3 ms·

Covid vaccination certificates hit by security glitch

4 points by patbucher3 5y ago

patbucher3 5y ago
Anyone have one? Is it an editable PDF form? or an PDF generation endpoint accepting any input?
- bananapear 5y ago
  Presumably even if it is a PDF, one could still edit the text with e.g. Acrobat?
  - patbucher3 5y ago
    You can "lock" pdfs from editing after which your options are limited. But breaking the lock is one possibility https://helpx.adobe.com/uk/acrobat/kb/edit-secured-pdf.html https://helpx.adobe.com/uk/acrobat/kb/edit-secured-pdf.html
fredley 5y ago
Serious question: How is this supposed to be used? Are you supposed to print it out? (Any 'security' pointless) Are you supposed to email it/upload it when booking tickets for travel? How is it being checked on the other end that it's real and not a mockup? (My guess: they're not) Cryptographic document signatures are supposed to solve exactly this issue, but I'll eat my hat if they're being used in any meaningful way - even post 'fix'. Edit: I'm half tempted to build a quick site to generate your own covid vaccine 'certificate' to print at home to highlight the issue...
- patbucher3 5y ago
  Yep print it out or show it on your phone. At least that's the theory. Bulgaria is the only place Ive seen so far who will accept them*. Back in the UK just south of the border NHS Englands certificates have a QR code which you can scan to verify the details on the certificate on an NHS website. Your fake certificates could easily take you to fake but official looking website. It's worth noting that there is the same issue with validating the authenticity of fit to fly PCR test results. There are literally thousands of test providers around the world all producing their own certificates. Given the expenses of the tests and the easiness to produce something vaguely official looking there is a big market for fake PCR results. But people have been caught and as it is fraud the penalties are quite heavy. https://www.gov.uk/foreign-travel-advice/bulgaria/entry-requirements https://www.gov.uk/foreign-travel-advice/bulgaria/entry-requ...

4 points by patbucher3 5y ago

patbucher3 5y ago

Anyone have one? Is it an editable PDF form? or an PDF generation endpoint accepting any input?

bananapear 5y ago
Presumably even if it is a PDF, one could still edit the text with e.g. Acrobat?
- patbucher3 5y ago
  You can "lock" pdfs from editing after which your options are limited. But breaking the lock is one possibility https://helpx.adobe.com/uk/acrobat/kb/edit-secured-pdf.html https://helpx.adobe.com/uk/acrobat/kb/edit-secured-pdf.html

fredley 5y ago

Serious question: How is this supposed to be used? Are you supposed to print it out? (Any 'security' pointless) Are you supposed to email it/upload it when booking tickets for travel? How is it being checked on the other end that it's real and not a mockup? (My guess: they're not) Cryptographic document signatures are supposed to solve exactly this issue, but I'll eat my hat if they're being used in any meaningful way - even post 'fix'. Edit: I'm half tempted to build a quick site to generate your own covid vaccine 'certificate' to print at home to highlight the issue...

patbucher3 5y ago
Yep print it out or show it on your phone. At least that's the theory. Bulgaria is the only place Ive seen so far who will accept them*. Back in the UK just south of the border NHS Englands certificates have a QR code which you can scan to verify the details on the certificate on an NHS website. Your fake certificates could easily take you to fake but official looking website. It's worth noting that there is the same issue with validating the authenticity of fit to fly PCR test results. There are literally thousands of test providers around the world all producing their own certificates. Given the expenses of the tests and the easiness to produce something vaguely official looking there is a big market for fake PCR results. But people have been caught and as it is fraud the penalties are quite heavy. https://www.gov.uk/foreign-travel-advice/bulgaria/entry-requirements https://www.gov.uk/foreign-travel-advice/bulgaria/entry-requ...