• 0 Posts
  • 58 Comments
Joined 3 months ago
cake
Cake day: June 23rd, 2024

help-circle










  • That is very decoder-specific. The most common QR reader apps are the Camera app on iPhones and Google Lens for Android so you’ll want to target one of these (though Google Lens might be using cloud processing for that). There probably won’t be any exploits in the image processing part but you obviously can write arbitrary data (including ASCII control characters such as CR, LF, null) into the “data” part of the QR code, as the encoding mode and data length is stored in the first 4+(n*8) bits of where data would be instead of null byte termination. Normally, the data is then right-padded with repeating 0xEC11 (or not) and then error correction follows (number of bytes in the error-correction part is defined by the size and ECC mode indicated in another region).


  • It’s easier to take precautions though. You probably don’t have an insulated USB port or throwaway host device but handling QR codes safely just takes basic tech and skill.

    Important advice:

    • Don’t use apps that auto-open URLs in QR codes when pointed at!
    • Make sure the app shows the full content of the QR code and lets you peruse it indefinitely before you open the link!
    • Know the structure of URLs and common pitfalls!

    Recommendations:

    • Be extra suspicious if there is no URL printed next to the code, or if the printed URL is different.
    • Use an open source reader app (most QR codes don’t contain secrets but it’s got permission to use either camera!) that does not resolve Punycode (Unicode in TLDs).
    • Strip any tracking parameters you spot before following any URLs.
    • Be careful if the QR code could have been easily tampered with (on a sticker over the original one, or on a plain sheet of paper inserted into a plastic wrap together with the rest)

    I think today’s generation’s equivalent is free Wi-Fi networks. Kids without mobile data in an area without an established public network will connect to just about any open one unless the SSID includes “LaserJet” or similar.






  • It was advertised as “2 TB (64 GB Extended)” at a local clearance sale (not AliExpress), which was basically correct though I would prefer “64 GB but misprogrammed so everything can get corrupted at any time”. When buying it, I didn’t yet know if I could reprogram the chip but the low price was justified for the pretty aluminum case with a USB-C port and place for a custom PCB. I decided to buy it also to prevent another, less technical person from using it and losing their data. The store was getting rid of inventory for very cheap and would close soon so no more fake drives would be ordered.



  • Sometimes, counterfeits or unknown brands are so similar to the real deal that it barely matters. I’d say that basic electronics (alarm clocks, kitchen scales, calculators, SD security cams) or even RAM is fine. With appropriate expectations, parts like video or USB cables, hubs etc., small home improvement items (hooks, screws) are fine too. Avoid categories where a lot of items have fake specs (storage devices, LED bulbs, anything that claims a runtime on a Li-Ion battery). Power electronics (especially if using mains or non-tiny Li-Ion batteries) can be downright dangerous. For novelty items and electronics modules, it’s usually easy to find text or video reviews on other websites because they’re easy to uniquely describe. Remember to consider ways in which the product can be utter crap despite high reviews citing good first impressions; it also helps to have practical knowledge of testing the properties of the items and fixing common issues.