QR-code-based access can be exploited for device linking and covert surveillance

Summary

QR codes are now the default mechanism for linking devices and granting access to shared content, but they are vulnerable: an attacker can send a QR code that, when scanned, links a device to an account without any physical access to the victim's hardware. German customs has operationalized exactly this as a permanent surveillance strategy across messaging apps. For any product that relies on a single QR code to collect or distribute guest content at an event, this is a trust landmine: users increasingly worry that a simple scan can be hijacked, leaked, or turned into a surveillance vector. There is no clean, user-friendly defense that lets people confidently use QR-based sharing at private events while staying protected, leaving a serious unresolved security gap for QR-driven photo and video collection.