboard because it asked them to. Hijackers would need to run a card through goggle payment processing to get a dirty url to work in the system. And what does the advertiser get out of the whole thing? Analytics.

VBprogrammer• 14 years ago

Does anyone have metrics on how many people actually scan QR codes? I'd count my self as pretty technical and except for a few attempts years ago for novelty value I've never scanned one. I can't imagine non-technical people even knowing what these are but their recent proliferation makes me wonder if maybe I'm wrong.

erock2• 14 years ago

I did an experiment in my town, placing my own qr codes over everything i could find. running for a month, with putting 80 or so qr codes through out town.

the number of scans i got was around 10. no one scans QR codes

I have been thinking about printing up my own posters, like "Scan the code below to donate to Toys for Tots", but i still don't think I'd get many scans. here's an article http://www.veracode.com/blog/2012/06/dangers-of-scanning-qr-...

leephillips• 14 years ago

If you got 10 scans after distributing 80 stickers I would not conclude that "no one scans QR codes". This is, instead, an impressive proportion of responses, unless I misunderstand.

talmand• 14 years ago

But what were you promoting with these QR codes? If they were just stickers of codes with no indication of what they were for then I would expect hardly anyone to actually scan them. But if it were associated to something that might interest them, say an event or big sale, then the response might be higher.

If you put the codes on top of other people's advertisement's then one could assume that the advertising wasn't effective enough for someone to be interested in scanning the code. Plus if the ad didn't say what the benefit of scanning the code was since it probably wasn't designed with that in mind, then why would they bother?

Also, from my experience in online retail, a response of 2% is often considered a good return. Just depends on what you are doing.

I just think you possibly conducted a less than useful test and possibly came to an invalid conclusion.

omaranto• 14 years ago

I don't see anyone scanning them here in Boston, but I have heard that in other parts of the world people do use them. They're supposed to be popular in Japan and South Korea. (Can anyone confirm that?)

kamjam• 14 years ago

The only one that I heard of which "worked" is this one in South Korea. Pretty innovative really!

http://www.innovationexcellence.com/blog/2012/10/29/koreas-e...

prof_hobart• 14 years ago

My 6 year old daughter loves them - we went through a phase of scanning pretty much every one we saw.

Excluding those, I've occasionally done things like scanning ones at museums that give more info about an exhibit and I've also scanned a couple of ones on menus etc at restaurants that have links to special offers. I realise I'm very much in the minority though.

edent2• 14 years ago

I've been gathering some real world metrics on QR codes in UK. They seem very popular.

See http://shkspr.mobi/blog/2012/10/no-one-scans-qr-codes-apart-... http://shkspr.mobi/blog/2012/01/real-qr-statistics-from-tfl/

jiggy20112• 14 years ago

I'll guess that it depends very much on the use case.

For example I can see just scanning a QR code on a tesco card might be more convenient than remembering to type tesco.com/clubcard/join or texting a specific thing to a phone number.

The bus use case is quite good too since looking stuff up on timetables is always a bit of a pain.

OTOH when I see one on some random movie poster on the street, I'm really not likely to stand there in the cold, advertising the fact I have a smartphone to anyone around and possibly holding up foot traffic just to get redirected to some website that's probably going to load slowly over 3G anyway.

18pfsmt• 14 years ago

Another anecdote:

I was sitting outside a brewery last week that is right next to a mall here in Colorado. This is a mall that has both an outside and inside. We were right near a mall kiosk with a mini-map and a QR code that will let you download a map of the mall. Over the course of 2 hours, I saw about 10 people scan the QR code.

I think it takes non-technical people more time to understand how to use, and incorporate new technologies into their lives. I am of the belief that most people only realized how to use the internet effectively in the last few years. Meanwhile, it's been integral to the lives of many HNers for over a decade.

c0nsumer• 14 years ago

I do mountain bike trail work and mapping, and I like putting very large QR codes on the trail head sign kiosks with a note saying "Scan this QR code with your phone to download a copy of this map.".

Year-old example (it's changed slightly since then): https://nuxx.net/gallery/v/travel/local_places/biking/PB1500...

I don't have anything in place (unique URLs or whatever) to track how often it's done, but I've personally seen a number of people using it just in times that I've been at the park and sitting near the trail head.

snippyhollow• 14 years ago

That's funny, because I made such stickers that I put in Paris subway on top of ads: http://emotion.inrialpes.fr/people/synnaeve/index_files/qr_w... that redirect to a random Wikipedia page...

jfb• 14 years ago

How about not scanning robot barf in the first place?

daeken2• 14 years ago

It'd be really interesting to scan codes in the wild, print replacements that forward it through a tracking service, and replace the originals. Information on when and where people scan QR codes across different markets (e.g. which products are most scanned) could be quite valuable.

franze3• 14 years ago

i.e.: https://news.ycombinator.com/item?id=4898851

daeken2• 14 years ago

Completely missed that -- thanks!

TazeTSchnitzel• 14 years ago

And then someone from a competing service scans the sticker and puts another on top, and now we're going through two layers of tracking...

vyrotek• 14 years ago

Google Glasses (and the competitors) might make QR codes very popular soon. Your camera will always be on and picking up any codes it happens to cross. This obviously eliminates the first friction point which is taking out your phone and pulling up your QR app.

But, the more I think about this the more I'm afraid for this. They could essentially act as real world cookies. They could track everything you've glanced at and be used to bombard you with ads or other things. I'm sure there will be resistance and then QR scanning features might be turned off by default. Then we're back to no one scanning QR codes.

Aardwolf• 14 years ago

I have the solution!

Rather than putting a QR code on the poster, put the actual URL there, so it's obvious when it's a spam URL.

And then let phones use OCR to visit the URL!

Then both the human and their phone can read it.

indiecore2• 14 years ago

QR has error correction and stuff built in, OCR does not.

That square QR barcode on the poster? Check it's not a sticker

Related Stories