Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Can QR codes always be copied? I am looking for some sort of QR code or chip that can be readily scanned (preferably via smartphone) and linked to a secure website, but that cannot be copied or reproduced in any way. Any thoughts?

share|improve this question

marked as duplicate by SmokeDispenser, Matthew, RoraΖ, Steffen Ullrich, Mike Ounsworth Apr 7 at 2:42

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Interesting concept, creating something that needs to be imaged to be read that cannot be imaged to be copied. It's like creating listenable non-copyable music, a much sought after dream of the recording industry. – Fiasco Labs Jun 30 '12 at 6:26
Anything visual that has to be interpreted by a camera can be copied. – schroeder Jun 30 '12 at 6:55
Can you explain your use case to some level of detail. Because there are many different things you could mean. But my immediate question is this -- if the QR code can't be readily scanned, what purpose does it serve? The point of a QR code is to allow some piece of information to be readily scanned. – David Schwartz Jun 30 '12 at 9:26
See QR codes that can't be copied - possible?, which looks like the same question. – D.W. Sep 22 '12 at 0:07

If such a thing existed, we could have solved counterfeiting printed money ages ago.

share|improve this answer

If it can be read, it can be copied. This is also the main reason DRM is useless.

share|improve this answer
DRM works very well in online games such as Second Life. The trick is not to give the protected data (e. g. server side scripts, virtual items that cannot be uploaded) to the client. I went into details on that topic in Are there DRM techniques to effectively prevent pirating?. – Hendrik Brummermann Jun 30 '12 at 16:50

It might be a good idea to give more context. There are multiple uses cases and it is hard to guess what you are aiming at.

As far as I understand you, we need to distinguish two aspects:

  • copying the chip
  • copying the link

How to prevent copying the chip?

Common smartcards store a private key. The chip can be told to decrypt or sign data. But the chip has no command to read the private key.

Smardcards are designed in a way which makes it extremely difficult to get external access to the internal memory without destroying the card. While there are attacks on smartcards (e. g. based on power analysis or artificial wearing), they are out of scope for most use cases.

The smardcard can sign the provided information and the reader can verify that the signature is correct.

How to prevent copying the link?

If you make the link available to an untrusted reader, it can be copied. For example there is quite a number of exploits that give full permissions to the owner of a smartphone.

So you must ensure that the user never knows the link. This can be done by replacing the link with a token.

The token is generated by the chip and contains a unique identifier and the link. It is encrypted with a public key that is known to the chip and signs it with its own private key.

The user submits this token to a server. The server verifies the signature and decrypts the token to extract the identifier and link. It checks that the identifier has not been used before. Then it connects to the target of the link, and forwards the response to the user.

The user does not know the link because it gets the response from the relay server. After the request the token is marked as used, so copying the token is not useful.

share|improve this answer

What about combining several factors to make it unique? Like a SMS text callback confirmation or require a facial pic of the user to unlock the scanned qr code?

share|improve this answer

Use a hard to find or hard to buy paper color that cannot be copied, like metalic ones, watermarked, ...

share|improve this answer
That would make it harder, but not impossible :) – Lucas Kauffman Jun 30 '12 at 8:35
agreed. hence the 'hard to find' – jippie Jun 30 '12 at 8:40
He meant that it's not impossible to copy – schroeder Jul 1 '12 at 6:34

It's not impossible but maybe very expensive for a product, we can use a random pattern for each label(maybe fiber like mostly bank note used)and you can use anti scan ink and photo blocker ink(used mostly on license plate)

share|improve this answer
"You can use anti-scan ink" is explicitly ruled out by the author's desire for "some sort of QR code or chip that can be readily scanned". – J Kimball Apr 6 at 11:48
so sorry got little confused here, so what author's what to protect? the QR code image? or the value of the qr code/the website link? if the image that author want to protect maybe you can use security paper/ink if author want to protect the value, maybe he can make some encrypt - decryption apps with user authentication to generate and read/scan qr code. – Febri Ade Putra Manusama Apr 11 at 8:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.