Replies: 1 comment 6 replies
-
|
@maxammann I changed the nginx config to rewrite the request so that the "card" parameter is discarded. It is not visible in my browser history now any more. Still not sure if this solves the problem or just "hides" it for me in the UI but still exposes the card data. Do you know that? |
Beta Was this translation helpful? Give feedback.
-
|
Hm, sad. We probably have to move away from the idea of using deep links completely then. Using a custom URL schema is also insecure as anyone can register a handler for that and so grab our data. |
Beta Was this translation helpful? Give feedback.
-
|
oh oke really? that sucks a lot. But again we have to think about convenience. I mean if we can check that no browser keeps a history of redirects than we can go with the first option. If any app can register deep links then also the first version with "https" and rewrites is "insecure". But I think if you have malicous apps on your phone then your are already fucked. |
Beta Was this translation helpful? Give feedback.
-
|
Not really, that is the advantage of the https-Links, because there Android/iOS checks if we as the domain owners allow a specific app to handle URLs that belong to our domain. I had to put two files in the .well-known folder of our web server containing e.g. the signing key signature. Another possibility would be to manipulate the QR-Code, so that "usual" readers ignore the card data and just see an URL but our reader can still extract the card data. No idea if something like that is possible. |
Beta Was this translation helpful? Give feedback.
-
|
I also though about that, but did not find anything quickly on google |
Beta Was this translation helpful? Give feedback.
-
|
Me neither. I also tried it using |
Beta Was this translation helpful? Give feedback.
-
Moved from discord. Summary:
Beta Was this translation helpful? Give feedback.
All reactions