QR Code Hijacking Attempts Are Pretty Inept


A poster behind some glass. A paper QR code is stuck on top of the glass. It is easy to see it is a replacement code.

I've been writing about QR codes since 2007 - long before they were fashionable. Because QR Codes are so cheap to produce, there has always been a concern that attackers might print out their own codes and stick them over legitimate ones. When I first wrote about QR Hijacking in 2011, I said that such […]

Continue reading →

How to generate a Base32 TOTP secret string on a Mac


A padlock engraved into a circuit board.

I needed a way to generate a TOTP secret using a fairly locked-down Mac. No Brew. No NPM. No Python. No Prolog, COBOL, or FORTRAN. No Internet connection. Just whatever software is native to MacOS. As I've mentioned before, the TOTP specification is a stagnant wasteland. But it does have this to say about the […]

Continue reading →

Strange Encoding Errors in TOTP QR Codes


A QR code.

Not really a security issue, but one which I thought was worth highlighting. It shows the peril of slightly vague specifications. When you scan a 2FA token into your authenticator app via QR code, you get presented with a bunch of information about your account. This lets you store things like the issuer and the […]

Continue reading →

Why is there no formal specification for otpauth URls?


A QR code.

Yes yes, Cunningham's law etc etc! I want to play around with 2FA codes. So, I started looking for the specification. Turns out, there isn't one. Not really. IANA has a provisional registration - but no spec. It links to an archived Google Wiki which, as we'll come on to, isn't sufficient. There's some documentation […]

Continue reading →

I was told that QR codes would never succeed because no one could make money from them


Search back through this blog and you'll find dozens of posts about QR codes. Back in the day, I was a freelance "Mobile Internet" consultant. I'd rock up to companies and say "you know you can get the Web on your phone, right? It's going to be the next big thing!" And people would pay […]

Continue reading →

A QR code built from Emoji


A QR built from emoji squares.

It's possible to encode QR images as text. In this case, Emoji!

Continue reading →

Donating via SMS - using QR Codes


One of the greatest cultural achievements of the last Labour Government was making museum entry free for everyone. Whether you're rich, poor, British, foreign, young, old - you can enjoy the treasures of our museums and galleries. Of course, while museums are funded by the state, they still rely on generating some external revenue - […]

Continue reading →

ASCII Art in QR Codes


There are plenty of QR generators which will render the code in ASCII, but I wanted to try something a little different. Is it possible to hide ASCII Art into QR Codes? Errr.... yes... It's pretty damn simple! I was surprised I couldn't find anyone else doing this. (_/) (='.'=) (")_(") Becomes: Which, when scanned, […]

Continue reading →

QR Codes on Energy Bills


Photo of an eBook. It is demonstrating how a customer can scan a QR code on their bill to see what their energy usage is.

This is a necropost - resurrected from the now defunct blog of a previous employer. Sadly, the follow-up post has fallen down the memory hole. You can still read Sharon's response to it. Well, we can finally unwrap one of the little projects The Lab has been working on. Along with the Department of Energy […]

Continue reading →

QR Codes in the Hardware Store


I'm a big fan of QR codes. A few years ago, I did some work for a major UK retailer who wanted to put QR codes on some of their DIY products. Rather than ship expensive instructions with each item, there would be a QR code on the packaging which linked directly to a video […]

Continue reading →