Is scanning QR codes with your phone risky?

On thinking about this some more: Interior pixels of a QR code (far from the registration marks) are equally likely to be black or white, so each of them will on average be surrounded by four other black pixels. So most of the interior cells will die of overcrowding on the first tick. Cells on the outer edge have five neighbors, so on average two or three of their neighbors will be black, so a good proportion of those will survive the first tick. Most of the cells just past the edge won’t have three neighbors, so you’ll get very little new growth outside of the original frame. And then, on the second tick, most of those edge cells that survived the first tick will have dead neighbors inwards, and no new growth outwards, so they’ll die on the second tick.

The registration marks might be more interesting: Symmetric patterns like that often “bloom” into oscillators more interesting than blinkers. Though that’s dependant on not having any interference from any stray survivors near them.

Playing around with it, it looks like a small registration mark (a black pixel, surrounded by 8 whites, surrounded by 16 blacks) turns into a simple hollow cross after only three ticks. A large registration mark (a 3x3 square of black, surrounded by 16 whites, surrounded by 24 blacks) turns into a cross of four blinkers after only three ticks. So yeah, absent interference, even those don’t do much interesting.

A side-comment on Life (which has everything to do with QR codes of course): Circa 1970, when it was fairly new, I was friends with a fellow student at Berkeley who later became a significant player in computer cryptography, working with Prof. Marty Hellman at Stanford. He devised an astonishing algorithm for computing Life generations.

Encoding a field as a bit matrix, with each bit of a word representing a pixel, he developed a sequence of boolean operations that operated on an entire row all at once, taking the current row, the row above, and the row below as inputs.

I took that algorithm and coded it up in assembly language for the CDC-6400 (60-bit words) and then for the PDP-10 in “hextuple precision” (each row being 6 words of 36 bits, or 216 bits). That PDP-10 had a CRT display, so I also coded it up to display the generations there, with an additional option to single-step the generations, and an elaborate format to enter arbitrarily complex starting patterns easily. I still have the assembler listing of that code. It was blazingly fast.

Since these were finite boards, I did the most consistent thing possible at the edges: The top and bottom wrapped around to each other, as did the left and right edges.

I once tried to cram my entire résumé as raw text into a QR code, intending to print it on my business cards. Didn’t quite fit…

Anyone see the Superbowel ad that was just a pong-ing QR code?

A first? I followed it, some Bitcoin offer.

I saw it. QR code floating around the screen for 30 seconds.

It was a Coinbase ad (they flashed that they paid for it at the very end).

I followed the thing with my phone, and assume many others did. I was excited about the ad, which pissed off my gf (she’s in advertising). She thought it was ridiculous, a waste of the cost of the time, but will create some buzz. “An example of producing ads just to create a potential viral ad”, she complained.

When I had a class in advertising in college they discussed those really terrible, low budget ads and said they could still be effective. I still remember the number for Empire Carpet in Chicago (588-2300) and I am willing to bet many Chicagoans still can.

In the end, the ad succeeds if it increases business…even if it is a shitty ad.

Of course, crap ads can be crap too (more likely).

I saw the Super Bowl QR ad, thinking first how unique, then how minimal, then how useless it is for anyone not clicking on it. Most of all, I thought of this thread. I’m betting they are caring more about the Monday buzz about the crazy commercials than getting actual clicks.

The QR ad was more successful than expected…it crashed their app…

Ha!

When the ad came on my second thought was their website will crash when 10 million people scan the code and hit the website within 20 seconds.

I wondered if they had considered that. Apparently not. I guess the ad people didn’t talk to the IT people. Shocker.

Yeah I had the same thought. I imagine the Coinbase advertising dept leadership were all in a war-room somewhere counting down the minutes to the ad being shown during the super bowl (with excitement), while in another war-room in a different location the IT people were doing the same thing (with dread).

The QR commercial is possibly record setting insofar as the biggest difference between the cost of the airtime and the cost of production.

Waking an old topic with some relevant news.

QR codes were embedded in emails, because that let phishing links bypass the email threat scanner. So in this case, I guess scanning the QR code is risky, because it puts you one step closer to passing information to a phishing site.

Obvious solution is to extend email scanners to decode QR codes in attachments and images. I’m a bit surprised they weren’t doing it already.

The article does point out that adding the extra step of scanning a QR code will reduce the number of people who follow the link. To me, the nature of the phishing attempt seems poorly thought out: “scan this code to login to fix a problem with your Office365 account.” Why do I need to do that from my phone? The phishing should have been something where using a phone made sense: “scan this code to install the new required corporate mobile app, you will need to login to Office365 first.”