QR-Code-generator VS shc-extractor

The funny thing is that no-one AFAICT has realized that the same content can be encoded in different-looking QR codes. Beside the obvious (different error-correction levels), the content itself can be changed while maintaining its semantic meaning (e.g. "https://example.com/foo", "HTTPS://EXAMPLE.COM/foo", or "HtTpS://eXaMpLe.CoM/foo" are all semantically identical) and even the QR encoding itself can be tweaked (e.g. by changing the version and mask, see the demo on https://www.nayuki.io/page/qr-code-generator-library). Each combination would yield a different-looking QR code that would encode the same meaning, and it could therefore allow the diffusion models even greater freedom.

I'm sure somebody will get to this soon.

Make a hidden Veracrypt vault on cold computer. Inside the Veracrypt vault save Keepassxc vaults. Store your seeds inside the Keepassxc vaults. For a paper backup, encrypt your seeds using an offline AES256/512 text encryptor/decryptor. Encode the encrypted text using an offline qrcode generator. Print out the qrcode. Test recovery using a dummy wallet. Be sure you can scan and decrypt. Bonus: Laser etch the qrcodes on metal plates. Make a multi-factor recovery vault, in case you forget your passwords. Shimar's secret sharing scheme is a useful tool for making your recovery vault. Never store your seed unencrypted anywhere, ever. Never input your seed on an online computer, ever. Always protect your seeds with something you know (password), something you have (vaults and keyfiles). Do not upload your vault to the cloud. Keep backups in multiple locations. Necessary tools: Cold computer: Any old computer will do. Just physically disable network access. Veracrypt: https://www.veracrypt.fr/code/VeraCrypt/ KeepassXC: https://keepassxc.org/ Cross-platform, open-source text string encryptor. https://github.com/a3diti/aes256-offline/ Cross-platform, open source QR code generators: https://kazuhikoarase.github.io/qrcode-generator/js/demo/ https://github.com/amanuel/JS-HTML5-QRCode-Generator https://github.com/nayuki/QR-Code-generator Shamir's Secret Sharing: https://github.com/paritytech/banana\_split

Necessary tools: Cold computer: Any old computer will do. Just disable network access. Veracrypt: https://www.veracrypt.fr/code/VeraCrypt/ KeepassXC: https://keepassxc.org/ Cross-platform, open-source text string encryptor. https://github.com/a3diti/aes256-offline/ Cross-platform, open source QR code generators: https://kazuhikoarase.github.io/qrcode-generator/js/demo/ https://github.com/amanuel/JS-HTML5-QRCode-Generator https://github.com/nayuki/QR-Code-generator Cross-platform, open-source text string encryptor. https://github.com/a3diti/aes256-offline/ Shamir's Secret Sharing: https://github.com/paritytech/banana\_split

I probably know this only because back in time I wrote a QR code generator in JavaScript [1] which was also one of such libraries reviewed by Nayuki [2], and as I haven't actually implemented a decoder my knowledge stops there. Sorry :-)

[1] https://github.com/lifthrasiir/qr.js

[2] https://www.nayuki.io/page/qr-code-generator-library

I guess it helps to understand how to generate a QR code: https://www.nayuki.io/page/qr-code-generator-library (see also the references at the end)

Good luck. ;-)

i think i found what i was looking for

Hahaha. That’s blatantly false. There are many open source GitHub repos for projects that allow you to scan the QR codes and there’s nothing of the sort in them. Here is one of many. Try it yourself. https://github.com/obrassard/shc-extractor

The app is fairly irrelevant - all they get is info that’s in the QR code - and that’s not secret, you can extract that info yourself: shc-extractor (You can’t use this to verify that a QR code isn’t just made up by a random individual, that’s what you need the official app for.)

The Ontario scanner app checks the signature to verify its authenticity, and shows a big yellow "warning" symbol and a "There is a problem" message. You can see what this looks like if you try scanning the QR code here.

The article says that 12 people downloaded the wrong QR Code. That's it. It's possible to extract data from the QR Codes (which are just encoded SHC records) using this: https://github.com/obrassard/shc-extractor

There's even some pre-built software to help you do it.

You'll get the string shc:/ followed by a long sequence of numbers. The encoding is described here if you're curious. The code library used to extract the information is here if you want to read exactly what your QR code says.

It's not. It is encoded based on a specification that anyone can look at. You can scan the code to get the shc string. Then use this tool to extract the information from it.

See: https://github.com/obrassard/shc-extractor