How Wechat / AliPay QR codes are protected from being tampered?

发布于 2022-09-07 11:37:41 字数 1379 浏览 30 评论 0

I'm curious how these QR payment systems have secured their QR codes.
What kinds of security mechanisms are there in place?

Decoding the QR gives a random string looking like some hash result that contains data for the payment to happen. what kind of encoding/encryption is done here?

Like this QR data contains name and phone number of a recipient.

+huM1AUuk+vG1GuWAKLn68VlUpekvkR3pr/TJV6rd1qDoW7Cu4Gs2Sh6xtC9B2Z+fSLqeN+GqUlQnr+zbTVhYEiwgaHseRMKNyrzcfI4rxRrPMWXSfTfSjJrlOEHVTajJfwLK1+d2xGq3LiIwzRDMykD
RmkcuYbsx6u25LaH3YM=

And this one contains just the recipient's name.

2810050501011MFF97FUSA49

(As scanned from Paytm's app)

Data required for payments to happen is not kept in plain text and there's a strong reason to do so, else any QR can be tampered and replaced to create a fake one impersonating the genuine recipient or, a malicious code can be put into the QR to steal personal data or a link to some malicious website.

There must be some digital signature to verify authenticity of QR and some sort of encryption to encrypt actual data from being tampered.

What exactly are the security protocols / Best practices used by these QR payment systems?

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。
列表为空,暂无数据
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文