I haven't tested any of these apps, but wanted to make sure the apps were coded in such a way that they will resist a malicious QR code that contained a fully qualified URL that led to a fake website.
Example: I am an attacker, and I print a QR code on a note that encodes the following URL:
http://my-nifty-attack-site.tk/address/128jxLBCaS1MZpCtXEzN8TmwcetBHibP9L When browsed, the attack site shows a mockup of blockexplorer / blockchain.info that shows a big balance that is not really there, which allows me to deceive someone into thinking I paid them when I really haven't.
The app should never send the smartphone browser there, but instead be smart enough to strip the bitcoin address out, and formulate the correct complete URL on its own: e.g.
http://blockchain.info/address/128jxLBCaS1MZpCtXEzN8TmwcetBHibP9LHi Mike
Hope you are doing well! I am loving my casascius coins!
As of now, the way it works is as follows:
http://blockexplorer.com/address/(unescape(e.result).match(/([^\?]*)/)[1].replace("bitcoin:",""))
What this means is:
1. It is safe from the malicious attack that you have provided above in terms of
http://my-nifty-attack...
2. However, it will
only accept QR codes that have the following form:
128jxLBCaS1MZpCtXEzN8TmwcetBHibP9L
bitcoin:128jxLBCaS1MZpCtXEzN8TmwcetBHibP9LAs per Winterfrost:
They will simply get some kind of 404 or Address not found I presume. Please checkout that tiny snippet on GIST -- that is the entirety of what this is as I simply made this quickly in an effort to give back to the bitcoin community which I have really come to value greatly. As Erik Voorhees had once mentioned, you guys (bitcoin community) are truly amazing.
With that said, if you think the reader needs to be able to read other types of addresses aside from the "#2" listed above, please let me know.
Cheers,
rasengan
