The QR code was never meant to be trusted

The QR code was invented in 1994 by an engineer at Denso Wave, a subsidiary of Toyota, to track car parts moving through a factory. The barcode of the day held too little information and had to be read straight on. The brief was to build something that carried more data and could be read fast, from an awkward angle, by a scanner held by someone with better things to do.

Judged on that brief, it is one of the great pieces of industrial design. It is free, open, universal, prints on almost anything and works reliably in conditions that defeat most machine vision. Three decades later it is on every menu, poster, parcel and payment terminal in the country.

What it was never asked to do was prove anything. There was no security requirement, because the threat model was a factory floor where nobody had a motive to forge a label on a gearbox. We took a stock-control technology and pointed it at our bank accounts, and then acted surprised.

What a code should do instead is something I filed on in 2020. WO2021156618A1 describes an ownership register reached through proxy codes, so a buyer can check the provenance of an item without ever being handed the identifier itself. The code becomes a question you ask the register rather than an answer you carry around.

Two properties, and both are load-bearing

Almost every problem with QR in the wild comes from two design decisions that were entirely correct in 1994.

The first is that the code carries its own payload. The URL, the text, the payment string is physically encoded in the pattern. Nothing is looked up, nothing is checked. That is why it is so fast and so dependable, and it is why a photograph of a QR code is not a copy of it, it is another original. There is no difference between the two, because there was never anything to differentiate.

The second is that it is fixed at the moment of printing. Whatever it says, it says forever. You cannot change it after distribution, you cannot withdraw it, and you have no idea how many times it has been read, by whom, or where.

Together those mean a QR code cannot answer the only question that matters when trust is involved: should this particular scan, by this person, in this place, right now, be allowed? It has no mechanism for the question. It is a label that reads aloud, and it reads aloud to everyone identically.

Which is why quishing works so well

The attacks follow directly from the design, and they are cheap.

Print a sticker, put it over the one on a parking meter or an electric vehicle charger, and you have redirected a payment flow for the cost of a laminator. Nothing was hacked. The system worked exactly as specified, and the specification never included any way to tell your code from mine.

In email it is worse, because QR defeats the defences by accident. Security tooling has spent twenty years learning to inspect links in messages. A QR code is an image, so the link is not there to inspect. The reader is trained to point a phone at it, which moves the victim from a managed corporate laptop to a personal device outside the perimeter, with a smaller screen that hides the address bar. The attacker gets to skip the filter and downgrade the endpoint in a single step.

And there is no recall. A compromised code stays live on printed material for as long as the material exists. There is no revocation because there was never anything to revoke.

To be fair to the format, none of this is a defect. It is a category error on our part. We used an identifier as a credential.

What a credential actually requires

Strip it back and a thing you can trust needs four properties, none of which a printed data-carrying code can have.

It must not carry its own answer, so that copying the mark does not copy the authority. It must be resolved at the moment of use, so the answer can account for circumstances that did not exist when it was made. It must be revocable instantly, long after distribution, because you will eventually need to kill one. And it must record what happened, including the attempts that were refused, because refusals are the signal.

Notice that all four are about the future. The reason a printed payload fails is that it commits you, permanently, at the instant of manufacture, to a decision about a world you cannot yet see.

How we built the other version

This is the problem I have spent years on. VCode is the answer we arrived at, and the design follows the four properties above rather than trying to make a QR code more secure, which cannot be done.

The symbol holds no readable payload. It is a reference, unique to one item, and on its own it means nothing at all. When a phone reads it, the platform resolves that reference against the record it points to and the rules attached to it, and returns a decision. Because the answer is composed at scan time, it can depend on where the scan happened, when, on what and who is holding the phone. The same mark can allow one scan and refuse the next.

The property I find people take longest to absorb is that identifiers are not allocated from a pre-existing pool. They are brought into being at the moment of issue. Codes are minted within namespaces, each carrying around 72 quadrillion possibilities, and namespaces are added as demand requires, so the space presently spans roughly 2.2 quintillion identifiers with no fixed ceiling. The consequence matters more than the arithmetic: a symbol produced outside the platform is not an unauthorised code, it is not a code at all. There is nothing for it to resolve to. A counterfeit does not fail a check, it fails to exist.

Revocation works the way it should. Any code can be withdrawn instantly, years after it was printed and shipped, and it stops working everywhere at once. Every scan is written to history, including the refusals, so a brand can see a code being read in a city where it never sold anything.

The physical envelope is wider than people expect, and this part is measured rather than theoretical. It reads at five millimetres on an ordinary smartphone and down to a hundred microns with assistance, at over a hundred metres, at angles up to about 170 degrees, and with roughly 30 per cent of the mark damaged. The angle and the damage tolerance are the two that change real deployments, because in the field labels are scuffed, curved, wet and read by someone leaning over a pallet rather than lining up a shot.

When to use which

I am not arguing that QR should disappear, and I would be suspicious of anyone who did. For a restaurant menu, a wifi network, a link on a poster, it is the correct tool: free, instant, universally understood, and the failure case is that someone reaches a slightly annoying web page.

The line is consequence. Use a QR code where the worst outcome of a forged one is inconvenience. Use something that resolves, and that can be revoked, wherever the answer decides whether money moves, whether a person is admitted, whether goods are genuine, or whether a document is still valid.

Most organisations have that line in the wrong place, usually because the QR code was free and the decision was made by whoever was closest to the printer. It is worth ten minutes to work out which of your codes are labels and which of them are, in practice, credentials. The second group is almost always larger than anyone expects.