If you’re running a public service, you should have a key that’s trusted by a CA anyway. So why couldn’t you, especially for qr codes that link to an https site, embed a signature in that qr code that verifies that the person that owns parkyourcar.com’s private key also created the code you just scanned? Just like signed pdfs?
Okay and what happens when I overwrite that qr code with one that points to downloadvirus.com? How is a client supposed to know that the qr code isn’t supposed to be here?
Well, because it won’t be signed by a trusted CA for that task. Like if CAs had a category of certificate issuance that applied here (the standardisation issue) then it would be easy to spot a fake (which wouldn’t be correctly signed). Alternatively, you could take the European approach of having everything government related (like public street parking, though Europe mostly uses apps for that, not signed QR codes) rely on government entities and those in turn on a national set of government CAs.
QR codes are mostly meant to let you get an amount of info (they’re mostly text-based) without having to type or enter it manually when you might make mistakes or when the process is just faster for the amount of text involved.
If you’re running a public service, you should have a key that’s trusted by a CA anyway. So why couldn’t you, especially for qr codes that link to an https site, embed a signature in that qr code that verifies that the person that owns parkyourcar.com’s private key also created the code you just scanned? Just like signed pdfs?
Okay and what happens when I overwrite that qr code with one that points to downloadvirus.com? How is a client supposed to know that the qr code isn’t supposed to be here?
Well, because it won’t be signed by a trusted CA for that task. Like if CAs had a category of certificate issuance that applied here (the standardisation issue) then it would be easy to spot a fake (which wouldn’t be correctly signed). Alternatively, you could take the European approach of having everything government related (like public street parking, though Europe mostly uses apps for that, not signed QR codes) rely on government entities and those in turn on a national set of government CAs.
Very cool. Why would anyone use qr codes then? When you can just write a url and that’s free
QR codes are mostly meant to let you get an amount of info (they’re mostly text-based) without having to type or enter it manually when you might make mistakes or when the process is just faster for the amount of text involved.