RE: https://c.im/@BBC/117144240968313104
Years ago when I lived in Canterbury, they brought in a phone to pay thing for parking. I wrote a letter to Canterbury city council saying this was a bad idea as someone could put a sticker over the phone number, and scam people for their credit card details. CCC said this wasn't a realistic attack, and they proceeded with the roll out.
The phone number is now a QR code.
And I was fucking right.
@quixoticgeek CCC being Canterbury City council, I assume?
because the other CCC (Chaos computer club) would definitely have agreed 😅
@pascoda yes. Definitely.
@quixoticgeek I recently saw a QR code on a poster that had text next to it that read something like "if this QR code appears to have been tampered with, do not use". Way to acknowledge the threat while doing absolutely nothing to mitigate it.
@quixoticgeek Who could have seen it coming? 😲
@quixoticgeek Basically, never scan a QR code, particularly one that appears in public.
Unless you are really convinced that it's legitimate. Sometimes you have to, eg you've just bought a widget and the only way to get at the documentation is to scan the QR code on the widget's label. And ones that appear on your computer or telly screen, eg to link an account on one to the other, probably haven't had anything stuck over them!
The worst I've seen is supermarket click-and-collect, where on arrival you're supposed to scan the QR code, in a publicly accessible car park, to tell them you've arrived and are waiting for your groceries.
Aug 23, 2026, 12:53 PM@TimWardCam @quixoticgeek In Suffolk the car park sign usually has the full list of apps (there's more than one available) so you can search independently on Play Store to check you get the legit one.
Last time I had to use one I had to pick the second app as the first one, whilst legit, didn't even register at all let alone ask for payment details!
I also use Binary Eye if I do scan a QR code which shows where its linked to, but you still need to know what you are looking for and what might be dodgy
Its still a lot of hassle compared to having a proper parking machine that works, but those who break into the ones that hold cash and vandalise the others are as much to blame for this situation as big tech..
@vfrmedia @TimWardCam the fact that an app is needed to park a car is really fucking annoying. I hate it. What do people do if they don't have free space on their phone for another app ?
Esp when the apps are all just a website wrapper anyway.
@quixoticgeek @vfrmedia Ah, there's an answer to that - an app which is supposed to work for all local authority parking across the country.
@TimWardCam @vfrmedia I'm in my 6th country in 2 weeks...
@TimWardCam @quixoticgeek @vfrmedia
And slightly after SOON 10 of them have been relegated to legacy use in forgotten infrastructure and the other 5 have grown into bloated monsters as more and more use case ae included.
I was on the C++ ANSI standards committee before the 1st release. Please don’t ask me about Bjarne Stroustrup lest I fill the bandwidth of this instance with lovecraftian tales of opportunities lost.
Aug 23, 2026, 3:55 PM@SpeakerToManagers @TimWardCam @quixoticgeek
what Suffolk does seem to have is a common protocol for site codes and data exchange which is usable by a number of competing parking app providers - who all take a few pence as a cut for their profits and/or use the details they get on your car to do DVLA and SMMT data scans and then recommend garage services..
@quixoticgeek @vfrmedia @TimWardCam A place where I often park is under a shopping centre and has dreadful mobile reception. So you have to park your car and walk outside before you can pay. And you have to hope that you don't get sniped by a warden in the meantime.
@DJDarren @quixoticgeek @vfrmedia I know a National Trust car park whose notice tells you that mobile reception is bad and suggests you climb the little embankment behind the toilets (or somesuch).
@DJDarren @vfrmedia @TimWardCam there was a case in the UK where people were being fined based on anpr cos they didn't pay within 5 minutes, but it required a walk to get to somewhere with phone signal. It was like the car park itself was a scam.
@quixoticgeek @vfrmedia @TimWardCam
Apps seem to be optional in the car parks around Colchester. Every where I park has a contactless option.
@vfrmedia @quixoticgeek I have never made a parking app on a phone work.
I still can't see what's wrong with waving a contactless card at the machine, orders of magnitude quicker and easier.
Aug 23, 2026, 12:57 PM@vfrmedia @TimWardCam @quixoticgeek URL shorteners make it all but impossible to know where QR codes go.
@vfrmedia @TimWardCam @quixoticgeek Park and Ride machines in Oxford have signs up saying "this machine does not have QR codes"!
@keefeglise @vfrmedia @quixoticgeek Ah, so the scammers know exactly where to stick the QR codes on - to cover up this wording.
@TimWardCam @vfrmedia @quixoticgeek It's in very large letters. It wouldn't work.
Aug 23, 2026, 3:52 PM@keefeglise @TimWardCam @quixoticgeek
most scammers are going to struggle to get access to a printer larger than A3 size, and someone attempting to surreptitiously put up such a thing in a car park that is often busy 24/7 and might have a further CCTV scheme of its own would be a scene worthy of a comedy sketch show..
Aug 23, 2026, 11:41 AM@quixoticgeek Of course a big part of the issue is that these days crime is basically legal as long as you do it through a company. Typically it is not actually all that difficult to find the culprits behind stuff like this, you can't process credit cards without leaving some pretty significant trails.
@NohatCoder except you don't need to process them just collect the info and sell it on.
Aug 23, 2026, 11:53 AM@quixoticgeek Whoever buys the info has to use it. Of course the details vary, but the constant is that these things are not treated like the crimes they are.
@quixoticgeek And will anything be done to stop it? Doubtful.
@quixoticgeek for #Android there's this app imaginatively called "QR Scanner" (com.secuso.privacyFriendlyCodeScanner) that shows you a preview of the data on the QR and makes you agree that you want to follow the URL (if it is one).
Granted, most people don't know how to read URLs, and most also use the QR Scan mode of their camera app :(
Aug 23, 2026, 12:42 PM@quixoticgeek This happened in Boston, USA. They put QR codes on meters and signs and some were covered over with new stickers. The city didn’t care for the longest time because they got fine revenue from people who thought they’d paid but had been scammed and it’s impossible for the parking attendants or the public to tell if a QR code is correct if the scam site is halfway convincing.
I always use the pay-by-phone app and manually type in the zone. I get that this relies on the app store approval / security process, but it’s better than nothing since I can’t use quarters in most places anymore.
Yikes 😬
Most of our parking meters (one machine every block or two and you put in your license plate number) still take credit cards. I'll probably use your method if credit card access goes away.
@quixoticgeek it's never realistic until it happens 😁
@quixoticgeek There was a remote rural car park round our way where they swapped out the QR code but also swapped out the support number for people worried about scams on the sticker next to it & caught folk both ways.
@quixoticgeek of course you were right. Why would no-one pick such low-hanging fruit?
@quixoticgeek So what needs to happen maybe is a way to certify that a QR code you are scanning is legit.
Maybe a signed jwt as the qr code payload. Then the reader can verify the signature and the id of the signer before making it navigable or whatever.
Then somehow magic everyone into forgetting qr-code readers that don't do this exist.
Aug 23, 2026, 2:39 PM@quixoticgeek CCC == Canterbury City Council and not the Chaos Computer Club (which would chime in to you warning), I assume?
@leyrer yes.
People, if your life has become tedious and lacks excitement, just make a habit of scanning QR codes. Or jumping off bridges with no parachute or bungie. Hoo-ray for gambling with your eyes closed!