I have no idea what the QR-code might reveal (I could not read it from this picture), so I pixelised it just to be sure.

FWIW I know exactly what happened. To reproduce, boot your device with init=/bin/sh, then type exit.

Kinda neat.

CachyOS

  • eleijeep@piefed.socialEnglish
    0·
    17 days ago

    Oh I see. If the URL puts the sensitive information after the anchor, like https://example.com/bsod#sensitive-info-goes-here then the browser would never send that part to the server. Everything after the anchor is just used locally by the browser to scroll the page to a specific place (or in this case for the javascript to read and process).

    You’d need to check every time you scan a QR code though that the # is in the URL and it’s not malformed. Trivially replacing the # with a ? would turn the private URL into one that sends all the data in the GET request. It’s training users to do something risky.

    Oh and it also assumes that the javascript hasn’t been tampered with to upload the data somewhere.

    I don’t like it.

    • A_norny_mousse@piefed.zipOPEnglish
      0·
      16 days ago

      It’s possible to use QR code reader apps that do not automatically go to the WWW.

      But who’s going to go to that effort on their slab of glass?

      I agree that the whole concept of QR code scanning is problematic.

      • b000rg@midwest.socialEnglish
        0·
        16 days ago

        I use URLChecker on Android as my default browser so I can inspect any kind of link before opening it. It’s the most useful tool I’ve found on mobile.

      • LeLachs@lemmy.ml
        0·
        16 days ago

        But who’s going to go to that effort on their slab of glass?

        Those who would like to make extra sure their data stays private. On an unrelated note, what kinds of data could be considered confidential in said log?

        • A_norny_mousse@piefed.zipOPEnglish
          0·
          16 days ago

          Those who would like to make extra sure their data stays private.

          Yes, well, exactly. You know not every question is a literal question, right?

          what kinds of data could be considered confidential in said log?

          I was wondering that myself. It’s “the kmsg log”, something to do with kernel mode switching or “graphics”. My guess: the log itself is not problematic, but there might be some metadata added. Or then one creates that metadata by submitting the QR code.