Slashdot Mirror
QR Codes As Anti-Forgery On Currency Could Infect Banks
New submitter planetzuda writes "Invisible nano QR codes have been proposed as a way to stop forgery of U.S. currency by students of the South Dakota School of Mines and Technology. Unfortunately QR codes are easy to forge and can send you to a site that infects your system. Banks would most likely need to scan currency that have QR codes to ensure the authenticity of the bill. If the QR code was forged it could infect the bank with a virus."
Only if they're stupid enough to execute code formed from non-executable input.
There was a way to scan a QR code without having an unpatched IE6 accessing the url in the code...
A bank note QR code would refer to a single site. It would not go to "the world".
Input hardening in such a case should be reasonably trivial. And if it failed to have the proper form it would be false.
I guess that's why all the checkouts at our local grocery stores get viruses when we scan the wrong barcodes.
Use appropriate software. Fuck.
Don't allow the machines that scan the bills to open urls.
Next problem, please.
What? QR codes can hold arbitrary strings, they don't have to be just URLs. This summary makes no sense. There isn't even an article here! Who is editing this shit?
A QR code is a two-dimensional barcode. A pretty decent way to embed a serial number. What exactly about the idea makes the poster believe the banks' scanning software would jump to some arbitrary website after the scan? Presumably, a much more sane and secure thing to do would be to look up the serial number in a database on a single, secure site.
QR Codes don't send you anywhere. They're just data. They can contain web links, just like any written sentence, but a device won't download the content at a linked URL unless it is programmed to.
QR codes are futuristic, 2D versions of bar codes. Nothing more.
qr code is a method to encode strings or binary data into a pixelized black/white bitmap. it is as good as the serial number printed on the bill. only it can incorporate full range of characters, printable or non-printable. i don't think op understands what qr code is.
QR Codes are just binary representation of data. The US Treasury could use QR Code as barcodes and require banks to use software certified by the treasury herself. The treasury could also require the software to run on a read-only system, or on TCPA protected hardware with secure boot on a system with a software that runs on user-mode, with kernel-mode (or root-access) software checking for tampering.
doesn't really seem like a good idea.
"...as a way to stop forgery of U.S currency by students of Michigan University"
English is hard.
I can't speak to whether QR codes can stop forgery of the currency, but a QR code, by itself, can't infect anyone with a virus. What kind of bank system would blindly go to whatever website is suggested by an illegitimate QR code?
A post a day keeps productivity at bay.
This story displays an incredibly low understanding about what a QR code even is, let alone how you would write a QR code reader for a secure environment. I'm surprised this even got accepted.
If you think a massive security flaw will stop some private company from selling them their product suite, you are WRONG. They'll cover it up like their jobs depend on it...because they do.
Who wrote this summary? A QR code is just a data.
Just make your system NOT go to the public internet. The QR code could just be the serial number of the note. Hell you don't even need to use a QR code.
Example: http://intranet.federalreserve.gov/verify?n=12345
Problem solved. No virus.
Seriously? You're telling me that a bank system using a barcode to check a serial number would spawn a web browser because the bill said so? How hard could it possibly be to *not* allow a browser to start while scanning in QR codes, and catching attempts to try as a guaranteed way to prove that the bill is a counterfeit?
The only way I could remotely see that happening would be if there was a vulnerability in the system that allowed for a buffer overflow attack of some sort. The problem with that is that QR codes only have a limited amount a data, which would make this all but impossible.
I would think that the banks would have dedicated systems that would not even know how to go to such an infected site. Just because a device has an operating system and programs running on it, doesn't mean it has the ability to interpret a url and use it to retrieve content from the internet. (For example, my 2003 Taurus is not at risk of getting an infection from a malicious web site, but yes it has a computer that processes input from the outside world.)
On the other hand, I could see small businesses using said QR codes to authenticate larger bills. But they would probably do so with some software running on a PC, iPad, etc....
www.DIYTVAntennas.com
Isn't it a bit redundant, seeing as how they have serial numbers already?!?!?! A QR code would contain what, a serial number? Obviously this article thinks it's a web link, which is what QR codes were designed for. If it's a web URL, wtf?! If it's a serial number, just real the serial number instead. They have OCR that does that already.
Bank employees are not stupid enough to have their software blindly follow/execute QR codes, so I do not think there is a serious concern of bank systems being infected with virii from forged QR codes. But if there was, I would hope the virus programmers would make include code to allow banks to help those that need help, not just the ones that have lots already.
1 article about using QR codes in money
1 article about how easy it is to forge QR codes
1 article about how automatically opening a url found in a QR code could infect your computer.
How did this summary possibly make it past filters. Not one article talks about how banks might be incompetent enough to auto execute code without first sanitizing their input, let alone whether the QR codes would link to a URL in the first place. I've been reading this website for a while and haven't been wanting to leave it, but this just pushed me over the edge. I'm not sure how this got past editor filters, but it's definitely not worth my time. I'm sorry slashdot, you were the first content aggregation site that I actually enjoyed reading.
The author of the post says: "QR codes are easy to forge and can send you to a site", which is very naive.
QR codes are not required to store only URLs; they can store arbitrary text. The banks would likely not store URLs, and whatever reader code they have could just ignore or not follow URLs. Even if they wanted to use URLs, they could validate them and only follow ones to a particular trusted domain or set of domains, and ignore all others.
Simply disable autorun on the USB QR code readers. Problem solved!
(Yes, I know this is a moronic comment, but I'm trying to match the moronic-ness of the original article).
is why so many Michigan University students are forging US currency.
I am not expert on this, but i agree that ia bank system woudn't go to some url.
However if the QR contained a salted hash of bill identifiers, and the reading app verified it, would it be possible to include well formed enough data to cause some sort of buffer overrun and injection attack? the paylload would have to be very small, and it would likely only crasg the target system. Therefore it would not ba a virus persay, just malicious code.
Silence is a state of mime.
I guess even on /. computers are devices shrouded in mystery. Watch out before the Gibson gets hacked.
Bank staff could break their teeth by trying to bite coins. They could also give themselves a sun burn by keeping their hand under the note-testing UV lamp. And now they have the added hazard that they could follow a link on a QR code to an infected site.
Ah yes, that's why I stopped coming to slashdot. I'd forgotten how moronic some of the articles could be, and actually started coming back to this site.
Look at the submitter's site. If I ever saw a shallow website with nonexistent layout and content, it's his.
Probably some kid trying to play the "security business" but failing utterly. TFS proves it, too.
Did anyone read Dan Brown's book in which the main plot point was a computer that gets taken over? Digital Fortress it might have been called?
This article is even stupider than that book. And that's saying something.
1. It's "The University of Michigan." Not trying to be as pedantic as those who insist on THE Ohio State University (as opposed to that other Ohio State?), but no one uses 'Michigan University.'
2. At no point, in any of the three cited articles, is U of M mentioned. The QR / Currency article from engadget refers to The South Dakota School of Mines and Technology, which is slightly different from umich.
There are some people that if they don't know, you can't tell 'em.
This is why we can't have nice things.
...
It's unclear how much malware spread by QR codes in late 2011, but AVG reports that it's an ideal distribution method for nefarious software and it expects the practice to grow throughout 2012. Users are unaware of what the code contains until the malware has already gained foothold. The point being, QR codes aren't as safe as you might expect them to be. The security firm likens scanning unknown QR codes to running an unfamiliar executable on your computer.
Let's repeat this again, people: QR Codes are simply a new version of a barcode. They are not magic pictures that infect computers or phones. There is nothing wrong with taking a picture of a barcode.
OTOH, if you run an application that which upon reading a code will automatically open a webpage that might run a script without user intervention, you giving people a guest pass.
when malware spread through QR codes on a Russian website and forums. The code directed victims to a download location for an infected version of the Jimm mobile ICQ client. The malware sent SMS messages to premium numbers.
They directed their phones to a web address they didn't know and shouldn't have trusted, downloaded an application and then installed it. This was their own fault. This has no more to do with QR codes infecting computers than a hyperlink can.
Where is that? The engadget article talks about a school in South Dakota, and I've never heard of "Michigan University". Did I miss something?
I can't believe this was allowed to be posted... sometimes /. amazes me.
First off, the bank would have an internally-only accessible database that maintains authorized QR codes
Second, the scanning would only be done on this internally accessible system.
Third, because it's only internally accessible, virus = moot
What does this mean... when they scan a note/bill, it scans the local database if the code exists, if it doesn't then "ding ding ding!!!!!" it ain't real!
QR codes can't even launch a browser themselves even if they contain a URL. That action depends on the QR code reader. If a QR code says "http://www.slashdot.com/", then it is up to the QR code reader to say "Hey, this is a URL, I should open a web browser." The QR code reader on my phone presents the URL for me and gives me the option of opening a web browser. I'm sure a hypothetical QR reader for currency wouldn't even do that. It would say "Hey, this QR code reads 'http://www.badsite.com/infect_with_a_virus.php'. That's not the correct hash so this must be counterfeit."
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
I see no abuses there nor the goverment forcing the banks to submit the depositor name to look up a serial number, nor promising to limit some type of liability as an incentive to look up serial numbers on each transaction. No sirree, won't happen.
(Btw, I assume they could do all this on current serial numbers but perhaps its easier on the OCR to have as described in the article).
Does anyone even read these articles? It wasn't from "Michigan University" (presumably meant to be the University of Michigan) but rather from the South Dakota School of Mines and the University of South Dakota. And on top of that, the article in the journal Nanotechnology (http://iopscience.iop.org/0957-4484/23/39/395201) which is not linked anywhere in the ridiculously stupid Engadget or Ubergizmo articles, makes no such broad sweeping claims. The advancement is presented as a chemical/coloring advance with a shroud of timeliness and applicability to government needs in the form of the QR code. Perhaps not the most astonishing advancement ever, but it's certainly not making the claims that all the Slashdotters here seem to be in a rush to decry and refute.
The ability to give bank computers AIDS is just the start. What happens when terrorists discover them?
http://qr.kaywa.com/?s=8&d=Death+to+Obama+and+all+Americans.+Allahu+Akbar!
-- Using the preview button since 2005
Although most QR codes âdoâ contain URLs, this isn't the only possible use. If the QR code contains a hash of the bill's serial number that is generated by a sufficiently complex process (private key, anyone?) then it's just a matter of verifying the hash against the serial number for verification.
What a moronic story. It makes no sense whatsoever to whomever knows anything about data, security or whatever. Dozens of stories get rejected from ./ every day. How the F**K this gets approved speaks very lowly of ./ quality control.
Reminds me at that movie: "uploading virus ..."
Funny was they used a Mac for that ...
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
The recursiveness in the idiocy of this article will soon make my brain stack overflo
Also, paedophiles use money. Now, I'm not saying that QR codes can turn people into paedophiles, but you can't buy candy without money, sheeple!
systemd is Roko's Basilisk.
The more worrying thing is that they are trying to make is really easy and fast to track all currency from a distance. When you present a bill they will be able to track whatever accounts that bill was withdrawn from. It would be trivial for a bank to record the serial numbers of the bills it dispenses and who they were given to. When they are then deposited in a bank, you will have a fairly good idea of their path.
If the serial number doesn't work, why would bar coding it, QR coding it, or anything else suddenly make it harder to counterfeit.
The only thing it does is make it easier to trace the path of money. When you get the same number in 2 locations you know one is counterfeit.
Of course the tin foil hat crowd won't like this, the difficulty tracing is why they use cash in the first place.
I commonly see developers not clean/check barcode data and just expect it to be numbers but it is easy to print out a database attack as a barcode so when someone scans that barcode it is run against the backend system.
Code128 lets you join many smaller barcode together that will be passed to the system as a single string, so when the system is only expecting a few digits you can flood it with kilobytes of SQL injections or shell code.
And that is all just with 1D barcodes. QR is 2D
This is a plan to stop forgery by students of Michigan University? That's an oddly specific demographic for crime.
What about bill validators or TITO slots (Ticket-in, ticket-out)
That may be the place where you may be able to do some hacking likely useing buffer over flows with some thing like this.
When I vacation at the beach, I use my linux laptop to surf the Internet through a rogue wireless node at the local bank. I can see their entire internal network, including their ridiculously antique IBM mainframe, which I have not attempted to hack.
I have been doing this for years now.
Setup a VLAN or VPN for that one machine that links back to the Fed Reserve or something along those lines that checks the info. The DNS and/or IP filters can be handled at the Fed Reserve side or whatever end point they'd want which would allow good QR codes to be looked up and the information passed back, while bad ones with forged codes trying point out to some website would either be ignored or blocked.
Hell, even an app that just scans the code, sends the code to the remote fed server to be verified as a legit serial number or whatever, and the answer sent back wouldn't have to really worry about being pointed out to an external address as the QR code wouldn't be used to pull a web address, but, just like a barcode, would contain a serial number that would get looked up.
Which reminds me to ask: an "editorship" here can't possibly be an actual full-time gig, could it?
Seems like it shouldn;t be that hard to catch and jail those Michigan University responsible for the forgeries.
--
Infinitive Splitter
What is Michigan University? There are Eastern, Western, and Central Michigan Universities. There is a Michigan State University. There is a University of Michigan. There is no Michigan University.
Not to mention the article is about a team at South Dakota School of Mines and Technology.
QR codes are simply a method of encoding a blob of information. There is no magically connection between a blob of data containing a url and the magically fetching of the URL. You actually have to write more code to make it fetch the url. And fetching the url does not automatically result in infection. You still have to pass that url data through a browser engine to evaluate and act on the data. There are so many steps that would have to be coded that the likely hood of a moron coder making a mistake that would result in infection is 0.
QR codes allow for a visible representation of more information than can typically be printed in human language in the same amount of space. Presumably they can be printed in such a way that they are more durable than say a hologram and thus can be trusted to represent authenticity markings on the bill. As compared to a hologram which is easily damaged.
Help, my computer has the flu! Will I get sick as well?
Can anybody explain to me why QR codes should be more of a thread than forged serial numbers or other forged data? Oh, they are? Then you should not read any further as from this point on there is maliciuos code hidden in the text. Sorry, too late, your machine is infected and will self-destroy in 10, 9, 8,...
Dude probably is watching too much TV where you can burn down computer by scanning bones
Comment removed based on user account deletion
Each note seems to have a serial number, meaning it should be unique. Why not have each note's S/N cryptographically signed and the signature stamped onto the note along with the S/N in some kind of machine-readable format?
It should then be possible to scan the barcode and verify the signature to determine whether the note was legitimate. They could create unique keys for each Federal Reserve district, perhaps annually, so that you wouldn't have to worry as much about the key being compromised.
Someone could clone the same S/N and signature, but if they did it would be easy for banks or other large cash processors with scanners to identify duplicates and remove them from circulation. Dupes could be identified as currency scanned at more than one geographic location within a certain time window where the chance of the currency being in two places at once was very slim -- kind of like the antifraud calls I've gotten from a credit card company when I've used a card in two cities in the same day.
Small numbers of duplicates would be hard to track, but the economic risk from counterfeiting isn't from some guy with a scanner and a inkjet printer but from mass counterfeiting of thousands of notes.
There is a very simple solution...
The QR code should link to specified government Treasury website. If it does not, (and you pre-scan the URL first), then you AUTOMATICALLY KNOW IT'S COUNTERFEIT.
Simple...
Okay. The big problem with this is that the technology to scan and write nano QR codes will become common, which then allows them to be reproduced even if (assuming the use is cryptographic and the keys are adequately protected) it isn't practical to generate new, legitimate ones.
They can't "send you" anywhere unless (1) the QR code is used to contain a URL -- which isn't the original or exclusive use, though its the most popular one in advertising, and (2) the reader expects it to contain a URL and is programmed to navigate to the URL it contains. If, instead, it contains a cryptographic signature of some data on the "visible" part of the bill (such as the serial number, date, value, etc.) then it provides an additional check against certain forms of forgery.
If the bank system was designed not only to scan the QR code, but to also treat the content of the QR code as something more involved than a digital signature like executable code or a URL to navigate to, sure. But since there'd be no reason to do that in this application, and it would take extra work directed at an end with no conceivable relationship to the purpose the QR code was being used for, its pretty hard to see this as a likely problem.
proves Slashdot officially sucks now.
Did Yahoo buy Slashdot when I wasn't looking? Come on, this is a technology website. We're not ALL morons.
Well, your post contains one truth, your IQ isn't 50. It is far far lower.
QR is simply a bar code. You scan it and get a string of data. That is it. It can contain any string valid within its codeset but it is just a string just a barcode is just a number.
Sure, buffer overflows exist but they exist deep within complex code, not on simple basic stuff as reading in a user input especially when there is only one.
And people with IQ of 50 (you call them master or whatever you can manage to utter with your sub-50 IQ) don't work for banks.
It doesn't matter if the string contains characters that together form a URL, that is only valid if someone with a sense of humor starts testing the read string for what it might possibly contain. It could be a string that if processed as a gif shows a image. But why would a banknote scanner contain the code to do that?
I could build a nut screwing robot and then give it an icecream and watch it transform itself into a icecream eating machine OR I could see it reject the input as invalid because it was never programmed to deal with that input.
What do you think that happens if a random string of text in a ssl key happens to form the word "reboot". That the computer will reboot?
You, the submitter, timothy and an awful lot of people who should be on facebook instead of slashdot seem to think computers are magic. They are not.
Only when silly MS programmers try to make their software clever by trying to guess what input could mean, things go wrong. People who software for banks are not silly.
If you spend a million years beating them over the head with a feature for "smart" input where code just tries to run any input whatsoever, they would just not get what you are trying to do. Such a stupid idea just does not exists in the universe of serious coders. There are no serious coders at MS. Or indeed Apple. Or many linux projects. Luckily banks for make it a point to find it for their "oh shit this is going to cost us more money then the worst/best traders in history" projects. Else the treasury goes after them and this ain't the corrupt branch of government, this is the bit that closes you down and then dissects your corpse while you are still using it so they can find the stupid bit and show it to all the banks. There are a lot of banks, so they will have to cut your up pretty small.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Japan uses QR codes to validate their visa stickers, weird how they haven't been hacked yet. Oh yeah, it's because it just contains a binary string and is not treated as a url, duh.
It's blatantly just planetzuda.com spamming its own worthless article.
Oh, I'm sorry sir, I thought you were referring to me, Mr. Wensleydale.
I don't see how this is going to be a big change wrt the current system. You already have to pick a serial number that will either be invalid or a duplicate when forging a bill. Nothing stops a forger from doing the same with a qr-code.
I'm pretty sure banks are already able to machine read sequence numbers -- and embedded metal thread are presumably harder to fake -- I don't see how qr codes would be a big improvement.
Remember when infected videos couldn't infect your system, then WMP would go to the given link inside the video to download AND RUN whatever was said to be required to run the video?
Or when jpg images could have a payload? People said the same thing then: it's an image! It can't infect you! Except that the more complicated you make the image, the more you have to run as if it were a genuine program.
Did that stop jpegs being a security hole?
This way we could discuss the actual stuff, indead of the report.
Like, for example, how usefull is it in a non-police state to have security features on the money that people can't ever detect?
Rethinking email
Please remove this post, the lamest programmer in the world will be able to avoid this "infection", as said by a lot of people QR codes contain binary datas or strings. I think this is a tabloid level post, an insult to slashdot users.
A QR code is just a novel configuration of a bar code that is able to hold more data than a standard bar code. It is basically a number. It is absolutely impossible for a QR code reader to be infected by the QR code. The machines that will read these codes are not going to care if a particular QR code is really a URL in the context of smartphone QR codes. To it it will just be a number, or perhaps a hash, but that's it. It will check that against a known number or a hashed number, nothing more nothing less.
This makes as much sense as the people that think the "Cloud" can be affected by weather.
Let's suppose that the bill with the forged code randomly ends up in some kind of photo taken with a smartphone, and let's suppose that the smartphone recognizes the QR code and sends the photographer to some kind of phishing website...
I know, totally unlikely as an attack vector, there's far more probability of someone being phished through ordinary spam. But even if the author of TFA didn't had a clue of what he was talking about, the bill with the malicious QR code could indeed be used as an attack vector of sorts...
Invisible nano QR codes have been proposed as a way to stop forgery of U.S currency by students of Michigan University.
Why are Michigan students forging US currency? Has the Secret Service been informed?
This is easily the stupidest slashdot article I've seen today.
People who say "sheeple" have about as much sophistication as an AOL user, and in fact are probably actually AOL users.
If qrcode.content != integer then bill = forged
The worst 1st year programmer could figure that out. Worst FUD article ever.
I was going to write something like what you stated. The QR code could be digitally signed.
There are some follow on implications that you didn't explore.
When accepting bills, scan the QR codes. If you get more than one bill with the same code, you've just spotted at least one forgery.
If the bills you handle are large in value, then have an online system that allows you to verify that a particular bill is not a known forgery or was not used to create a forgery. It is incumbent on the holder of that bill to turn it in so it can be seen that his bill is in fact the original that was used previously by some forger and he is merely a victim. The victim's bill would be scrutinized to ensure it is the genuine thing.
Eventually if all locations that accept large bills can cheaply scan them and verify them with a central authority, then forgers must turn to smaller and smaller bills. Eventually the terminals that do the bill verification proliferate down to lesser and lesser value points of commerce until they are at every Walmart just like credit card terminals.
Now we have something very interesting.
We didn't create a cashless society. But a lot of people might not understand that every bill is no longer anonymous. If government is able to keep records for every bill, they could know approximately every time it changes hands. They could then know that I got that bill from Target, but Joe spent it at AutoZone.
I'll see your senator, and I'll raise you two judges.
TFA is stupid; however, it does raise an interesting idea. QR codes used to store the serial number on the bills might be easier to scan than the numbers which already can be OCR'd. So that doesn't gain you anything.
How about Digital Signatures? PGP the money!
QR codes then make a lot of sense so any smart phone could ID phoney money.
Yes, somebody could copy the signature; but if it is unique to each bill it would require somebody to copy MANY signatures.
As more devices automatically scanned the cash duplicates would be caught more. Currently, we have serial numbers which are just as useless since they can just randomly be made up but we still have them because they prove useful in many situations. Using encryption you make it harder to generate new ones and by using QR codes you make it faster and easier to spot duplicates.
Democracy Now! - uncensored, anti-establishment news
The Secret Service would love nothing more than a counterfeiter that prints something on their counterfeit cash that leads the Secret Service back to the counterfeiter. Yes, it's theoretically possible that a counterfeiter could send a bank back to their web site to give the bank some malware, and congrats to planetzuda for contriving the possiblity and getting the submission past the editor, but it's never actually going to be attempted by a counterfeiter.
US Currency *ALREADY* has a serial number on each bill. Certainly modern OCR software is accurate enough to read that. Why do we even NEED a QR code?
Cos, like, this is, like, *2 dimensional*, man, it's, like, completely different! It's twice as secure! I hear those clever Japanese are working on a 3 dimensional serial number that's 3 times as secure!
Also FatPhil on SoylentNews, id 863
The article doesn't actually say it's a QR-code, just 'like' one for us laymen.
In actuality, it's a nano ink particle that is encoded and would be impossible (at the moment) to counterfeit.
That, my friends, is the really cool tech to discuss!
QR-codes are fine and all, but are really not designed to be much more than printed on your magazine ad.
My immediate thought was...
http://xkcd.com/327/
One would hope that a bank or other financial institution would do a better job than Little Tommy Tables' school.
But I wouldn't be surprised if they didn't.
like Chris said I am inspired that a person can make $4125 in 4 weeks on the computer. have you read this web link http://cutt.us/Mr1O
Since QR codes can hold arbitrary strings, why not sql injection attacks?
Given that at any time
1) banks would not be the only party interested in tracking money and/or customers,
2) codes would be scanned and entered into database,
3) at some point tracking would become mandatory,
4) there are still sloppy programmers out there building SQL statements by concatenating
strings,
I can see, why this could be a not-so-good idea...
That is the dumbest thing I have ever heard, well maybe not the dumbest but pretty dumb. QR codes are no different then simple bar codes. It is just a way to store information. What some program does with the information is up to the programmer.
Modifying fingerprints on your fingers to generate a hash containing malicious URLs when fingerprints are scanned may lead to corrupting the police database.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
You don't just "get infected" by "visiting a site". Your browser or automated software doing the bill scanning needs to do something stupid that allows the site to run code where it shouldn't. Pure text, HTML, etc aren't going to melt your brain. Sad but true.
Now MY question is why are we not arresting these criminal students at the University of Michigan who are forging money! Why is law enforcement not cracking down on this ring of spoiled college brats and their "Free-With-Purchase-Of-Laptop-For-College" ink-jets! Does the treasury think that sitting around and musing over possible longterm solutions is a viable solution to protect the US economy from these Econ Class Flunkies?! We need to send in Treasury agents to bust down the door to their dorms and arrest them! Heck, lets even send in the DEA, I'm sure forgery is only the tip of this tender iceberg! They're probably rollin' doobies with faux Benjamins whilst waiting for their buddies to get more color ink from the bookstore! This is an outrage! (also, I think the poster missed a comma)
~theCzar
"...to stop forgery of U.S currency by students of Michigan University" Surely the students will see this article and just find a different way to keep forging...
If they're smart enough not to enable network connectivity to the scanning computers.
Nothing to see here, move along.
What the fuck sort of shit story is this? Yes, QR codes are easily copied, but not at the nano scale. And why the fuck would a bank, or anyone, connect its QR scanners to the internet? It just has to be sensitive enough to read and verify the QR code and that's it. This is pure nonsense.
can send you to a site that infects your system
Yes, if you evaluate them as hyperlinks you fucking moron. That's a feature if you use it for a QR reader on your phone intended to be pointed at posters, etc. - but for a reader to verify documents or bank notes or whatever, it would be so unbelievably stupid that I'd instantly fire the developer who wrote or included that piece of code.
Really, have they been handing out the stupid pills again?
Assorted stuff I do sometimes: Lemuria.org
http://xkcd.com/327/
"Invisible nano QR codes have been proposed as a way to stop forgery of U.S. currency by students of the South Dakota School of Mines and Technology"
If this is a known problem with the South Dakota School of Mines and Technology, perhaps some intense interrogation of the students is in order to isolate and prosecute the culprits. Check the computer labs first, to see if the dangerous QR codes were generated there.
Now we can use a background with this site's name in it for "you, sir, are a moron" images.
Screw URLs, I'd just forge a note with a QR that says 'sudo give me all your money'.
This is foolproof.
Hello
We at Pacific Breeze QRs are affliliates of QR.GL Marketing.
This issue can be solved by using a separate QR Code server that is fully monitored by GeoTrust, and the QR Code Optimized Web Page Generator that is retrieved always from our sever will be displayed.
We can also do a proprietory custom Web Page template to make the complete loop very secure.
Security on our QR Code servers is 256 bit encryption.
Please visit us at www.connnectionsqrcodes.com
Or email me at murray@pacificbreezeqrcodes.com
Thank you
Murray