Guide to (not) fucking up QR codes

The last example is wild. Looks like QR marketing hasn't reached it's full potential yet.

Recently discussed: https://lobste.rs/s/urdoby/dithered_qr_codes

Russ Cox made a tool that lets you embed an image in a QR code. I used it for my business cards.

https://research.swtch.com/qart

One of the most amusing tricks I've seen is the fake code that some designs add outside the real code square, to make it look like a heart, or some other shape.

I expected a different take from infosec.exchange. What stupid stuff you can do security-wise:

• Use a static QR code for something security-related. You want it to be time-limited / expiring.
• Tell people to just scan a QR code containing a link. An attacker can replace the code with another.
• In a multi-device scenario (e.g. transferring something confidential from one device to another), is the device scanning the code and confirming the action trusted? Can someone perform an AITM?

There is https://qrbtf.com which can generate qr codes with images