Questions about safety practices surrounding crypto wallets

[YellowSwap]

Now that I am using two separate hardware wallets I want to know if there is any danger related to using a airgapped device to scan a qr code? Any?

Assuming I visit a local store in a country where Eth or other coins are acceptable as payment,  then instead of using a hot wallet I use a Trezor or a airgapped wallet to scan their QR code, is there any possible threat doing this?

I read somewhere that using your crypto wallet to scan qr code might not be safe, since it's possible to hide links or something bad in these Codes but since my crypto wallet isn't internet 🛜 ready will they be affected?

[OmegaStarScream]

AFAIK, A trezor does not have any built in camera, so the scanning will be using your phone through the Trezor suite app. I don't see how would anything be excuted though. The trezor suite would check if the address is valid or not, if it is --> ask you to confirm from the device screen. There should be no possibility of a "harmful code" being executed inside the device.

[Jewan420]

Since QR codes only carry data and the hardware wallet is offline, the links or malware present in the QR cannot work. Make sure that the data is correct. However, in the case of hot wallets, these problems can occur, phishing, malware, funds drain, etc. However, these do not occur in the case of hardware wallets that are offline. In this case, the main risk is that the address is wrong or the money goes to the wrong address, check the address carefully before completing the transaction.

[Stalker22]

~
I read somewhere that using your crypto wallet to scan qr code might not be safe, since it's possible to hide links or something bad in these Codes but since my crypto wallet isn't internet 🛜 ready will they be affected?

Using an air gapped device for scanning QR codes does provide a technical safeguard from being infected with malware.  This is because you wont be able to use your "mouse" to click on links or connect to servers through that air gapped device.

However, a QR code that has been created by a hacker may still succeed in tricking you into approving a transaction that will take money from your wallet and send it to a scammers account rather than the merchant.

When working with a wallet that requires you to authorize and confirm every transaction using a hardware device, be sure to carefully compare the amount and address displayed on your hardware device before approving each transaction.  If you do not take the time to verify that the destination address and the amount you are sending match what was displayed on the merchants website or document when you were looking at it, it does not matter if your wallet is air gapped or not; if you did not double-check these before approving your transaction, then you just authorized a theft!

[Z-tight]

I read somewhere that using your crypto wallet to scan qr code might not be safe, since it's possible to hide links or something bad in these Codes but since my crypto wallet isn't internet 🛜 ready will they be affected?

There are a certain risks, but they are easy to spot and avoid. Scammers can place a fake code over the real one, which would send the funds into a scammers address if you scan and send. But if you intend to spend your coins in a store around you, then i doubt this can happen and if it does, then it ought to be on the merchant. So just verifying the address is enough. And if you scan a qr code and it redirects you to a website or something, it is probably a potential scam.

Assuming I visit a local store in a country where Eth or other coins are acceptable as payment,  then instead of using a hot wallet I use a Trezor or a airgapped wallet to scan their QR code, is there any possible threat doing this?  

This would require a few steps. I.e. if you are spending from your airgapped wallet, you'd need to scan the qr code with your watch-only wallet and create the tx there, then move it to your airgapped wallet, then sign the tx. And then finally move it back into your internet connected watch-only wallet to broadcast the tx. These steps a lot of people would be unwilling to take just to spend a few $ in a local store. This is why i keep ~ $100 or less in a hot wallet and it is funds for spending on the go. It is easier and safer to do that way, than moving around with your cold storage wallet.

[Zaguru12]

I read somewhere that using your crypto wallet to scan qr code might not be safe, since it's possible to hide links or something bad in these Codes but since my crypto wallet isn't internet 🛜 ready will they be affected?

One thing about QR code is the malware is actually in the software used to create or read the QR code, so if the malware is actually in the QR code once you actually scan the code the device will get infected or might actually change the address destination depending on the type of malware on the code. Now to your question of maybe it actually affects your airgapped device I think with airgapped Wallet you would need to scan this address from your watch only wallet and that’s where the malware will affect if it’s a change of address it will change it but I don’t think this will affect an offline device, except if the malware installs on a device once the code is there on that device.

[satscraper]

Now that I am using two separate hardware wallets I want to know if there is any danger related to using a airgapped device to scan a qr code? Any?

Assuming I visit a local store in a country where Eth or other coins are acceptable as payment,  then instead of using a hot wallet I use a Trezor or a airgapped wallet to scan their QR code, is there any possible threat doing this?

I read somewhere that using your crypto wallet to scan qr code might not be safe, since it's possible to hide links or something bad in these Codes but since my crypto wallet isn't internet 🛜 ready will they be affected?

It depends on what you consider safe.

“Bad” QR code cannot compromise your hardware wallet, but it can potentially "freeze" it and throw the error like the one shown by SeedSigner:

The more trivial risk is that it can trick you with the wrong destination address, so you should always verify the details on your hardware wallet’s screen before signing anything.

[Wind_FURY]

OP, for the BEST OPSEC - never complicate it. Merely just use your hardware wallet for sending/receiving, and NEVER for connecting anywhere like what some Ethereum/Solana shitcoiners do. They connect their hardware wallets to a service then sign a message.

The signing of the message IS the exploiter's attack vector, BE VERY CAREFUL.

But for your issue, just use a hot wallet with a small amount for purchasing through QR. SIMPLE.

[dkbit98]

Now that I am using two separate hardware wallets I want to know if there is any danger related to using a airgapped device to scan a qr code? Any?

You didn't say what hardware wallets you are using, but there can always be some risks especially if you are using closed source devices.
Some hardware wallets like Safepal are pure crap, and they are also using closed source QR scanning code.
You can't scan anything with Trezor devices since they are not airgapped.