Can QR codes always be copied? I am looking for some sort of QR code or chip that can be readily scanned (preferably via smartphone) and linked to a secure website, but that cannot be copied or reproduced in any way. Any thoughts?
It might be a good idea to give more context. There are multiple uses cases and it is hard to guess what you are aiming at.
As far as I understand you, we need to distinguish two aspects:
- copying the chip
- copying the link
How to prevent copying the chip?
Common smartcards store a private key. The chip can be told to decrypt or sign data. But the chip has no command to read the private key.
Smardcards are designed in a way which makes it extremely difficult to get external access to the internal memory without destroying the card. While there are attacks on smartcards (e. g. based on power analysis or artificial wearing), they are out of scope for most use cases.
The smardcard can sign the provided information and the reader can verify that the signature is correct.
How to prevent copying the link?
If you make the link available to an untrusted reader, it can be copied. For example there is quite a number of exploits that give full permissions to the owner of a smartphone.
So you must ensure that the user never knows the link. This can be done by replacing the link with a token.
The token is generated by the chip and contains a unique identifier and the link. It is encrypted with a public key that is known to the chip and signs it with its own private key.
The user submits this token to a server. The server verifies the signature and decrypts the token to extract the identifier and link. It checks that the identifier has not been used before. Then it connects to the target of the link, and forwards the response to the user.
The user does not know the link because it gets the response from the relay server. After the request the token is marked as used, so copying the token is not useful.