qr_plus

Description:

qr plus

qr_plus #





An advanced all-in-one QR code package that provides multiple layers of security. This package acts as a wrapper around some of the most popular QR-code related packages. It uses qr_flutter for rendering the QR-codes and mobile_scanner for reading the QR-codes.

An example QR code rendered with QrPlusMode.paranoid
Platform support #
Reader #



Android
iOS
macOS
Web
Linux
Windows




✔
✔
✔
✔
❌
❌



Renderer #



Android
iOS
macOS
Web
Linux
Windows




✔
✔
✔
✔
✔
✔



Motivation #
In today's world, QR codes are used for a wide range of purposes, from making payments to accessing secure information. However, the ease of use and convenience offered by QR codes also makes them vulnerable to malicious attacks. To address these security concerns, QR Plus provides multiple layers of security, each fixing a single security vulnerability from the previous layer, to ensure that your data is safe and sound.
For example, consider a scenario where you're organizing a scavenger hunt event and you want to ensure that each team's progress is recorded accurately and fairly. The teams will scan QR codes at various locations to receive points. To prevent cheating, you need a solution that ensures that each team only gets points for the location they have actually visited. This, and plenty of other similar use-cases, is why we created qr_plus; To make QR-codes safe without having to write a ton of own custom logic!
Get started (recommended settings) #
IMPORTANT: You need to have the same security mode on BOTH the reader and renderer, otherwise the reader won't accept the data.
1. Configure platform #
Since this package is a wrapper around mobile_scanner, please follow the steps for platform specific configuration from their documentation.
2. Add renderer #
QrPlusRenderer(
data: 'https://youtu.be/dQw4w9WgXcQ',
mode: const QrPlusMode.snowden(
encryptionKey: '<your-encryption-key>', // Your encryption key from .env. See https://pub.dev/packages/flutter_dotenv
),
),
copied to clipboard
3. Add reader #
QrPlusReader(
mode: const QrPlusMode.snowden(
encryptionKey: '<your-encryption-key>', // Your encryption key from .env. See https://pub.dev/packages/flutter_dotenv
),
onData: (data, authenticity) {
/// Handle the data
},
),
copied to clipboard
4. You're all set #
Enjoy your new safe QR-codes.
Multiple layers of security #
QR Plus offers multiple layers of security, each fixing a single security vulnerability from the previous layer. As you climb up the layers, the QR-codes become more and more secure. Here are the security layers within this package, from least to most secure:
1. QrPlusMode.plain #
This layer does not contain any security whatsoever.
2. QrPlusMode.safe #
Problem
A malicious user could screenshot the QR-code. In the scenario described in the Motivation section, a user could show a screenshot of a QR-code to a referee, which would give points to another user instead of the one who shows the QR-code.
Solution
This layer splits the data into multiple pieces and displays a single piece at a time.
3. QrPlusMode.robust #
Problem
A malicious user could screen record the changing QR-codes and share them with friends.
Solution
This layer adds a time-to-live (TTL) to the transmitted data. The QR-code is only valid for a given period of time. If the TTL has expired, the reader will be notified of that. Its up to the developer / user to decide what to do with that information.
4. QrPlusMode.sound #
Problem
A malicious user could modify the phone's time zone in the settings to display a QR-code that is valid in the future.
Solution
This layer adds time synchronization from a remote NTP server. The user can change the time settings locally, but it won't affect the QR-code.
5. QrPlusMode.paranoid #
Problem
A malicious user could share their screen in a FaceTime call or turn off network connections to trick TTL and NTP.
Solution
This layer adds possible cheating attempt detection. The renderer knows when the device is currently sharing its screen or recording it, or when the user has turned off their network connection. The renderer (malicious user's phone) displays the QR-code normally, but information about this suspicious activity is sent to the reader through the QR-code. It is then up to the reader to decide what to do with this information.
6. QrPlusMode.snowden #
Problem
A malicious user could read the data with another QR-code reader, manipulate the JSON to be valid, and create new QR-codes with the valid data.
Soliution
This layer encrypts the data before sending it. With the encryption key properly stored, only the reader provided by this package can decrypt it.