Bar & QR Codes

[wasbit]

A neighbour asked me today what information bar codes & QR codes contain & who controls the information. Apparently a parcel he received had both on the outside & he wondered if anyone with a mobile phone could scan the codes to find out what was inside.

--
Regards
wasbit

Rig 1: Optiplex 3050 SFF
Rig 2: Asus ROG G20CB (rebuilt wreck)
Rig 3: HP Elitebook 8440P

Dear Starfleet, hate you, hate the Federation, taking Voyager. - Janeway

[The Duke]

I doubt it, as that code would be a one time generated code

Most items like beans, or bud etc have a industry standardised code. Them codes are in public databases that shops and apps can use to look up items

The one time generated code, would be private between you and the buyer, so will be private to the outside world of baroda tables.

Tho these are just my thoughts on how this should work.

 

As to the driver knowing what you have in your box, I know some companies (yodel) the drivers have a list of what is in each box.

So if you have a popular* high price item to buy for Xmas, a Switch, ps4 pro, Xbox one x, iPhone or Samsung phone, etc.. And the busimess use yodel, GBpost, city post, or some of the lesser liked carriers, don’t order it. As you will likely not get it

Luckily I knew my yodel delivery fellow, and he knew I Kew of his light figures,and his coke debt. So he would drop off a pile of goodies at his dealers house, get a tenth of the stuffs worth every week.

I don’t know how he got away with it. He never got sacked for sealing. But laid off cos he was sent down for dealing drugs.

When I asked him how he knew what he had on board, he shown me the way klip board. Real modern, a print out of address, contact details, bar code sticker iirc, and contents

I think it’s ment to put them off sealing, by showing them that the company know exactly what each worker has. But as they have so much “losses” they couldn’t keep up I’m figuring out who lost what.

Once the poorly paid staff figured this out, it made all but the angels, fill their boots.

The only company I don’t check who is delivering is amazon, as if there is an issue, they will have a replacement out In 12h or a refund while your on the phone.

Last year amazon, iny area, started to phase out DPD (?), however of late DPD has been delivering again AND it may of taken 12 months but amazon logistics is now good, and there in built follow your driver feature from with in the amazon app is great.

Similar to the DPD follow my driver feature, but it’s withing the amazon app. To Dail down on where your DPD package is you would then have launch the DPD app.

So I’m happier 12 month on with amazon logs.

[Dave Rice]

Like any other label, they can contain any information the producer pleases.

[Ed P]

QR codes are much more dangerous as the act of scanning one can in the worst case send your phone off to a malicious web address. You should really only scan QR codes from trusted sources. See article

While Dave is of course correct with respect to bar codes, they are an important part of many inventory control systems (for example goods in/out of a warehouse or stock control). To that end most companies adhere to a global standard such as EAN  or UPC. It is too many moons ago since I last was involved in warehouse automation but I know my old company used a standard code which was probably UPC.

[The Duke]

I think the question was could anyone scan them and read the info. The simple answer is no. As the info say argos put on there delivery qr/bar code, can noly be read by a machine /app that has access to the argos barcode database

Now anyone could scan a tin of beans and the info would be readable buy any phone. But not your parcel. The delivery driver probably has access to the private database and

[Ed P]

The answer is of course yes you can if the barcoder has conformed with the international standards.  There are however a couple of prerequisites – first a bar code parser, to get out the GTIN and second you need access to a database of manufacturer numbers.

As Richard was professionally involved in procurement (resisting temptation to call him a professional procurer)?, he can fill in the gaps much better than me. Suffice to say that there is nothing ‘secret’ in standard barcodes as they are now an essential part of nearly any company’s purchasing , goods received/order entry, stock control and general ledger systems.

However, what you may find are two bar codes on an object, a big ‘standard’ one and a much smaller company info barcode the latter is company specific and as you say Steve not normally capable of being read.

A QR code is of course different again and can have masses of info as well as the down-loadable stuff. This could in theory contain encrypted/encoded info.

[Dave Rice]

Yes, there’s a difference between reading and understanding.

I doubt Yodels label says PS4 inside in plain text.

[Ed P]

I’d guess that Yodel labels are similar to SKUs which only have to conform to Yodel’s internal standards.

[wasbit]

What protection is there for the customer? I can’t find any regulations that govern either types of code.

--
Regards
wasbit

Rig 1: Optiplex 3050 SFF
Rig 2: Asus ROG G20CB (rebuilt wreck)
Rig 3: HP Elitebook 8440P

Dear Starfleet, hate you, hate the Federation, taking Voyager. - Janeway

[Dave Rice]

Why would there be a need for “protection”?

I’m not aware of any regulations with regards plain text labels on packets.

[Ed P]

Sorry, I cannot see what point you are trying to make. If you order stuff from Chibay it will come with a standard custom’s sticker that should identify if the contents are valuable. Anything you are musing about would also have to cover that situation.

Barcodes/skus are currently only for vendor/distributor convenience though I guess eventually things like smart freezers will need to have some sort of standardised sticker identifying package contents, freezer life etc. No doubt the EU will produce the necessary regs to which we will have to adhere without any post-Brexit say in the matter.?

[Richard]

I am struggling to follow what is the concern here. I will leave aside the QR code issue as I believe that Ed has exposed the can of worms that can hide within that one, so use at your peril.

Within a huge organisation bar codes are usually used for goods tracking and as such most items will have a specific code that says what they are, it is up to stock control to count the number. Standards exist to prevent a can of bean and a left handed widget getting the same code and similar problems arising. I guess the FCC code allocation system or the Ethernet port numbering were much smaller scale forerunners for this sort of management system. So far as I know, private networking type arrangements can exist allowing a business to have its own barcode labels used internally for whatever it needs.

The large logistics companies will automatically sort on bar codes storing stuff away and fetching and packing things to order, e.g. Amazon. Many places will try to avoid over boxing for shipping so warn that the contents are visible when they are ordered. A simple tracking label is added, this will usually allow the item to be added to the navigation guide (route map) and be scheduled on the driver’s hand held, wide variations in such measures do exist, shipping labels can be proprietary if necessary and, I guess, probably are. Some systems constantly track the driver’s location, others (non-systems?) do not have a clue. Saying exactly what is scheduled in each delivery appears to be a useless piece of information, the driver needs to know the address and the order number, the order number can confirm the supposed drop contents for example where  larger box contains many widgets. Arguably your post code is a barcode forerunner and is likely coded into the item along with other necessary details, e.g. name. When you or someone else takes delivery, the driver’s hand held reads the bar code, brings up the items basic shipping details, a signature is collected the goods are handed over and, shortly after a delivery confirmation mail or text can be produced. Bar code allow such levels of automation though it is also creeping into retail, flash your QR card in Screwfix when buying widgets and others, get an email receipt moments later. In that case the driver certainly knows what as being delivered, since the driver is you (or me).

Ed, I was not in distribution or procurement though I did spend time negotiating orders for big boxes of bits that the supplier bolted together and we approved through the fun business of acceptance testing – aka, we try to break it they try to show it does not fall over – we often won in the early stages. One supplier refused to accept our test requirements we declined their proposals.

[wasbit]

After chatting a bit more it seems his point is that the information is hidden from him therefore he doesn’t know what it might contain.

One point he made was that the QR codes were encryption in plain sight – very helpful for terrorists.

I don’t know enough about the subject to refute it & couldn’t find much information other than that which has already been said & he was getting quite worked up about it so I’m now trying to avoid him.

--
Regards
wasbit

Rig 1: Optiplex 3050 SFF
Rig 2: Asus ROG G20CB (rebuilt wreck)
Rig 3: HP Elitebook 8440P

Dear Starfleet, hate you, hate the Federation, taking Voyager. - Janeway

[Dave Rice]

If it’s his parcel he can open it and find out ?

Terrorists communicating via QR codes, hmm not heard of that one being on GCHQ’s radar.

[Ed P]

He was correct with respect to QR codes in as much that they potentially link to multiple sites as well as potentially containing space for a fair amount of encrypted text or code words//numbers. QR codes do however have to conform to some minimal standards in order to make them readable.How-to’s for this are freely available.

If however you see a rectangular code block then it is probably IQR.

While the potential is there for harm, such codes are unlikely to used for the antisocial purposes that your friend moots as such codes suffer from the two drawbacks of being both static and visible. In that use they are as good as but not much better than the old thieves/didicoy secret chalk marks.

Any techie who has read spy stories can think of dozens of ways to pass on information that are far less visible, contain even more data and can be easily updated.   I can think of half a dozen examples of different ways of passing huge quantities of secret hidden info, that are potentially a lot more secure and capable of far reaching coverage. If the Government were not so fixated on spying on the general public maybe the security services would have more resources to pursue humint and focus on these aspects . (It hasn’t gone unnoticed by me that nearly every real terrorist was known to the authorities but they did not have the resources to follow up their lines of inquiry.)

Tell your friend not to worry about terrorist bar codes and instead read some old Cold War spy novels by Len Deighton et al. then apply his imagination to this.

[Bob Williams]

At the moment it is not barcodes on parcels that are troubling me, but the handling of barcoded parcels. Yesterday I received my youngest gdaughter’s Chrimbo pressie, a Wileyfox Swift 2 Plus, in a parcel also containing earbuds for the phone. My missus took the parcel, handed to her by a Christmas Relief Postie, never seen before. Unusual part about the delivery was that he came twice in 10 minutes: once with 2 cards and a letter, which I took. The again with another card and the parcel. SWMBO took it in, turned it over and saw the damage. Postie was gone, red van disappearing down the road at a rate of knots. I phoned the Sorting Office and was told to photograph the damage and open it for internal damage or missing contents. Before doing that, I checked the contents through the torn cardboard: it really looked as if some attempt had been made to get inside, but of course I cannot state that in any formal complaint. There was a small cardboard box containing the earbuds, I could see that an attempt had been made to open that: a corner lifted. The phone and battery were side by side in a sealed box and I could see the seal was unbroken. I opened the parcel and there were no contents missing and no internal damage, except for the earbud box. I will transmit this to Amazon.

Note that “Lithium Ion battery” is visible. Is that attractive to certain light fingered people, or what?

The area of original damage was to the right of the pic: the rest is where I opened it. Erabud box:

That’s what I could see through the damage hole, package unopened. Seal for phone and battery box was also visible – the blue seal to the left of the earbud box. I sincerely hope that this temp. Postie returns at some point….

To cap a great weekend, the large hotplate at lower right under the upper pic, lost its knob last night and cannot be switched off. We managed to cook and eat a delicious fillet steak though. A visit to EAG Grimsby tomorrow for a new knob and switch. STOP SNIGGERING AT THE BACK! ?

When the Thought Police arrive at your door, think -
I'm out.

[Richard]

We did have one like that a while ago, but the usual postmen refused to hand it over. He asked me to complain about the damage and refuse delivery, which I did. The postman must have used his hand held gismo to report the tracking results there and then. I went straight on the phone to Amazon who said something like, ‘Yes we can see that the delivery has been refused due to serious damage.’ OK the replacement will be on its way shortly. True enough the mail pinged with the new order and it was on its way shortly after. It arrived the next day.

We believed that the damage had happened in the sorting office machine, your damage was mild, mine was shredded along one side, front and back so no way to hide the problem.

[The Duke]

That’s why I love amazon. Simply no messing. I bought a nail gun a few years ago, it didn’t turn up, I contacted amazon via their app phone back service, and the sent a replacement out, arrived the next day.

About a month later the original turned up, I contacted amazon, and they said just keep it. So that coverdale my prime cost, and got my BiL Xmas present covered.

Ive never had a bad experience with amazon customer services, and for that reason alone prime is worth its price.

On a similar note Halifax building society, had never let me down either, on about 4 or 5 occasions, I’ve had iffy activity on my account, one was a cloned card that took the max out for a few days, the others was for online transactions, usually concert tickets, and on each ovation, within 10 mins, they have transferred the cash back.

The stage thing (each time), they said well have to send out an form for you to sign for fraud purposes. I’ve never once received the document to sign and return.

[Dave Rice]

Having spent a lot of time in RM and Parcelforce Mail Centres I can testify to the damage that the machinery can do, but it’s usually to badly packaged items (some of the things I’ve seen you wouldn’t believe). But sheer volume this time of year doesn’t help.

Bob, use your noodle. If the postie was going to pinch the contents you wouldn’t get a box that looked like it’d been investigated. You wouldn’t get anything. He probably sped off because the time pressure this time of year is unbelievable. If you ever get a chance to visit your local Mail Centre do it. You’ll not see it at it’s busy times but you will get an idea of the scale of the operation.

If I’m sending anything of value I always pay the extra for the appropriate insurance and get proof of postage.

“Signed For” only gets you a signature at the end, in transit it’s dealt with like any other packet. I almost never bother with it.

If you want proper tracked handling then you need Special Delivery Guaranteed, what used to be known as Registered Post but with guaranteed next day delivery.  Everyone that touches it “signs” for it – in my day on the counter it was paper and quill pen ? My ink pad and thump it down date stamp was my signature (they were traceable to a person) and special bags were wired shut and delivered to special secure areas of the sorting office.

That’s why it costs so much more, human being interaction isn’t cheap. Throw it into a sack which is then emptied into a machine is a lot cheaper as no skill is involved.

BTW you can write “Fragile” on a packet all you like, in the middle of a sack no-one can read it. If it’s fragile, package it appropriately. If you shake it and it moves, try again. I keep some (collapsed) Amazon boxes & packing hanging about, especially the ones laptops and HDDs come in.

What I’ve said about the Post Office / Royal Mail / Parcelforce system applies equally to all the third parties. You get what you pay for.

Who do I use? For sub “parcel” size packets I use Royal Mail 1st Class with appropriate insurance. For parcels I use Parcel2Go to see what’s about and I don’t just look at the cheapest as often not much more can buy a better service (it’s the add-ons folks).

Looking at my order history, for parcels containing run of the mill stuff it’s almost always My Hermes 2-5 days with me taking it to the local Co-op store. In my experience it’s always been 2 days.

For anything of value it’s usually ParcelForce next day pre 12 with them collecting from me. In my experience they’ve never let me down.

[Bob Williams]

Dave: ” Bob, use your noodle. If the postie was going to pinch the contents you wouldn’t get a box that looked like it’d been investigated. You wouldn’t get anything. He probably sped off because the time pressure this time of year is unbelievable. If you ever get a chance to visit your local Mail Centre do it. You’ll not see it at it’s busy times but you will get an idea of the scale of the operation. ”

Yes, I get that Dave, I was never going to have a go at calling any RM staff thieves 1) it’s unprovable 2) waste of time 3) where would I start? . What I believed was a ‘Temp’ was on again today and I met him at the door, showed him the package and he immediately began excusing himself. I stopped him and quietly said that I was not going to criticise or complain to RM or Amazon, knew the damage was not down to him. However, why did he not show the damaged side to my wife, so that we could either refuse the parcel and return it, or accept it as our risk? He was apologetic and said that he had only just started this round after moving from Grimsby (which he hated, don’t blame him) to Louth Villages, which he always wanted. I asked if he was almost done with the round, as I know they finish with our village. Then I offered him a cuppa if he had time to call. Which he did, and SWMBO stuffed him with her cakes.

Now we have a friendly postie! The last one we had retired in the early spring and he knew us all, so I took time to tell him about all the people and addresses I knew in the village. Moving from Grimsby back streets to country village rounds, must be a culture shock. I bet he offers to return any damaged parcels in future, which would be a result.

Richard, what you describe is exactly what happened a few weeks ago here, with another bigger and more badly-damaged parcel. The previous Postie just showed me the parcel on that occasion and asked if I wanted to accept or return it. I took the Return option and Amazon sent another item. I also returned Plusnet’s ‘Hub’ a few weeks back, as I intended to use my own router. No quibble: Postie just asked for an electronic sig and returned it.

When the Thought Police arrive at your door, think -
I'm out.

[Author]

Posts