-2

Can QR codes always be copied? I am looking for some sort of QR code or chip that can be readily scanned (preferably via smartphone) and linked to a secure website, but that cannot be copied or reproduced in any way. Any thoughts?

4
  • 4
    Interesting concept, creating something that needs to be imaged to be read that cannot be imaged to be copied. It's like creating listenable non-copyable music, a much sought after dream of the recording industry. Jun 30, 2012 at 6:26
  • 6
    Anything visual that has to be interpreted by a camera can be copied.
    – schroeder
    Jun 30, 2012 at 6:55
  • 3
    Can you explain your use case to some level of detail. Because there are many different things you could mean. But my immediate question is this -- if the QR code can't be readily scanned, what purpose does it serve? The point of a QR code is to allow some piece of information to be readily scanned. Jun 30, 2012 at 9:26
  • 5
    See QR codes that can't be copied - possible?, which looks like the same question.
    – D.W.
    Sep 22, 2012 at 0:07

6 Answers 6

13

If such a thing existed, we could have solved counterfeiting printed money ages ago.

0
7

If it can be read, it can be copied. This is also the main reason DRM is useless.

1
3

It might be a good idea to give more context. There are multiple uses cases and it is hard to guess what you are aiming at.

As far as I understand you, we need to distinguish two aspects:

  • copying the chip
  • copying the link

How to prevent copying the chip?

Common smartcards store a private key. The chip can be told to decrypt or sign data. But the chip has no command to read the private key.

Smardcards are designed in a way which makes it extremely difficult to get external access to the internal memory without destroying the card. While there are attacks on smartcards (e. g. based on power analysis or artificial wearing), they are out of scope for most use cases.

The smardcard can sign the provided information and the reader can verify that the signature is correct.

How to prevent copying the link?

If you make the link available to an untrusted reader, it can be copied. For example there is quite a number of exploits that give full permissions to the owner of a smartphone.

So you must ensure that the user never knows the link. This can be done by replacing the link with a token.

The token is generated by the chip and contains a unique identifier and the link. It is encrypted with a public key that is known to the chip and signs it with its own private key.

The user submits this token to a server. The server verifies the signature and decrypts the token to extract the identifier and link. It checks that the identifier has not been used before. Then it connects to the target of the link, and forwards the response to the user.

The user does not know the link because it gets the response from the relay server. After the request the token is marked as used, so copying the token is not useful.

0

What about combining several factors to make it unique? Like a SMS text callback confirmation or require a facial pic of the user to unlock the scanned qr code?

0

Use a hard to find or hard to buy paper color that cannot be copied, like metalic ones, watermarked, ...

3
  • That would make it harder, but not impossible :) Jun 30, 2012 at 8:35
  • agreed. hence the 'hard to find'
    – jippie
    Jun 30, 2012 at 8:40
  • He meant that it's not impossible to copy
    – schroeder
    Jul 1, 2012 at 6:34
0

It's not impossible but maybe very expensive for a product, we can use a random pattern for each label(maybe fiber like mostly bank note used)and you can use anti scan ink and photo blocker ink(used mostly on license plate)

2
  • 1
    "You can use anti-scan ink" is explicitly ruled out by the author's desire for "some sort of QR code or chip that can be readily scanned".
    – J Kimball
    Apr 6, 2016 at 11:48
  • so sorry got little confused here, so what author's what to protect? the QR code image? or the value of the qr code/the website link? if the image that author want to protect maybe you can use security paper/ink if author want to protect the value, maybe he can make some encrypt - decryption apps with user authentication to generate and read/scan qr code. Apr 11, 2016 at 8:10

Not the answer you're looking for? Browse other questions tagged .