32 ms·

What's Inside the EU Green Pass QR Code?

• sschueller 5y ago
  Here is the source code the Swiss version for anyone interested which in theory (I have not tested it) is EU compatible. Edit: I am able to scan the code in the OPs link with the Swiss App and I can import it however the certificate seems to be currently not accepted. https://github.com/admin-ch/CovidCertificate-App-Android https://github.com/admin-ch/CovidCertificate-App-Android
  • harikb 5y ago
    Thanks for the link! It is amazing to see a government app talk about reproducible builds and the importance of it!
    • denysvitali 5y ago
      To be fair, the app was developed by a private company with government money, AFAIK, but at least it's open source and good in quality :)
      • xcambar 5y ago
        A government that can balance what to do internally and can carefully choose their contractors, all the while pushing towards openness, is a dream come true.
        • sschueller 5y ago
          Sadly not the rule at the moment in Switzerland. Lots of mistakes have been made but there is a strong push towards this kind of work. E-Voting and E-Id was a disaster and we hope it gets pushed into this kind of openness and focus on privacy for all future government software.
          • jeffrallen 5y ago
            Some reality from someone who is involved: E-voting was a poorly implemented transparency process to check a not totally terrible (and also, not correct) implementation of a pretty good design. Lessons were learned on the transparency side, and they are on HackerOne now, doing things approximately right. Security is hard and they will probably fail again, but they are failing according to industry standards now, at least. (I was a reviewer of the original system.) e-ID was rejected by the voters as a gift of a service that should have been in government control to private industry for them to make profit on it. There was nothing technically terrible about the design for outsourcing eIDs to private industry, it was just a concept the voters found unacceptable. (I voted no along with a majority of my fellow citizens.)
            • CaptainZapp 5y ago
              It didn't really help that one of the prime candidate company to issue the eId couldn't get even basics, like cert management, straight. I'm quite thankful for Die Republik (slightly leftist daily internet "paper", which is ad free and subscription only) because I think they were quite instrumental in uncovering some of the shenanigans being pulled by those companies.
          • atoav 5y ago
            One thing about e-voting that is often missing in the discussion. No matter how you do it, the most important goal of any voting system is surprisingly not to get a result — the most important goal is to get a result everybody can agree on. This is the fundamental flaw of any e-voting system. Even if you manage to get it secure, how do you transparently proof this to everyone, including those who can't grok cryptography. What about those who don't care and just want to call the election stolen? It is hard enough to convince them with paper ballots, but these are at least physical and they cannot come out of nowhere.
            • dolmen 5y ago
              > Even if you manage to get it secure, how do you transparently proof this to everyone, including those who can't grok cryptography. Even those who can grok cryptography can't check that the implementation matches the specification. No human being can review the complete software running on a computer. Even less a distributed system. But most human beings can understand the paper ballot system.
        • vbezhenar 5y ago
          In my experience government either choses cheapest contractor (will all sort of consequences you can imagine) or bribes are involved (which might lead to a better outcome, surprisingly, but at much higher expenses). I wonder how Switzerland manages to avoid that plague.
          • throwaway8451 5y ago
            I think that I once heard that in Switzerland the second cheapest bidder is the one to get the contract, exactly to discourage someone aggressively underbidding all others. I could not verify that now though.
            • blocked_again 5y ago
              What is the right solution here from a game theory perspective?
              • bhaak 5y ago
                Own two companies that agressively underbid all others?
                • xcambar 5y ago
                  That is deceptively simple. It might just work :D
              • z77dj3kl 5y ago
                Auction design is a very active research area and what the "right solution" is, is not so easy to figure out. This has huge applications in... adtech.
        • deleted 5y ago
          [deleted]
    • wdroz 5y ago
      This was developed by Ubique[1] and they aren't at their first app. [1] -- https://www.ubique.ch/ https://www.ubique.ch/
  • AmericanChopper 5y ago
    Do the verification apps do an online validation? If yes then where is there any PII in there at all, and if no then why isn’t it signed?…
    • ewidar 5y ago
      > and if no then why isn’t it signed? It is indeed signed, according to the blog post and to the spec linked in the blog post https://github.com/ehn-dcc-development/hcert-spec/blob/main/README.md https://github.com/ehn-dcc-development/hcert-spec/blob/main/...
      • AmericanChopper 5y ago
        Oh, it’s a COSE message. It all makes sense now.
      • unknown_error 5y ago
        How does the scanner app verify the signature? Does it always have to be online, or does it have a set of trusted public keys included? How are the codes generated to begin with? Is there some central database that hands them out, or can any clinic generate one (having access to a copy of the private key?)
        • pfg 5y ago
          The verification app needs to maintain a set of trusted certificates. More details on the trust model can be found here: https://github.com/ehn-dcc-development/hcert-trust/blob/main/hcert_trust_exchange.md https://github.com/ehn-dcc-development/hcert-trust/blob/main... Infrastructure for code generation and signing is probably country-specific, though I imagine most countries will establish centralized systems dealing with this and integrate with other systems that track vaccination or test records on various levels (some countries delegate vaccination efforts to their states, others handle it nationally, etc.)
          • unknown_error 5y ago
• uniqueuid 5y ago
  Really interesting. I like the choice of leaving the final judgment about immunity outside the code - i.e. to have the client verify that the doses are sufficient and happened in a suitable time window. That will make things easier when the desired immunity definition changes (i.e. require three vaccinations), and also allows medical staff to make their own judgments.
  • denysvitali 5y ago
    > i.e. require three vaccinations Well, I guess that will invalidate the covid certificate. There seems to be the "number of doses" and "doses received". It will be interesting to see how this will actually be changed if we need more than 2 vaccines to be considered immune. Will they have to re-issue a certificate and invalidate the previous one? Will they let the old certificates expire and issue a new one with the updated total count?
    • tomp 5y ago
      I’m guessing there’s a timestamp of the vaccination… many EU countries are currently saying that vaccination is only valid for 6 months (though I expect this to be a pessimistic estimate, likely to increase soon)
    • FriendlyNormie 5y ago
      You are literally the “govern me harder daddy” NPC meme. Eat shit and die you worthless little faggot.
    • pmontra 5y ago
      No need to invalidate the old certificate. If the new requirement is 3 jabs and the certificate reads 2, the certificate is useless. The person carrying it will ask for a new one reporting all the 3 jabs.
      • denysvitali 5y ago
        Yes but then the "total doses" field is useless :S
• fy20 5y ago
  I'm somewhat disappointed it contains personal data. I wonder how long until third party validation apps come out that exfiltrate this to the highest bidder. Yes of course GDPR should protect you from the business purposely doing it, but I'm more thinking of the app doing it without knowledge.
  • fabian2k 5y ago
    Without personal data you cannot verify that the code belongs to the person showing it.
    • krona 5y ago
      Unless the code contains biometrics (even just a photo) you're not 'verifying' anything without some other way to verify it.
      • sgtfrankieboy 5y ago
        They verify it against the persons ID card which has a photo of them by matching up the name.
      • fabian2k 5y ago
        The code contains your name and date of birth. The photo is on your ID card/passport you show along with the QR code. So the person checking you can verify that the names and date of birth match, and that the photo in your ID could reasonably be you.
      • jeroenhd 5y ago
        The PII is in there so you can verify against some kind of ID. The QR is not intended to be valid without also checking the accompanying ID. They could've gone the lazy route and stored your SSN (or similar).
  • zaarn 5y ago
    The German and Swiss/Austrian apps are all open source (and I think all three also have reproducible builds, you can verify what you installed, I know this is true of the official German apps involved). If you use a non-gov third party app that's on you I guess, not much from stopping you doing that since the QR code can be handled by any app. Otherwise, some personal data will be required, since the person checking your code (like a bouncer) must be able to verify that against your ID card.
• billpg 5y ago
  Given the structure seems simple, what would prevent someone making their own QR with fake data and a randomly selected ID number? If the answer is that a service can validate the data, then why not just have the ID value if its all going to be on a server?
  • DangerousPie 5y ago
    It's signed.
    • deleted 5y ago
      [deleted]
  • nousermane 5y ago
    Digital signature would prevent that (assuming scanner does a good job at verifying one). "Looking at the hexdump" section of TFA, last 64 bytes (cyan-coloured). On top of that, online verification (e.g. by certificate ID) might be possible, too.
    • thierryzoller 5y ago
      Yeah, didn't fine the hash in that JSON
  • asutekku 5y ago
    Most likely because it’s not 100% guaranteed the server will be accessible, as then having that data will be a good backup system.
  • kawsper 5y ago
    I guess the certificate id is the id value you speak of. It would be cool if the whole thing was signed by a government public key, then you could verify it offline.
    • fabian2k 5y ago
      It is. This is signed by the relevant health authority in each country as far as I understand. And the official apps for reading them can verify the signature offline.
• PaulHoule 5y ago
  That is a big QR code, bigger than the Red Cross Rapidpass. If it was ‘carefully optimized for size and reliability’ they would use all caps letters and reduce the area by 40%. Saying that is carefully optimized is like saying GDPR pop ups carefully optimize user interfaces.
  • seszett 5y ago
    You cannot ask everyone to use only the unaccented latin alphabet for names when there are EU countries that use other alphabets, and accents. And on the other hand, you cannot ask people in the rest of the EU to learn cyrillic for when a Bulgarian citizen shows their pass. There is no easy solution for this, and including the native name + a normalised (ICAO 9303) version is probably the best one
    • da_big_ghey 5y ago
      maybe standard trans-literate method? the eu need to pick one since languages are each having many.
  • johncolanduoni 5y ago
    They actually do use all caps letters, hence why it’s base45 encoded instead of base64
• samuel 5y ago
  This is the official github of the project. https://github.com/eu-digital-green-certificates/ https://github.com/eu-digital-green-certificates/ There are Android and iOS apps for QR reading, although they don't point to the production certificate chains so can't be used to verify "real" EU certs.
  • fnord77 5y ago
    the images checked in seem a bit bizarre https://github.com/eu-digital-green-certificates/dgc-participating-countries/blob/main/gateway/images/OpenSSL.PNG https://github.com/eu-digital-green-certificates/dgc-partici...
    • mhils 5y ago
      This is included in https://github.com/eu-digital-green-certificates/dgc-participating-countries/blob/main/gateway/OnboardingChecklist.md https://github.com/eu-digital-green-certificates/dgc-partici..., in that context as an example it does make some sense.
  • girst 5y ago
    the juicy bits seem to be here: https://github.com/ehn-dcc-development https://github.com/ehn-dcc-development
  • lorlou 5y ago
    Practically all committers are German... How surprising ;)
    • camillomiller 5y ago
      As an Italian, this is reassuring :D
    • ar0 5y ago
      I don‘t seem to get the point of this comment, but the reason for this is that the EU Commission has assigned this project to Deutsche Telekom and SAP, two German companies (as is explained in the README).
• rjzzleep 5y ago
  So after all this talk of how we're better than China and how invasive the wechat Green qr code is we decided to copy it? What exactly is the moral high ground we stand on?
  • martin_a 5y ago
    I don't see any personal information besides the name and date of birth here. That's pretty good, don't you think so?
    • jhoechtl 5y ago
      The magic happens in the reader app. Does it have access to a passport ID? Image database? How is the one verifying the validity of the certificate supposed to check if it's actually the holder of the certificate standing in front to clear admission?
      • Deukhoofd 5y ago
        Check name, compare with identification, and done? Most of the EU has an identity document.
      • markus92 5y ago
        The person reading can use their eyes to read a passport/photo ID ;) You don't need an app to do that.
        • Kwantuum 5y ago
          Your id does not contained a cryptographically signed vaccination status, which this is.
          • avianlyric 5y ago
            You know it’s possible to carry ID and this QR code at the same time
        • 5y ago
• dtech 5y ago
  It's interesting that all of this is in there. In the Netherlands the health minister has multiple times promised that the checking party (like pub/work) would not be able to determine if you were OK because of vaccination, recent negative PCR test or recovered. Maybe that is only for the national check and not EU passport.
  • markus92 5y ago
    The Dutch app will have two QR codes: a national one which does hardly contains any information - initials and day/month of birth - and the EU DCC which is discussed here.
  • Deukhoofd 5y ago
    Yeah there's different QR codes, one for usage in The Netherlands, and one for international usage. Dutch: https://coronacheck.nl/nl/faq/1-6-welke-informatie-staat-in-mijn-qr-code/ https://coronacheck.nl/nl/faq/1-6-welke-informatie-staat-in-... English: https://coronacheck.nl/en/faq/1-6-welke-informatie-staat-in-mijn-qr-code/ https://coronacheck.nl/en/faq/1-6-welke-informatie-staat-in-...
  • Spooky23 5y ago
    You are correct. The national/intra-jurisdiction checks usually give you a thumb up / thumb down without context. The cross-border credentials provide context to allow the destination to make a determination if they wish. For example, some jurisdictions may not recognize Sinovac. Others may not recognize a COVID recovery + 1/2 dose series as valid. In the future, some vaccine series may need a 3rd dose. Each place in different. Some US jurisdictions adopted a "hold my beer" approach. Others have tight standards and vaccine registry, others have good immunization processes, but the integration with third parties is poor.
• simias 5y ago
  It's cool that all the data is embedded in the code instead of just containing a URL that points to some centralized server. This way people can't be (trivially) tracked by looking at the pings from the scans.
  • distances 5y ago
    There is no central server containing this vaccination data, so thankfully it would be impossible to implement.
• gillesjacobs 5y ago
  > there is no superfluous data inside, so the QR code is not a privacy nightmare, as some have feared. I strongly disagree. If the goal is to determine the COVID19 immunity status of a person on-site the only thing that should be contained is vaccination information. There is no need for full names, place of birth, issuer, targeted disease to be encoded in a QR-code that will be read by businesses. Especially since the information is presumably signed and verified by the official issuers anyway. Any other personal details such as age can be checked via already existing IDs. The "targeted disease" field betrays function scope creep. So much for the EU's moral high ground regarding privacy: needlessly sharing personal details for entering a cafe is not good privacy practice!
  • markus92 5y ago
    How can I verify that the QR code is of the person in front of me, if there's no name or anything included? Screenshots are old you know.
    • gillesjacobs 5y ago
      There are zero-knowledge and differential privacy solutions to this issue. For more critical applications there probably is an ID cross-check and online verification being performed. The nightclub does not need to know my full name, residence and birthdate.
      • skeeks 5y ago
        On most ID cards, there is the full name and the birthdate of the person. So it does not matter if it's on the QR code too. The place of residence is neither on the ID card nor on the QR code.
    • nomercy400 5y ago
      Name seems like a good field to include, but you will want to remove the 'vaccination details'. Does a bouncer at a nightclub really need to know I received one dose of a Pfizer vaccine against COVID-19 in Austria on February 18, 2021? Or does he need to know that 'I am fully vaccinated to enter this venue according to local laws'?
• jeffrallen 5y ago
  Thank you for this. I've been casually reading the Swiss Covid Certificate verifier to find the same info.
• A_No_Name_Mouse 5y ago
  Does it reflect a state of prior illness where only 1 jab is required instead of 2? Or is the doses element adjusted to reflect that? Edit: could be in the top level "r" for Recovery group element Edit 2: no, the recovery element does not allow information on vaccination, and vaccination/recovery group cannot be combined
  • carlmr 5y ago
    At least not in Germany, which is a point of contention: https://www.faz.net/aktuell/wirtschaft/jens-spahns-umgang-mit-genesenen-und-corona-impfungen-17396468.html https://www.faz.net/aktuell/wirtschaft/jens-spahns-umgang-mi... They won't give you a second jab, but they also won't officially recognize you as vaccinated right now. And travel is also problematic since not all countries, not even the EU countries, accept prior illness + vaccine as being fully vaccinated. These laws look like code that could use property based testing.
    • jeroenhd 5y ago
      The benefit of this system is that at least we have a unified document right now. From what I've heard, covid recovery is indeed part of the QR code so any country accepting half vaccinated people that have recovered doesn't need to deal with different paperwork from every member state. The lack of getting people a second shot is disappointing, but with the limited availability of vaccines it's understandable from a health perspective. The goal of vaccination isn't to help people travel, it's to prevent a deadly disease, after all. We'd be better off with a common deciding factor what measures are acceptable to cross the borders, but areas with tourist-centric economies are incentivised to reduce the access requirements, and other countries are paying for those economies while they're still failing, so health and safety wouldn't be the main concern of such a common approach. The national approach doesn't have this problem, at least not for the countries supplying the tourists.
      • kroeckx 5y ago
        My understanding is that vaccination, recovery and a negative test are 3 separate QR codes. You normally only need 1 of the 3.
• sneak 5y ago
  > Apart from the name/manufacturer of the received vaccine, there is no superfluous data inside, so the QR code is not a privacy nightmare, as some have feared. It has someone's name and DOB in it, which, when scanned, creates a record of their identity at that location at that time. Coordination between scanners can create a crude track log. It's still a privacy nightmare.
  • realityking 5y ago
    Name and DOB are necessary to cross check the certificates with IDs/passport to make sure screenshots aren‘t passed around
    • yokaze 5y ago
      It is the same way necessary as having your passwords stored in plain-text to verify your password. Name and DOB could be hashed and compared to the hash inside the QR code.
      • daveoc64 5y ago
        Such a system would be a nightmare for matching names reliably. There may be variations between different documents (e.g. it might exclude middle names, people might use a different name on different documents, accented characters, hyphens, might be in a different order, might have a title or honorific such as "MR").
        • yokaze 5y ago
          Reflecting on it, it doesn't solve anything, as I still have to give my name and date-of-birth to the person validating it anyway. Otherwise, there is a large degree of normalisation in the id documents in the EU, and you could simply hash each variation.
• robthebrew 5y ago
  I'm having grief running the code on MacOS. Has anyone tried running the UK NHS app QR code through this? I am (200%) certain that uk.gov reinvented the wheel just to piss everyone off, but it would be interesting to know.
  • mattdoughty 5y ago
    I have decoded the UK QR code (though not using this code). It conforms to the same standard.
    • robthebrew 5y ago
      That is good to know, as the app seems to claim you can use the QR code for foreign travel. Whether it is accepted is another thing.
  • contracertainty 5y ago
    The UK doesn't have an NHS, nor NHS app. The UK has four national health services, one for each country. IIRC only England has an NHS app. And we have no id cards. It's not looking good.
    • robthebrew 5y ago
      Have you looked at (in my case) the iOS app store? They certainly do have just such an app. Sure, I made a mistake thinking we were still United, but there is such an app for England residents.
  • girst 5y ago
    well, i've written that code quite hastily, and mostly for my own need. i'd guess, the most likely cause would be a missing libzbar.
• allyourhorses 5y ago
  The certificate expires after 1 hour, so this is still an online process.
  • supermatt 5y ago
    They dont expire after 1 hour - where did you hear that?
    • Spooky23 5y ago
      I think there is a green pass for unvaccinated individuals that allows an antigen test to be used. Those tests are only valid for a few hours, varying by jurisdiction. (I think most US states accept these for 6 hours)
      • deleted 5y ago
        [deleted]
        • Spooky23 5y ago
          Depends on the cert. I know when I got the NY excelsior pass, the certificate expired about 6 hours after either the test was administered or results determined. (Don't remember which)
          • supermatt 5y ago
            Sorry - i deleted my comment as I thought it was superfluous, but to reiterate - "it would be the validity for the test, not the cert". It is entirely possible that there was an expiry set, but you wouldn't be able to "reissue" it with a new expiry date, in contrast to what GP was suggesting.
            • Spooky23 5y ago
              No worries. This stuff is all as clear as mud, and different jurisdictions take differing approaches. There's a few competing standards, lots of noisy people, etc.
• JakaJancar 5y ago
  Nice to see government tech that’s well-designed and a positive article about it. Clicking the link, I must admit I was expecting a privacy or security disaster. We should highlight the good stuff more often.
  • y04nn 5y ago
    So now, bar/restaurant owners can reliably track their customers: age/name, how often they come in each branch. Large franchise would also be able to track where and how often their customers travel and what they eat. I think this is real privacy issue. If you what to store the data, please anonymize it first, at least when it leaks it would be a lesser privacy disaster.
    • zaarn 5y ago
      GDPR Breach, plain and simple. No franchise would risk storing and leaking what amounts to medical records (since that is the source) in front of a GDPR Watchdog. Pretty sure you'd get the hammer if you did that. Either way, the official apps that let you check the record do not allow tracking, only verification. The simple solution is that if you don't see them using the official app, simply leave.
      • michaelt 5y ago
        > the official apps that let you check the record do not allow tracking, only verification. So why are name and date of birth included in the QR code?
        • bigiain 5y ago
          I would guess so that they can use more traditional ID (like a drivers license) to confirm the vaccine record is yours.
        • mtmsr 5y ago
          Because you need a way for the pub to authenticate that this is indeed your qr code (matching your id)
• jeroenhd 5y ago
  > there is no superfluous data inside, The Dutch government disagrees. Their app implementation will have the ability to generate two codes, one for events within the borders and one for the EU pass. The reason behind this is that the Dutch QR code only contains the bare minimum of personal information to identify you. By default this means the day and month of birth and your initials, unless you share those among many other citizens. In that case, more data may be added, such as your full first name or year of birth. While the amount of personal data exposed through the QR code is small and not a privacy risk in my opinion, it does have some points where it can improve. Still, it's not a bad system from a technical point of view. My problem with the entire system is that this code is basically a free pass for all the old people we've stayed inside for a year for to go on holiday, while everyone else gets to go through all the same hoops they've been going through for months. If the vaccinations were spread randomly across the population, I'd be perfectly okay with such a system, but in real life all the old people got their shots first. Things may be different in other countries, but here the vaccinations are still going, with only half the population having had a first shot. The underlying message is clear, there's no solidarity between the age groups. I had to pause my social life to protect the people aged 50+, but those people aren't willing to put off their holiday for me in return. I'm sure the underlying reason for implementing this system is economic, it's the EU after all, trying to save tourist-oriented economies and all that. I'll get my pass somewhere near the end of August (two weeks after my second shot), past the holiday period. Parents will have to wait for even longer if they want to travel with their kids, because kids are all the way at the end of the vaccination line if they even get them at all. With the Indian covid variant ravaging Portugal and the seasonal effect, I do wonder how long this system will last. It's only a matter of time before some mutant shows up that's resistant to a certain vaccine and we start from scratch.
  • float4 5y ago
    > By default this means the day and month of birth and your initials, unless you share those among many other citizens. In that case, more data may be added This sounds like k-anonymity, in which case the k is usually made public. Any idea what value they chose?
    • 5y ago
• r1ch 5y ago
  This design looks pretty sound, revocation seems like the big missing piece but I guess that could be done by pushing an updated scanner. Here in The Netherlands our app is also used for proof of a negative test. I wonder if giving signing powers to however many hundreds of test locations will backfire at some point. Then again I don't know if our national QR codes are even cryptographically signed to begin with.
  • cr1895 5y ago
    > I wonder if giving signing powers to however many hundreds of test locations will backfire at some point. In Germany the vaccine proof can be generated at (most?) pharmacies. If that would become an issue, I don't think it would only be one in the Netherlands.
    • zaarn 5y ago
      Should be most pharmacies but they have to check your vaccination booklet (or proof of vaccination, they give you extra papers at the vaccination location). It seems to work alright considering atleast one person I know is facing charges for falsifying medical documents and falsifying signatures due to them trying to fake their vaccination and bringing that to the pharmacy.
  • bigiain 5y ago
    From the qr generated and qr expiry timestamps, it looks like they are only valid for 2 days, so revocation isn’t that much of a problem.
    • r1ch 5y ago
      I was thinking more along the lines of one of the signing keys leaking.
  • lesquivemeau 5y ago
    I don't know how the signing process is for this specific green pass, but the national France one is signed exclusively by the French healthcare system: vaccination centers and test locations can emit a signed pass remotely and print it, but they don't possess the private key locally.
• jfrunyon 5y ago
  > What we're looking at there is a Base45-encoded, compressed, signed binary data structure. ?!?!?! QR codes support binary natively. What the hell even is base45?!
  • supermatt 5y ago
    https://github.com/ehn-dcc-development/hcert-spec/blob/main/README.md#base45 https://github.com/ehn-dcc-development/hcert-spec/blob/main/...
    • devit 5y ago
      The document says that the encoding is 11 bits for two characters, which means that Base45 plus that encoding is very efficient, since 45^2 / 2^11 = 0.988, so only 1.2% of the capacity is wasted.
  • RobinUS2 5y ago
    https://datatracker.ietf.org/doc/draft-faltstrom-base45/ https://datatracker.ietf.org/doc/draft-faltstrom-base45/
  • dugmartin 5y ago
    It is the first I've heard of it too but according to this draft spec QR codes can't support binary: https://datatracker.ietf.org/doc/draft-faltstrom-base45/ https://datatracker.ietf.org/doc/draft-faltstrom-base45/ "Even in Byte mode a typical QR-code reader tries to interpret a byte sequence as an UTF-8 or ISO/IEC 8859-1 encoded text. Thus QR-codes cannot be used to encode arbitrary binary data directly. Such data has to be converted into an appropriate text before that text could be encoded as a QR-code. Compared to already established Base64, Base32 and Base16 encoding schemes, that are described in RFC 4648 [RFC4648], the Base45 scheme described in this document offer a more compact QR-code encoding." Here is the output alphabet: Value Encoding Value Encoding Value Encoding Value Encoding 00 0 12 C 24 O 36 Space 01 1 13 D 25 P 37 $ 02 2 14 E 26 Q 38 % 03 3 15 F 27 R 39 * 04 4 16 G 28 S 40 + 05 5 17 H 29 T 41 - 06 6 18 I 30 U 42 . 07 7 19 J 31 V 43 / 08 8 20 K 32 W 44 : 09 9 21 L 33 X 10 A 22 M 34 Y 11 B 23 N 35 Z My initial thought is using "Space" as a valid encoded value seems like an enormous foot gun.
• ChrisMarshallNY 5y ago
  In New York, we have the "Excelsior Pass," which is quite similar[0]. Here's what it looks like (in a big fat QR): { "@context":["https://www.w3.org/2018/credentials/v1"], "id":"<INDIVIDUAL ID>", "type":["VerifiableCredential"], "issuer":"<ISSUER ID>", "issuanceDate":"2021-06-12T01:14:19Z", "expirationDate":"2022-05-19T03:59:59Z", "credentialSchema":{ "id":"<SCHEMA ID>", "type":"JsonSchemaValidator2018" }, "credentialSubject":{ "display":"#24387E", "passType":"COVID-19 Vaccination", "subject":{ "birthDate":"<DOB>", "name":{ "family":"<LAST NAME>", "given":"<FIRST NAME>" } }, "type":"COVID-19 Vaccination" }, "proof":{ "created":"2021-06-12T01:14:19Z", "creator":"<CREATOR ID>", "nonce":"<NONCE>", "signatureValue":"<SIGNATURE>", "type":"EcdsaSecp256r1Signature2019" } } I'm not sure where to get the schema, but it looks like some common format. There's not really any private medical ID in there. My driver's license has more info. [0] https://epass.ny.gov/home https://epass.ny.gov/home
  • shellac 5y ago
    It's jsonld, using w3c verifiable credentials. (https://www.w3.org/TR/vc-data-model/ https://www.w3.org/TR/vc-data-model/). Using the context (https://www.w3.org/2018/credentials/v1 https://www.w3.org/2018/credentials/v1) you can look up information about the properties and types, in principle. (It also also includes a link to a json schema)
    • deleted 5y ago
      [deleted]
• nomercy400 5y ago
  In my country, there have been awareness campaigns about not giving out our passport or copies of our passport, as it contains our Social Security Number, biometric fingerprints, and other information that can be used to create a profile and impersonate a person. This links 'a person' to 'a piece of health information'. Imagine what you or any data platform could do with that (big) data. Imagine that you are only allowed to visit certain countries based on your vaccination status. Advertising agents of tourist and traveling agents would love to get their hands on that information, to create a better profile of you. Maybe Google could even make a FLoC of 'COVID-19 vaccinated people'. Imagine that one year from now, one of the vaccines is known to cause health issue X, which would require over-the-counter medication Y. Advertising companies would love to know exactly what vaccines you have received, to add to their 'profile'. and would go to great lengths to get this information (create their own 'reader app' and supply this to events). Here we hide personal health information in a QR code and are expected to give random strangers 'consent' to this personal data to gain 'access' to a venue or 'service'. Sounds awfully lot like a cookie consent-popup, which the EU is so actively trying to prevent through legislation. Do you really need to link 'a person' to 'a vaccine profile'? Isn't it enough to link 'a person' to 'can access this service/venue according to local laws?'. In software development, you separate authentication and authorization. The authentication part is 'are you who you say you are', the authorization part is 'are you allowed to access this resource'. For authorization, you don't send the full list of all roles/permissions of this user for all authorized applications, you send a true/false based on the question canAccess(resource)? Otherwise a 'hacker' might find he has no permissions using the current authenticated account to resource A, but conveniently has full permissions to resource B. You wouldn't give a random webshop access to your Bank Balance and history, would you? Your bank should only tell them 'transfer of X dollar is approved'.
  • damagednoob 5y ago
    > Imagine that you are only allowed to visit certain countries based on your vaccination status. How is this different from the uncontroversial practice of requiring yellow fever vaccinations when travelling to certain African or South American countries?
• FreezingKeeper 5y ago
  Somewhat related - here's [0] a report on the QR codes that public venues in England can display for patrons to 'check in' using the NHS COVID-19 app to assist with contact tracing [0] https://www.revk.uk/2020/09/how-not-to-qr-nhs-c19-app.html https://www.revk.uk/2020/09/how-not-to-qr-nhs-c19-app.html
• miguelrochefort 5y ago
  There aren’t that many different ways to design an immunity passport. Their design looks very similar to mine [1], but they use a compact and custom schema instead of FHIR and W3’s Verifiable Credentials standard. Looks like they might be using LOINC code though. [1] https://miguelrochefort.com/blog/immunity-passport-2/ https://miguelrochefort.com/blog/immunity-passport-2/
• mssundaram 5y ago
  So it's "papers please" all over again for Austria?
• Avalaxy 5y ago
  Why would "target" disease be "840539006"? Have there been 840539005 other diseases before? Would "1" not suffice? Or just "covid19"?
  • robjan 5y ago
    It's the SNOMED code for Covid-19
  • altacc 5y ago
    It comes from SNOMED, which is a system for electronic health records and is very comprehensive, multi-lingual & multi-national. Every disease, symptom, medical term, etc... has a code which allows matching across languages. I doubt the IDs start at 1, it's likely the fist few digits (perhaps 8405) are a type classification for the ID. It's been going for a few decades and thousands of new IDs are added each year.
  • DerWOK 5y ago
    840539006 is the ID by SNOMED https://www.snomed.org/news-and-events/articles/march-2020-interim-snomedct-release-COVID-19 https://www.snomed.org/news-and-events/articles/march-2020-i...
  • tummybug 5y ago
    The complete list of codes can be found in the github repo containing the schema for the qrcode data https://github.com/ehn-dcc-development/ehn-dcc-schema/tree/release/1.3.0/valuesets https://github.com/ehn-dcc-development/ehn-dcc-schema/tree/r...
  • CRConrad 5y ago
    Yeah, Covid nineteen! Where was all this foofarah the first eighteen times, eh? Eh? /s
• bluefox 5y ago
  Great tool for fascism. But hey, tech seems legit.
• mvanaltvorst 5y ago
  Who is in control of the actual certificates? Is it a private company, or the government of some European country?
  • stavros 5y ago
    You mean the CA that signs the vaccination certificates?
• londons_explore 5y ago
  The design of this code seems bad... It should encode: https://covidcheck.gov.eu/87HS84JU8179 https://covidcheck.gov.eu/87HS84JU8179 The URL, when visited by browser should display a big green tick or cross. The page should contain all the machine parsable metadata. The URL itself should have a check digit to allow low-security offline checking, although for cases where falsification is an issue, online checks should be required, since there is no good way to revoke offline codes. The substantially shorter code will read much more easily and be smaller to print. It can be verified or generated without any special software.
  • pawal 5y ago
    The downside of this is that the lookup is done online, and every use of an individual is tracked per service. This is not something that I am comfortable with.
  • tuxone 5y ago
    For offline checking you will eventually need some data (first name, last name, birthdate) to validate against eg. an ID card.
    • iudqnolq 5y ago
      As they do.
  • raxxorrax 5y ago
    People faking vaccination data is no real threat. Only when government has a problem with liberties will we see fakes.
• baby 5y ago
  I’ll tell you why it’s not great: it doesn’t interop with other vaccination passport. I got vaccinated in the US and I’m in France now and my vaccination is worth nothing. Perhaps it will be a good thing for the short term and to incentivize people to get vaccinated, but I’m not sure what other purpose this really has.
  • WC3w6pXxgGd 5y ago
    Vaccine passports are dumb.
  • disabled 5y ago
    There is an actual procedure for getting your vaccine internationally recognized. I looked this up for tourists coming to Croatia (who do not need to do this). It is conceptually the same as getting documents in your home country legalized for use in the respective country you are going to live in, abroad. I have went through this process more than a few times now. But, it is a pain to do. Here is an example of how it works for vaccines: https://thecostaricanews.com/how-to-apostille-in-costa-rica-the-proof-of-a-vaccine-applied-in-the-united-states/ https://thecostaricanews.com/how-to-apostille-in-costa-rica-... Basically you do this: 1. Get your official vaccine record from your /state/ (not county) department of health. 2. Get your official vaccine record apostilled (certified for international use) by mailing it in (and paying a $10-15 fee) to your state secretary of state (in the state where it was issued). 3. (sometimes required--call a consulate) Get an official translation of the vaccine record (usually a translation on the apostille is not required) from a court approved translator in the country abroad (i.e. France). Typically this costs $35-50. 4. (sometimes required--call a consulate) Get all of this authenticated for use in the country you are staying in, abroad, usually via an official working for the Ministry of Foreign Affairs (i.e. France). This probably costs around $20. Anyways, this is a lot of work, but this is the legalization process for foreign documents, so that they are viewed as official and usable abroad. Anyways, this is the standard and typical certification process for Croatia, an EU country.
• hedora 5y ago
  How is this not a privacy nightmare? It has name and date of birth in it. The California version will certainly be used to generate databases that will be fed to marketers.
  • JBorrow 5y ago
    Well a lot of venues ask to see your ID to verify your age for entry. How is this any different? It's not like it contains any contact information.
    • codeecan 5y ago
      I think if every time you went to a venue, they would photocopy your ID, nobody would visit that venue. The doorman is not remembering/recording every person who came in, thats the difference.
      • JBorrow 5y ago
        But they are through CCTV
  • alkonaut 5y ago
    Companies aren’t allowed to keep that data in the EU. I thought California had something similar to GDPR? In any case, it’s the minimum amount of information required for the task, and it’s at least (hopefully) for a limited time.
  • mmcnl 5y ago
    What's stopping people from robbing you at gunpoint? The law. GDPR is specific about consent and the purpose of collecting data. It's simply illegal to feed the data to marketers.
    • slipframe 5y ago
      If somebody robs me at gunpoint, I immediately know it happened. I can report it to the police, who will take the report seriously. If the police catch the guy (which is likely if he's a serial offender), the prosecutor will take it seriously. If convicted, the offender will go to prison for years. If a company violates privacy laws, I will not immediately know it happened. If I don't know it happened then I can't report it to the police, but even if I did, the police probably won't take it seriously. And prosecutors going after corporations? Even if that happens it will doubtlessly take many years for the court case to reach any conclusion. If convicted, the corporation will receive a fine that is a fraction of what it would take to put them out of business. The executives won't go to prison. The practical differences between these two scenarios are substantial.
• tyingq 5y ago
  The "first positive test result date" in the recovered example seems interesting to me. Is there are reason for a pub to know you ever tested positive, if you are far enough past the date, immunized, etc?
  • ajsnigrutin 5y ago
    Depends... In my country, if you get a positive PCT test, you can go places 10 days after the result and up to 6months after, then a vaccination is required (or a new positive result, or a test). If another country has different limits (14 days after the positive test and up to 5 months after), they need a test date to calculate if you're allowed to enter or not. As someone from a former socialist country, this really reminds me of "papers please", especially the border crossings between countries with similar numbers of infected not letting people cross.
• motohagiography 5y ago
  This tech is troubling, partially because it will work, the question is what it will work for. I've worked in privacy for a long time, and these passport schemes are just an absolute attack on health information privacy legislation and they create the precise outcome the regulations were designed to prevent, which was a literal tyranical society that used arbitrary medical pretexts to privilege and disadvatage people politically and economically. This isn't just rhetoric either, we have decades of health information privacy legislation built around this principle. Every single new government tech in many countries needs to go through a privacy impact assessment to ensure it isn't a mechanism to do this specific thing, and I guarantee these technologies would not have survived one. Why should you give your vaccination status to anyone within the borders of a country, and what meaningful assurance does it provide to the pub/venue recieving it? Here is what it does not do: a) show you do not have a variant of a disease b) show you are not carrying a disease c) show you are or are not vulnerable to a disease or variants of it What does demonstrating this status signify? Perhaps I am missing something.
  • zoobab 5y ago
    All this personal health infos should never ended up being encoded in clear in the QR code. Some french researchers and Laquadrature are going to court to remove those infos from there: "la lecture du code en 2D permet à n’importe qui, toujours aussi facilement, d’accéder à des données de santé très sensibles mais parfaitement inutiles au fonctionnement du passe : date de prise du vaccin, nom du vaccin, contraction passée de la maladie" https://www.laquadrature.net/2021/06/09/passe-sanitaire-attaquons-lobligation-didentification/ https://www.laquadrature.net/2021/06/09/passe-sanitaire-atta...
    • motohagiography 5y ago
      Why should we have a health status QR code at all?
• hammon 5y ago
  It's not a privacy problem, it's a human rights one. Sadly, no one seems to care. Requiring a genetic treatment, to work, travel or live is a dystopic future. Madness.
  • koalaman 5y ago
    At every level of education I was required to show evidence of vaccination to attend. This has been normal for many decades, and as far as I'm concerned makes complete sense. It's unclear to me what's dystopic about public health requirements. Society imposes on individuals many constraints, and gives us back many benefits in return. Perhaps people care, but simply disagree with your threshold for what's an appropriate societal imposition. I certainly do.
  • yarcob 5y ago
    You can get tested instead of getting a vaccine. (Also, a vaccine is not a "genetic treatment". Not even an RNA vaccine.)
  • aww_dang 5y ago
    I care. Many are skeptical of a vaccine passport combined with a digital wallet for CBDC. The historical background of those promoting this program is concerning. Even without that, the historical parallels to other atrocities is concerning. Together it seems obvious to those who are willing to examine it. Unfortunately, there's a distinct lack of "intellectual curiosity" surrounding these issues. People are scared. Once again, they are looking for authorities to help them. Dissent is demonized as always. In this case, concerns are framed as dangerous propaganda preventing us from reacquiring our pre-pandemic freedoms. For those true believers, I ask: When has government willingly returned freedoms ceded under the pretense of emergency? The banality of evil marches on.
  • quenix 5y ago
    "Genetic treatment"? Please.
    • hammon 5y ago
      if you modify rna to produce a protein of your choice what it is? btw, even for the law Vaccine is something that give you immunity, and we have already plenty people with 2 shot getting covid again... Next winter we will be in the same situation as 2 year ago, and alot of people will realize.
• ezoe 5y ago
  It looks like technically bogus to me. A technically sound proof which doesn't require online access is like this. The authority encrypt some private information(name and birth date for example) with the private key, and encode it to QR code and give it to the customer. On entering the pub, the customer show the document(passport, driver's license etc) which prove his private information. Staff then decode the QR code and decrypt it with authority's public key. Check the decrypted text.
  • iudqnolq 5y ago
    That sounds exactly like what they did to me?
• monkeybutton 5y ago
  Looks similar to the one implemented in Quebec: https://news.ycombinator.com/item?id=27354815 https://news.ycombinator.com/item?id=27354815
• jcq3 5y ago
  Is it possible to spoof the qr code? If so, how?
• streamofdigits 5y ago
  it feels as if the covid pandemic will do more to sensitise people to the critical role of digital technology and data privacy in our lives than any amount of activism back in the days of "normality", let me check - 478 days ago. these exercises in scrutiny, the demands on transparency, accountability, second order risk analysis etc. all this sets a precedent that will not be easy to ignore. a silver lining if you wish [you can now resume the discussion]
  • benjaminwootton 5y ago
    I never really engaged with the arguments about Facebook, Whatsapp privacy update etc. Mainly because I thought they were just trying to sell us ads. Maybe I made a mistake as I certainly care about data privacy now. These passes are an absolute tragedy for society as far as I can see.
    • da_big_ghey 5y ago
      i was the same... i am just avoiding facebook and whatsapp. i can not avoid a required scan for to enter my local food market. "you will submit to tracked or be ostricized from society... you have no rights until central government certify you."
    • raxxorrax 5y ago
      I think in reality nobody will care about it in a few months, hopefully not years. I didn't plan any travel this year and not really interested in getting my health certified. Still sensible to get vaccinated, but I think I will just put it in my paper pass. I don't trust smartphone OS one bit.
• deleted 5y ago
  [deleted]
• deleted 5y ago
  [deleted]
  • deleted 5y ago
    [deleted]
• notorandit 5y ago
  Gabriele is a "he". Grabrielle is a "she".
  • CRConrad 5y ago
    > Gabriele is a "he". Grabrielle is a "she". Gabriele is a "he" in Italian. Gabrielle [sic] is a "she" in French. Kari is a "he" in Finnish, and a "she" in Norwegian. Maybe Gabriele is a "she" in Austrian German.
• kokey 5y ago
  I guess this only works if it's used alongside proof of name and/or date of birth. I guess adding some basic biometric data like height and eye colour would have allowed venues to harvest even more personal data which is not ideal.
• vicedvin 5y ago
  Using “green” pass does contradict with EU resolution 2361/2021 which states: “ 7.5.2 use vaccination certificates only for their designated purpose of monitoring vaccine efficacy, potential side effects and adverse events;” Allowing people to visit pubs or other social places is the right — whether someone concerned of getting sick it is up to them to get a vaccine; those who are not in for the experiment (most of covid vaccines are in experimental state up to year 2023) shall not suffer the artificial social limitation barriers.
• fortran77 5y ago
  Is the California state QR code compatible?
• williesleg 5y ago
  I love me some government control
• kmonsen 5y ago
  Has someone tried this with the California QR code? I cannot find the specification for it. When I scan it on my I iPhone it just gores to the Apple health app with no information.
  • jdkizer 5y ago
    Sure, you can find the specification for the QR code format in https://smarthealth.cards/ https://smarthealth.cards/. The data payload is defined in http://build.fhir.org/ig/dvci/vaccine-credential-ig/branches/main/#use-case-1-vaccination-credentials http://build.fhir.org/ig/dvci/vaccine-credential-ig/branches...
  • imemyself 5y ago
    I was also curious about this too, it took a few steps to get the SHC data into something human readable. I posted what worked for me here - https://github.com/ogarraux/california-vaccine-record-reader https://github.com/ogarraux/california-vaccine-record-reader.
• pyentropy 5y ago
  Regarding binary and QR: seems like the state of QR scanners is a cruel joke. There are multiple specs, of which only ISO 18004:2006 survived. It says: A QR code contains a mode indicator, character count and the bitstream encoding the characters. Modes are: - numeric: 10 bits are used for [0-9]{3} - alphanumeric: 11 bits are used for [0-9A-Z$%+-./:]{2} - 8 bit Kana/JIS X 0201: (8 bits are used for every Japanese character) - Kanji - mixed mode (switching between multiple character sets in one stream) - extended channel mode (ECI) - latin1, cyrillic, etc https://www.swisseduc.ch/informatik/theoretische_informatik/qr_codes/docs/qr_standard.pdf https://www.swisseduc.ch/informatik/theoretische_informatik/... Note that the document mentions that stuff like 'font size' is not specified in QR (?), while saying nothing about basic questions like 'what about non-printable characters'. Then it got it got superseeded by 18004:2015. When a person asked on StackOverflow what's going on, the answer by the author of the most popular QR library (zxing) says "There is one (not obsolete) ISO spec for QR codes, ISO 18004:2006. Most of what you observe is just lack of compliance." - https://stackoverflow.com/questions/18699739/tools-for-qr-code-generation-not-agree-about-standard-limits https://stackoverflow.com/questions/18699739/tools-for-qr-co... Looking at other questions ("how do I store utf8"), it seems like scanners do some heuristics (scanning for BOM, valid unicode codepoints, etc), not even slightly conforming to the modes: https://stackoverflow.com/questions/51516612/choosing-a-character-encoding-for-qr-codes/61035910#61035910 https://stackoverflow.com/questions/51516612/choosing-a-char... --- So, you can do base64 with ECI latin1, and risk the scanner performing some heuristic... or you can just take the alphanumeric route with 45 options (26 letters: [A-Z], 10 digits: [0-9] + 9 special characters), which is compact in terms of QR representation (not in terms of modern 8-64 bit words in memory!) and call it a day: https://tools.ietf.org/pdf/draft-faltstrom-base45-06.pdf https://tools.ietf.org/pdf/draft-faltstrom-base45-06.pdf
  • dirkx 5y ago
    And it is not that bad - base45 packages nicely in 11 bits; so compared to exactly the same payload in binary - there is just a few percent difference in the end in pixels/cells on screen.
    • deleted 5y ago
      [deleted]
• pzo 5y ago
  Although apps are open source there is a lot of potential that all those information can be missued mainly for tracking: 1) Some other countries or commercial venues using their own version of VERIFIER app (based on open source) that pings some server online 2) Some other countries using their own version of ID app (based on open source) that pings some server online while QRCODE is rendered/generated I'm just wondering why they havent designed it in different way (only when applying for use in commercial venues): For application inside nightclubs, concerts etc. : 1) QRCode doesn't have any private data such as firstname / family name / date of birth etc (so that it's impossible to create profile ID) 2) While downloading your qrcode for the first time after installing the app (onboarding), it ask your for e.g scanning your National ID and/or holding your phone in front of mirror to verify your face (similar like other banking app do). After verification only then generates offline qr code for you 3) While onboarding it is mandatory that app is protected with your FaceId or TouchId 4) Such app can be installed only on one device (similar like in Whatsapp once trying onboarding on new device the previous app code is invalid) - any qrcode would be valid only for 48h 5) Bouncer still scan qrcode to check offline if is properly signed by authority + communicated with the app P2P via NFC/Bluetooth/Proximity to verify this is neither screenshot nor some unauthorized app. ad 5) Verifier maybe would have to ping some server to check that App is legit but wouldn't know who is checkin in edit - formatting
  • petre 5y ago
    > 2) While downloading your qrcode for the first time after installing the app (onboarding), it ask your for e.g scanning your National ID and/or holding your phone in front of mirror to verify your face (similar like other banking app do) This is already way over the line. I can understand banking apps do it but for a vacvination certificate? No way. The QR code implementation is fine. It would also be fine if it would be printed on paper or in a PDF and valid for a year.
    • pzo 5y ago
      I agree this is more hassle but the QR code implementation is only fine if you trust that some EU governments or companies won't try to abuse the system in the future. I'm not saying that this will happen but why not design the system so that it is not possible? If verifier app will at some point start pinging some server having a QRCode in PDF or printed on paper won't save you from someone tracking all places you are going to. Imagine how useful it can be for tracking some politicians, activists or journalists and correlating that check-in information who they might be meeting with.
• ibejoeb 5y ago
  Soon enough, the cool kids will be the ones who don't carry phones.
• dvh 5y ago
  {-260:...} - why is key -260 ???, I mean who designs format like this?! Like in the middle of nowhere, bam -260. I would understand {type:-260, data:...} but this?! What is wrong with these people?
  • raxxorrax 5y ago
    That is indeed to be condemned. Missing and wrong quotes aside.
• deleted 5y ago
  [deleted]
• stevengraham 5y ago
  There is an epidemic of naivety and irrational fear pervasive in society right now. Even "data" and "science" is subject to emotionally or ideologically-driven narrative and/or subjective perception. This, against a backdrop of our current "big tech" which has demonstrated wanton disregard for individuality and autonomy in favor of centralization and manipulation. There are a few voices of reason here. Hopefully more will speak up. It is the very creation of SYSTEMS that pose the greatest risk to individual liberty and the course of society. Once the systems are in place, they can evolve. They can be leveraged or weaponized. It is past time for ethics and limits in tech. The creation of these "pass" systems is extremely naive, and forms the basic enabler of a technocratic tyranny. Your personal autonomy is being increasingly removed. You are approaching a reality where some (many in this thread) naively want you to accept that you are inherently dangerous, untrustworthy, and unprivileged - until some central "system of authority" grants you "privilege" to exercise "rights" that are being removed. No thanks. Reject the overton window shift.
  • 1_player 5y ago
    Nonsensical appeal to fear. Either express concrete criticism or avoid posting rambling FUD and doomsaying that doesn't contribute to the topic at hand.
  • johnbaker92 5y ago
    Amen to that. Sad that most seem to go along with this nonsense. No thanks, I will also pass on this. This is the opposite of what true freedom looks like.
  • Shocka1 5y ago
    100% - this should be at the top.
• deleted 5y ago
  [deleted]
• WC3w6pXxgGd 5y ago
  "Papers, please!" If you support vaccine passports, at least acknowledge you don't care about individual rights, privacy, or capitalism. People don't realize authoritarianism always comes in the form of the govt "caring for / protecting" you.