I posted a comment on the announcement when it was posted here: >As someone who is working in incident response and malware analysis I h...

I posted a comment on the announcement when it was posted here: >As someone who is working in incident response and malware analysis I have to say that is one of the worst ideas I have ever seen. A lot of companies have issues with ClickFix [1] and other social engineering campaigns and now Google wants to teach users that they should scan QR codes to proceed on a website. >How should we realistically teach Susan from HR the difference between a real Google Captcha QR code and a malicious phishing QR code - you (realistically) can't. I wish we could - but those people don't work in tech, they will never know and I can't really blame them because at the end of the day they are just happy that they don't have to deal with tech after work. >We have spent years of behavioural conditioning to prevent QR-code based phishing attacks (some people call it Quishing but I hate that term) and since the QR code is being scanned from a mobile device (99.99% of the time the private device), we have no EDR visibility on those devices and can't track what's happening if people scan it. >This is more of an invitation for threat actors than it is something that holds them back. [1] https://www.kaspersky.com/blog/what-is-clickfix/53348/

Posted by mafriese on May 8, 2026, 7:29 PM

Tags

• complaint (Other)

Related issues

• I wish there was something that could be done beyond feeling powerless.
• I don’t hate taxes per se but I hate that the government will take tax dollars earmarked for one purpose, which is how they got the tax a...
• I've never thought SF Symbols were beautiful.
• > conservatives don't like being told that their ideas, while legally allowed, are not welcome in polite company As long as there are a ...
• Yeah but this AI music is worse than any AI produced code.
• I wish there was a way I could get educational-only youtube as an adult.