QR codes

[idavidmcdonald]

What

QR codes are a machine-readable code consisting of an array of black and white squares, typically used for storing URLs or other information for reading by the camera on a smartphone.

Whilst QR codes once generated look fairly standard and may not be too much up for debate, when and how to use them is.

Why

Government appears to be using QR codes more frequently. We are now seeing them used as part of track and trace to scan into a venue and the NHS include them in some of their letters to link users to content without having to enter the url manually.

On GOV.UK Notify, in the past few months we have seen a good handful of support requests in the past few months asking about support for QR codes.

At the moment it's not clear to me

• when you should use a QR code
• when you should NOT use a QR code
• are they accessible?
• whether users trust QR codes in terms of phishing
• if you are using a QR, how you should use it. For example, maybe you should always provide the link alongside the QR code for those users not using a phone or without a camera
• where/how you should you generate these (should you use a third party website for example)
• any other security considerations

Anything else

https://www.revk.uk/2020/09/how-not-to-qr-nhs-c19-app.html

[edwardhorsford]

I've investigated them a bit for a personal project - testing printing various sizes with various data densities and various error correction levels.

One finding I had was that you shouldn't necessarily go for high error correction. Going to the highest makes a much more complex code, which means at smaller sizes it's harder to scan. I basically found that M seemed a good tradeoff for some correction whilst keeping the codes 'simple' and quick to scan.

[mrmjprice]

I had a COVID test booked for myself and another family member by my aunt earlier in the month.

She forwarded me emails with QR codes for the tests but the QR codes were missing.

This is worth bearing in mind for people who use services on other people's behalf.

Takeaway: have a backup in case the QR code doesn't work.

[joelanman]

A significant issue with QR codes is the fact users have to know what to do - that they have to install an app (though it is built into recent ios and android) and scan the code. In general, a short, simple url or code is easier to use and doesn't require installing an app. A short URL or code is also easier to share with others.

[mrmjprice]

I wonder if it's useful to take a look at services which use QR codes and their user needs?

Examples

Government services

Passenger locator form

The user receives this in a PDF attached to an email (based on experience in October 2020 - no idea what happens next as it wasn't checked at the border)

NHS COVID-19 app venue check-in

A place, for example a café or restaurant, generates a QR code poster and displays it on their premises. A user uses the NHS COVID-19 app to check in to the venue and is marked as being at the venue until midnight or the next QR code scan.

NHS Test and Trace test centre check-in

The user receives this as an image in an email when a test slot has been booked. The person having a test shows this to test site staff, who scans it to confirm their identity. This is scanned again when handing over the completed test, along with the barcode of the swab.

Non-government services

Public transport tickets

Some public transport tickets are issued as QR codes through an app or to a phone's wallet.

The user scans the QR code with vehicle or station scanners, or produces the QR code to a member of staff who scans it with an app or operator hardware.

Apple Wallet

Several retailers use QR codes for loyalty cards, usually scanned at the till through self-service or by a member of staff.

Flight boarding passes often have QR codes.

Building visitor passes

Issued on visitor passes, used to sign users out by scanning the QR code with a visitor management app.

Publicity

Where a business or organisation wants a user to scan a QR code to take the user to their publicity website. This is instead of the user typing a website address.

Logging into WiFi

The user scans a QR code instead of finding the WiFi network and typing in the secure password.

Manufacturing

In rapid production lines to scan as products pass through each step.

[jessdenney]

HMRC Online Payment Service

Hello I am wondering if there has been much development on this since 2020? This does seem to be somewhat of a time capsule of the covid days, I'm sure by now there must be many ways QR codes are being used across gov. I know there are 2 in use by HMRC.

I am currently working on the Online Payments Service, we have a QR code as part of the open banking journey.

They scan the code on the screen and are taken to their mobile banking app and can approve the payment. This limits a lot of user input errors as they don't have to input any reference codes or amounts onto the banking app. They can also login via biometrics avoiding having to remember/find long pass phrases or card readers to login.

However...

We do have some limitations of the use of it so we only display it to users who are logged in so we know who they are.

Our user feedback is a bit of a mix so we always offer desktop journey as some still are unsure of QR codes security. Saying that half of the users who are shown the QR code choose to use it and the payments are consistently less likely to fail than when someone stays on desktop.