I think you’ll find there isn’t an Android or iPhone on the market today vulnerable to SQL injection or XSS etc via scanning a QR code. You’re talking about device vulnerabilities that get patched and it’s equally possible to encounter these exploits with plaintext URLs
If the restaurant doesn’t have a good enough reputation that I couldn’t trust the QR they provided (which displays the URL so I can inspect it before launching the web browser), I also wouldn’t want to trust my health to eating there.
It isn’t like some random thing you found on the sidewalk.
I’m pretty sure these are just an echo of the same concerns people put forward when URLs first started being included in signage, due to general privacy/security concerns with the internet. Somehow we got through it!
I think you’ll find there isn’t an Android or iPhone on the market today vulnerable to SQL injection or XSS etc via scanning a QR code. You’re talking about device vulnerabilities that get patched and it’s equally possible to encounter these exploits with plaintext URLs
Patching out zero days takes time.
Yes which is why I clearly stated that following URLs from any unknown sources carries risk.
The difference is that due to menus being a point of payment they have a greater incentive for abuse.
So we shouldn’t use smartphone features if they could potentially have exploits? With this logic you shouldn’t have a phone.
no but QR is a shit bug/exploit riddled mess of a format
If the restaurant doesn’t have a good enough reputation that I couldn’t trust the QR they provided (which displays the URL so I can inspect it before launching the web browser), I also wouldn’t want to trust my health to eating there.
It isn’t like some random thing you found on the sidewalk.
I’m pretty sure these are just an echo of the same concerns people put forward when URLs first started being included in signage, due to general privacy/security concerns with the internet. Somehow we got through it!