A [1]hyperlink [goatse.cx] has at least the potential to be confirmed as something safe and familiar.

[1] http://goatse.cx/

Before browsers started obscuring them, you used to see entire links before you interacted with them, and human readability was a feature. Ironically Slashdot itself undermined your example by prominently displaying the associated domain.

Many QR code interfaces are now displaying the underlying URL before proceeding to enable discriminating.

> And how is that different from a [1]hyperlink [example.com]?

At least with a hyperlink, you can visually see what the FQDN is. If it is amazon.com, apple.com, or company name you have actually heard of, you can likely proceed with reasonable confidence. If it is amaz0n.com, you know something is fishy. With a QR code, you can't even eyeball it for sanity.

[1] https://example.com/?dvfjslDFSB34b

The rest of the article:

> Researchers and fraud managers said it was hard to estimate the costs of “quishing” as cyber security companies and banks do not typically log the format of malicious links and because such emails may be just one element in a broader cyber attack.

> But research by IBM found that “phishing” attacks — which involve scammers send targeted emails with malicious links — are increasingly expensive to companies, with the global average cost of a data breach rising nearly 10 per cent to $4.9mn in 2024.

> QR codes contain data, such as URLs or payment information, in binary code. Invented by Japanese company Denso Wave in 1994 as a tool for tracking auto parts, these codes are designed to be quickly readable by machines, particularly smartphones, but are generally illegible to humans.

> Although most smartphones display a short preview of the URL contained in a scanned QR code, researchers have said that this pop-up is generally not sufficient for users to be able to detect that a link might be fraudulent.

> “These attacks take advantage of the fact that QR codes, by nature, are difficult to interpret visually, so victims often don’t know where they are being directed to until it’s too late,” said Amir Sadon, director of research at cyber security consultancy Sygnia.

> Banks said that the prevalence of this kind of scam has accelerated since QR codes surged in popularity during the Covid-19 pandemic, when they were used to display everything from vaccine passports to restaurant menus. “It’s definitely a growing trend in terms of the number of reports we’re seeing,” said Steph Harrison, a senior fraud operations manager at TSB.

> A survey by security software company McAfee in May found that more than a fifth of all online scams in the UK probably originated from QR codes. Reports of QR code scams in the UK more than doubled in the year to August 2024, according to Action Fraud.

> The US Federal Trade Commission, as well as multiple local authorities across the UK, also warned this year about a specific kind of “quishing” scam targeting drivers, including cases where stickers directing users to fraudulent sites have been placed on top of legitimate QR codes used to pay for parking.

> These links may direct users to an incorrect website and ask them to enter their details, or lead them to download malware. Worse still, said Harrison, “you could also get fined for not actually having a parking ticket”.

> Victims have also reported fraudulent QR codes being placed over legitimate ones at EV charging points, train stations and restaurant tables.

> But researchers said that “quishing” scams are most commonly deployed in emails — a threat that has put corporate security vendors under pressure to adapt their online defences.

> “Today almost no [cyber security] products are looking through attachments,” said Wisniewski. “If this continues to be a problem, I suppose the industry will have to move there — but it will slow down the delivery of emails, and it will also make things more expensive.”

I will grant you that through various methods it is possible to obscure almost every detail one might make a trust decision on within a link. At least though if you are somewhat savvy you can 'spot' if the opacity is there for a technical reason or just to make it harder to know what your clicking on, or some mixture of the two, and make your choice informed by that judgement/information.

QR codes basically normalize near total opacity. A lot of QR code applications represent an interface designed to active

> or by setting your settings incorrectly.

Which most people do. Even if they should know better. Because it's a second or two faster.

I was going to post a link to the graphic of the funny Windows Defender popup (the one with the button that says "make this message go away and get on with things"). But most of what came up in my search was how to turn security warnings off.

You win the internet for an hour. Well played.

> I feel like the new cyber security words are all made up by CompTIA so to sell people new Security+ text books.

This. I imagine KnowBe4 has a hand in it as well in order to sell annual "security" training.

> That's a strange way of saying you've never met anyone that actually works in security. Where do you think these silly terms came from in the first place. A quick google search of the term will tell you that it's already a thing, you can get onboard with nomenclature used or you can forever be considered that one stubborn person who has trouble communicating with others.

Weird... and here I thought my Masters in Information Assurance and 3 decades of experience actually meant something all this time.