What the UK Government gets wrong about QR codes
domains gov.uk privacy QR Codes security · 12 comments · 700 words · Viewed ~757 times.
One of my most memorable experiences in the Civil Service0 was discussing link shortening services with a very friendly1 person from the Foreign and Commonwealth Office.
I was trying to explain why link shortners like bit.ly and ow.ly weren't sensible for Government use. They didn't seem to particularly care about the privacy implications or the risk of phishing. I needed to take a different tack.
"So, you know how .uk is the UK and .de is Germany, right?" "Yes." "What country do you think .ly is for?"
There was some consulting of ISO 3166-1 alpha-2 whereupon the blood drained from their face and they stepped outside to make a phone call.
A little while later, the National Cyber Security Centre published an explainer about why they weren't using bit.ly any more.
Throughout my time in the Civil Service I advocated for the use of .gov.uk URls everywhere. They're a trusted destination for users, they're under Government control so are less likely to be hijacked, and they don't require users to give their data to third parties.
I helped the Government Communication Service write "Link shorteners: the long and short of why you shouldn’t use them."
Today, in the post, I received six QR codes for Government services. Let's take a look at them.
The Good
Policing Surrey have a QR code which points to surrey-pcc.gov.uk/...
Excellent! 10/10! No notes.
Woking Council send out this code which use qr.woking.gov.uk
Brilliant! The use of the qr. subdomain means they can easily track how many people follow the link from the code.
The Bad
Childcare Choices is a leaflet which is, I assume, shoved through everyone's letterbox. All the URls in the leaflet say gov.uk2 - but what happens when you scan?
Our old friend enemy Bitly. A user scanning this has no idea where that code will take them. They cannot access the content without giving their data away to Bitly.
Surrey also sent me a leaflet with two different QR codes.
There are many reasons not to use .io. Of particular interest is the scnv.io privacy policy which, if you click that link, you will see is missing from their website! What does this company do with the data of people who scan that code? No one knows!
The Ugly
Surrey police started so well, but the back of their leaflet is a major disappointment.
Aside from using an unintelligible Bitly link, the QR code is inverted. The QR standard is very clear that the codes should be black-on-white. Some scanners will have difficulty scanning these white-on-dark codes. They may look æsthetically pleasing, but it's a pretty rubbish experience if you can't scan them.
Now What?
I've been writing about QR codes for 17 years! I'm thrilled that they've finally caught on. But, like any piece of technology, they need to be used sensibly. The rules are pretty straightforward - mostly boiling down to testing your codes and keeping them simple.
Is there a risk risk of QR hijacking? Possibly. The best defence is to train users to look for a trusted URl.
In this case, using link shorteners is training users to be phished. If they are used to official Government QR codes going to weird locations, they won't notice when a scammer tries to send them to a dodgy site.
Please practice safe QR generation!
-
I am no longer a Civil Servant. The Government's views are not my own. And vice-versa. ↩︎
-
But not so friendly that they'd tell me their surname... ↩︎
-
When I was there, the "Brand Police" were insistent that it should be referred to as GOV.UK in all-caps. The leaflet exclusively uses the lower-case version. Sorry Neil! ↩︎
@edent says:
Mike says:
More comments on Mastodon.