0

Say I have a QR-code on my laptop screen that I need to scan with my mobile device.

Is there anything that can be done to make the on-screen code harder to scan from a distance? I am thinking for colors, contrast, movement, etc. At what point would the legit device have trouble scanning a, for example, moving QR code? Possibly ways of disguising the code in a photo or a noisy background?

I would expect it would be harder to scan a rapidly clockwise movement from a distance than when you can fill the camera’s seeker with the code + wiggle-room.

Any thoughts or other ideas? Throwing a blanket over my head and laptop while scanning the code would be more secure, but less practical than a software based solution.

Improve this question
1
  • If there were a market a software solution could completely cover the code with an obscuring window and convert the value to text for you. Assuming the code relates to value like Bitcoin consider not using the QR but the value instead. QR by design is meant to be read by all who can see it thus a better method of access to the value it contains might be your fix.
    – zedman9991
    Commented Jul 9, 2014 at 14:15

1 Answer 1

Reset to default
1

A decent camera like that one, with some adequate zooming length, will get from 20 meters away a snapshot of your screen with a lot more detail and precision than your own smartphone's camera. By "obscuring" the QR code, you will make the scanning harder and then impossible sooner for your smartphone than for the attacker. Thus, this "obscuring" thing won't work against a decent attacker (it will work only against cheap attackers who also have only smartphones).

Longer range eavesdropping can be done with bigger but still off-the-shelf hardware, such as this one. Its aperture should allow for picture precision down to 1 mm (i.e. sufficiently low to scan the QR code, even "noised out") from 500 meters away.

Also, remember that QR codes are optimized for easy reconstruction in a fraction of a second by a smartphone. The encoding is ripe with error-correcting codes so that scanning works even in noisy environments. This helps both your phone and the attacker. But the attacker can spend more time cleaning up the picture with Photoshop, allowing him to obtain the data from a picture which would be too blurred for a generic smartphone to handle.

A better way would be to block the view of the screen from the attacker. The "blanket" method would work. If you want to improve things, I suggest that you modify the QR-displaying system so that it shows a blank square most of the time, displaying the actual QR code only when you strike a specific key on your laptop keyboard, and for only three seconds. That way, you can keep the critical phase (during which the QR code is actually visible) short.

Not performing sensitive operations in locations where there are roaming shoulder surfers might be a good idea after all.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .