Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -1 down vote favorite

Can QR codes always be copied? I am looking for some sort of QR code or chip that can be readily scanned (preferably via smartphone) and linked to a secure website, but that cannot be copied or reproduced in any way. Any thoughts?

share|improve this question
3  
Interesting concept, creating something that needs to be imaged to be read that cannot be imaged to be copied. It's like creating listenable non-copyable music, a much sought after dream of the recording industry. – Fiasco Labs Jun 30 '12 at 6:26
3  
Anything visual that has to be interpreted by a camera can be copied. – schroeder Jun 30 '12 at 6:55
2  
Can you explain your use case to some level of detail. Because there are many different things you could mean. But my immediate question is this -- if the QR code can't be readily scanned, what purpose does it serve? The point of a QR code is to allow some piece of information to be readily scanned. – David Schwartz Jun 30 '12 at 9:26
See QR codes that can't be copied - possible?, which looks like the same question. – D.W. Sep 22 '12 at 0:07

5 Answers

up vote 9 down vote

If such a thing existed, we could have solved counterfeiting printed money ages ago.

share|improve this answer
up vote 5 down vote

If it can be read, it can be copied. This is also the main reason DRM is useless.

share|improve this answer
1  
DRM works very well in online games such as Second Life. The trick is not to give the protected data (e. g. server side scripts, virtual items that cannot be uploaded) to the client. I went into details on that topic in Are there DRM techniques to effectively prevent pirating?. – Hendrik Brummermann♦ Jun 30 '12 at 16:50
up vote 3 down vote

It might be a good idea to give more context. There are multiple uses cases and it is hard to guess what you are aiming at.

As far as I understand you, we need to distinguish two aspects:

  • copying the chip
  • copying the link

How to prevent copying the chip?

Common smartcards store a private key. The chip can be told to decrypt or sign data. But the chip has no command to read the private key.

Smardcards are designed in a way which makes it extremely difficult to get external access to the internal memory without destroying the card. While there are attacks on smartcards (e. g. based on power analysis or artificial wearing), they are out of scope for most use cases.

The smardcard can sign the provided information and the reader can verify that the signature is correct.

How to prevent copying the link?

If you make the link available to an untrusted reader, it can be copied. For example there is quite a number of exploits that give full permissions to the owner of a smartphone.

So you must ensure that the user never knows the link. This can be done by replacing the link with a token.

The token is generated by the chip and contains a unique identifier and the link. It is encrypted with a public key that is known to the chip and signs it with its own private key.

The user submits this token to a server. The server verifies the signature and decrypts the token to extract the identifier and link. It checks that the identifier has not been used before. Then it connects to the target of the link, and forwards the response to the user.

The user does not know the link because it gets the response from the relay server. After the request the token is marked as used, so copying the token is not useful.

share|improve this answer
up vote 1 down vote

Use a hard to find or hard to buy paper color that cannot be copied, like metalic ones, watermarked, ...

share|improve this answer
That would make it harder, but not impossible :) – Lucas Kauffman Jun 30 '12 at 8:35
agreed. hence the 'hard to find' – jippie Jun 30 '12 at 8:40
He meant that it's not impossible to copy – schroeder Jul 1 '12 at 6:34
up vote 0 down vote

What about combining several factors to make it unique? Like a SMS text callback confirmation or require a facial pic of the user to unlock the scanned qr code?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.