I've been noodling on https://qr-send.com which is a slightly more polished version of the "erasure fountain codes + stream of QRs"-idea, inspired by divan's Txqr posts but using Wirehair FEC for the fountain code (basically: you receive ~file size bytes via QR codes and it magically assembles them into the source file regardless of missed codes).
It's an offline-first progressive web app and there are native & wasm builds for the sender. The browser-to-browser transfer falls up to WebRTC when possible because 30 MB/s over wifi beats a 100 kB/s QR stream. The QR scanner is a heavily-optimized WASM build of zbar, scanning at 60 fps on mobile & multiple QRs per frame (but it's finicky! Work in progress.)
The WebRTC "fallback" basically means the QR code is just a handshake when both devices are on the same network?
I'm cooking something faster but depends on the job situation and funding whether I have time to spend on it.
Napkin math: QR codes encode 0.75 bits per module, each module needs about 3 pixels of camera resolution, and the temporal resolution is quite dodgy as well, maybe 0.25 * min(cameraHz, screenHz). So if everything is perfect, 44 kB/s at 60Hz per a 500x500 pixel patch. I've seen ~250 kB/s when a 1920x1080@60 transfer is working well. At 4k@30, you might reach 0.5 MB/s. If you throw in the 2x subsampled UV channels to transfer data as well, you might get an extra 50%.
I have a device with a camera and a touch-screen that only uses capacitive charging. I type a message. Bytes are encrypted. I hit send. QR codes flash on my screen. I use my PC or my normal phone to receive the encrypted bytes, and transmit them to you. You have the same device. You have your PC or phone flash encrypted QR codes. You use your device to receive, and then decrypt.
I've daydreamed about also buying several different hardware random noise generators. XOR all of their bits together. Save a huge one time pad to each of our devices. And then also use public key crypto on top of it.
I'm not really sure why I want this. But, it's my answer for how to reduce attack surface as much as possible, and have truly secret messages.
Congratulations. You just invented IrDA: https://en.wikipedia.org/wiki/IrDA
Having actually used IrDA on Sony, Nokia, and Ericsson devices, no it couldn't.
In the real world, two IrDA devices have to be very specifically aligned, and also brought within just a few inches of each other. There's no way data transfer would happen without your knowledge.
Knowing that, I doubt that someone with even moderate funding would have difficulty receiving a signal from any of the transmitters you mention.
But, in all honesty, if you put a physical cap on the transmitter and receiver, maybe I'm wrong.
But in the other hand, none of the devices I currently own have one of your transmitters, and they all have screens and cameras, so...
Thanks for the dialogue and for sharing your experiences.
Second part, Charlie Bennet said "the only entropy source is one you can trust" and the best entropy source is quantum fluctuations, so we built a fully open source phase diffusion QRNG at Quantum Village and released it. Link: https://github.com/QuantumVillage/EntropyLoop
Why do you need a separate device for this and not just an airgapped computer?
I want another device, which I imagine to be a Pi or Esp32 or something with a camera and a touchscreen display, and capacitive charging. After I program it and give it the public/private keypair and the OTP, I imagine physically breaking off a USB port, or sealing one with some hardening resin.
I don't want an entire airgapped computer. Maybe you do, that's fine. For me, I'd love it to be a credit-card sized doodad.
Like a modem
Amazon had modems very much like this in its little buttons that you could stick to your refrigerator and automatically order different items. When setting up the device, you could only hear the little clicks as it turned on and off.
I loved the technology. Hated that the prices changed all the time and you never knew what price you were going to pay ahead of time.
Really goes to show that it's very difficult to stop a motivated and informed actor.
Downloading a tiny JS from a CDN, or accessing a GitHub page is mostly noise, especially if obfuscated well.
use a 1D code variant with very high FPS to work around the rolling shutter.
[1] https://divan.dev/posts/animatedqr/
[2] https://divan.dev/posts/fountaincodes/
Recently I rewrote it in Dart/Flutter and finally implemented RaptorQ codes (way more efficient than Luby used in original Txqr). Testing it internally now, prepareing Appstores/GooglePlay/Web deployment and new article.