All it takes is for one organised crime syndicate to hack the site and compromise millions of people’s data for this trend to die off.
Now I would never encourage anyone to break any laws . . . but in this situation are there any forumosans out there ready to take one for the team? 
Guy
I don’t think gangsters want to know your diet and food preferences.
Nobody cares about food and dietary preference.
I mean hacked site where they steal real info, like credit card info, banking info, passwords, etc.
They’re encrypted on the devices if they used apple/samsung/google pay, but still…
Information like (for the US) SSN, ID number, date of birth, mother’s maiden name, answer to possible security questions, stored passwords, etc.
Oh and World Gym requires you to use their app to use their gyms… what if you don’t have a smartphone?
I think this demonstrates the lack of understanding. @Taiwan_Luthiers is pretty on the nose with this one. All devices come with exploits. Millions of android devices running out of date versions. Phishing, data theft, unauthorised charges, keyloggers, account information if stored, RANSOMWARE. If some of the biggest companies get hacked, you think Apple 203 is going to be paying for better security tham Sony?
My ROG phone is still stuck on Android 9. Here is a Bluetooth exploit. Hopefully restaurants don’t start using Bluetooth!
This exploit will never be patched for me.
Source:
Not to mention, if the restaurant requires an app, that can have numerous additional exploits.
Best would be to not use a smartphone. There’s a lot of personal info on them, if a thief got it they can basically steal your life.
I remember in Austin if you used Capital Metro they had apps that you could buy tickets on. The app would display a thing that changes color when you tap it (you show it to the driver to get on). Not hard to write an app that does the same and you can essentially steal rides. No idea why they aren’t using RFID cards like everyone else (probably because it’s a backwater city that don’t care about public transportation).
The problem is everyone’s requiring a phone these days.
Planned obsolescence. They want your cheap ass to keep buying a new phone every year to enjoy the latest security features.
Why would you give out any of that sensitive info when you order food using a QR code? And don’t you order on your own phone?
I was responding to Marco, and we were talking about ordering food at a restaurant with a QR code (presumably with your own phone). Why would you give out any of this info when ordering food?
If the site the QR code is compromised, they will steal other info off your phone.
There isn’t a way for a website to get much sensitive info from your phone without you explicitly typing it or installing something. Just going to a URL or browsing the internet can’t hurt you.
When we say a website is compromised, it doesn’t mean it physically steals info from your device. It just means the info you actually give them is stolen by a third-party. What kind of info are you giving the restaurant when you order your food?
There are exploits, viruses, etc. especially for older phone OS. They can and do steal info.
That’s why it’s called theft. It’s taken without permission. From your phone. The one device that has everything about you on it.
You can’t get viruses or malware on your phone without downloading and executing anything. Phones work exactly like computers.
Yea, which means sites get hijacked with malware and such.
Websites don’t have the capability to take anything from your phone unless you download and open a file, or you type sensitive information into the website yourself.
Sites can get hijacked, but that doesn’t mean your phone is hijacked. Your phone can’t get hijacked unless you actually download something, and open it as I already said.
I think Marco already told about an exploit where they can steal personal info through Bluetooth. It’s patched in later versions of android but if you have an old phone, it never gets patched.
There are viruses out there that can evedrop on you by turning on your microphone without your knowledge. What happens is the hacker would call you, and your phone will answer without you knowing. Then it’s transmitting whatever you said. I’m sure it’s all patched but who knows what exploit gets made everyday?
Best way to be secure is not use a smartphone, but with everyone requiring qr codes, apps, this isn’t possible.
Basically use a dumb phone with removable battery, and phone is turned off with the battery removed when not using it. Again, this is impossible with smartphones because none have removable batteries except very old android devices.
And it’s not like hackers don’t know about permissions and such. That’s why exploits are made to get around it.
Again, none of the exploits you mentioned are possible without you first explicitly doing something dumb on your end to allow them. It’s very rare for an exploit to be able to get around your phone permissions, and if you do run into such powerful exploits then chances are lots of other phones have too, and QR codes will be the least of anybody’s concerns.
Scanning a QR code isn’t any more risky than going to any website manually in your web browser. If you don’t want to scan a QR code, then you shouldn’t browse the internet either.
This is completely false.
Yes it can.
No.
I’m not giving them anything. A spoofed website can be malicious in nature and be malicious in both the software engineering side as well as the social engineering side to cause damage.
This is false.
And computers have vulnerabilities that can be exploited.
Yes they do.
What did these people do to have their files locked?
Did they run the malicious software themselves? Do you know why browsers are constantly being updated? Because everything comes with vulnerabilities and many of those vulnerabilities allow code to be executed with elevated privileges.
Any JavaScript code that runs in your web browser via a nefarious website cannot affect anything outside your browser environment. If you come across a bad website then just close your browser.
The only way a malware or virus can leave your browser and enter your OS is if you download it and then install it. Sure, a bad actor can write some JavaScript to trigger an automatic download, but your OS still won’t allow downloaded files to run (or install) automatically.
Of course, I am speaking from the perspective of an iPhone and Mac user. I’ve never seen one malware or virus in the last 20 years. It’s very possible that Windows hasn’t caught up yet.