4 ms·

Absolutely terrible for privacy to use a client-server architecture for this. Why can't this be purely client-validated like passport chips?

• xiphias2 5y ago
  ,,COVID Certificate is the official app for storing and presenting COVID certificates issued in Switzerland. The certificates are kept and checked locally on the user's phone.'' It seems like the server is needed for getting / revoking certificates, not for the verification.
• tonfa 5y ago
  > Why can't this be purely client-validated like passport chips? From the diagram this looks similar. The client-server is to fetch the certs and revocations, and handle the signing infrastructure.
• traspler 5y ago
  It‘s as distributed & offline as can be. You could easily print the QR code out and the validator can be offline; the validation still works fine. The validator should have to connect to the network periodically to check for revocations, otherwise everything can be done offline. Issuance, Revocations & cross country validation requires some kind of backbone but even issuers don‘t have to be centralized if you want. The only thing you need is to get an issuer cert from that central trust authority and you can start issuing passes that are valid. Currently it still requires a government ID in addition to the pass so it‘s even more „offline“. The specs have room to enable eID solutions though but that will probably be online only as the verifiers will need to be specific for every provider.
  • KptMarchewa 5y ago
    Why do you need revocations of vaccine status? Can you become unvaxed?