Hacker News Reader

Some sort of MITM attack by someone who owns the display but not the server, maybe. Like a malicious ad company.

Ok, but then I'd still prefer a method that sends users to a unique URL. OP's method may help with obfuscating the changing of the code, but I'm sure there are ways to better achieve that without having to introduce this quasi-randomness. The simplest would probably be to just to regularly hide/show the code (which would happen anyway on a typical digital ad display that cycles through a number of ads).

But hypothetically, the owner of the ad might pop in and make sure

1. the ad looks correct, and

2. the URL is the one they expect

So there may be a use case for a QR code that looks almost identical but goes somewhere else, allowing them to swap it out while someone is looking at it without them realizing.

A niche use case, to be sure, but being able to exploit a niche vulnerability is a skill.

But if you own the display, you can send the user to whatever server you want.

Reply on news.ycombinator.com