6 ms·

I'm somewhat disappointed it contains personal data. I wonder how long until third party validation apps come out that exfiltrate this to the highest bidder. Ye

by fy20 5y ago

I'm somewhat disappointed it contains personal data. I wonder how long until third party validation apps come out that exfiltrate this to the highest bidder. Yes of course GDPR should protect you from the business purposely doing it, but I'm more thinking of the app doing it without knowledge.

fabian2k 5y ago
Without personal data you cannot verify that the code belongs to the person showing it.
- krona 5y ago
  Unless the code contains biometrics (even just a photo) you're not 'verifying' anything without some other way to verify it.
  - sgtfrankieboy 5y ago
    They verify it against the persons ID card which has a photo of them by matching up the name.
  - fabian2k 5y ago
    The code contains your name and date of birth. The photo is on your ID card/passport you show along with the QR code. So the person checking you can verify that the names and date of birth match, and that the photo in your ID could reasonably be you.
  - jeroenhd 5y ago
    The PII is in there so you can verify against some kind of ID. The QR is not intended to be valid without also checking the accompanying ID. They could've gone the lazy route and stored your SSN (or similar).
zaarn 5y ago
The German and Swiss/Austrian apps are all open source (and I think all three also have reproducible builds, you can verify what you installed, I know this is true of the official German apps involved). If you use a non-gov third party app that's on you I guess, not much from stopping you doing that since the QR code can be handled by any app. Otherwise, some personal data will be required, since the person checking your code (like a bouncer) must be able to verify that against your ID card.
- dannyw 5y ago
  If people are using apps, there are zero knowledge proofs that can be used here . The bouncer at the night club don't need to know how many doses you had or where you tested negative, as that has no impact by the legislation
  - csunbird 5y ago
    The bouncer will also not check your ID as long as the barcode scanner says it is a valid certificate. He just does not care at all.
    - gillesjacobs 5y ago
      But it's trivially readable and collectable anyway.
  - zaarn 5y ago
    It does actually, because not all vaccines require the same amount of doses and if you were infected, that's a completely different story too. Different cities also have different timespans after infection or dose after which you can start all the fun activities (and sometimes it matters per activity). For example, the nightclub might require 7 days after the last required dose for vaccination or 14 days after the last negative test after an infection, but other venues might only require 7 days after the last negative test and 14 days after the last dose. In addition to that, legislation may change, so your time limits and dosage limits now all change and future vaccinations might require more doses. Either way, the bouncer doesn't get to see any of this. They only see your name, check your ID if it's the same name (which they have to do anyway to check you're 16 for alcoholic beverages and curfew) and then wave you through. The apps I've seen in use by people who check the vaccination QR code only give you an OK or NOT OK signal, once you've setup the type of limits you have to obey.
user-the-name 5y ago
It contains your name. That seems like the absolute minimum personal information you could possibly include.
- bloak 5y ago
  It seems to contain name and date of birth. Would it be better if it contained the person's ID card number, assuming they have such a thing?
  - pmontra 5y ago
    Id cards expire and are replaced by new ones with new ids. In my country they expire after 10 years, on the birthday. So about 7 / (365 * 10) = 0.002 % of id cards expired this week here, or 115k cards. I'd store only the name and birthday and let officers check the id card with the usual procedure.
    - bloak 5y ago
      It would presumably not be a problem for people to regenerate their QR code when they replace their ID card. They have to regenerate it every day or so anyway. (The QR code in the article expires after 48 hours.) Linking to an ID card number has the slight advantage that the ID card number is unique whereas several people can have the same name and date of birth. It doesn't really help with keeping the name or date of birth private because in practice those things are printed on the ID card which has to be shown together with the QR code. The ideal would be to reveal only the information that is needed in a particular situation. For example, if you're trying to get into an Austrian pub all that's needed is the photograph of the face and confirmation that the person with that face is over 18 and vaccinated. Though in practice people like pub bouncers are not very good at checking faces so having a physical ID card that is hard to counterfeit is an important part of the security. That line of reasoning suggests that what's needed is an ID card with banknote-style anti-counterfeiting measures that shows only a unique number and a photograph while all other information is provided through another channel such as a QR code.

by fy20 5y ago

fabian2k 5y ago

Without personal data you cannot verify that the code belongs to the person showing it.

krona 5y ago
Unless the code contains biometrics (even just a photo) you're not 'verifying' anything without some other way to verify it.
- sgtfrankieboy 5y ago
  They verify it against the persons ID card which has a photo of them by matching up the name.
- fabian2k 5y ago
  The code contains your name and date of birth. The photo is on your ID card/passport you show along with the QR code. So the person checking you can verify that the names and date of birth match, and that the photo in your ID could reasonably be you.
- jeroenhd 5y ago
  The PII is in there so you can verify against some kind of ID. The QR is not intended to be valid without also checking the accompanying ID. They could've gone the lazy route and stored your SSN (or similar).

zaarn 5y ago

The German and Swiss/Austrian apps are all open source (and I think all three also have reproducible builds, you can verify what you installed, I know this is true of the official German apps involved). If you use a non-gov third party app that's on you I guess, not much from stopping you doing that since the QR code can be handled by any app. Otherwise, some personal data will be required, since the person checking your code (like a bouncer) must be able to verify that against your ID card.

dannyw 5y ago
If people are using apps, there are zero knowledge proofs that can be used here . The bouncer at the night club don't need to know how many doses you had or where you tested negative, as that has no impact by the legislation
- csunbird 5y ago
  The bouncer will also not check your ID as long as the barcode scanner says it is a valid certificate. He just does not care at all.
  - gillesjacobs 5y ago
    But it's trivially readable and collectable anyway.
- zaarn 5y ago
  It does actually, because not all vaccines require the same amount of doses and if you were infected, that's a completely different story too. Different cities also have different timespans after infection or dose after which you can start all the fun activities (and sometimes it matters per activity). For example, the nightclub might require 7 days after the last required dose for vaccination or 14 days after the last negative test after an infection, but other venues might only require 7 days after the last negative test and 14 days after the last dose. In addition to that, legislation may change, so your time limits and dosage limits now all change and future vaccinations might require more doses. Either way, the bouncer doesn't get to see any of this. They only see your name, check your ID if it's the same name (which they have to do anyway to check you're 16 for alcoholic beverages and curfew) and then wave you through. The apps I've seen in use by people who check the vaccination QR code only give you an OK or NOT OK signal, once you've setup the type of limits you have to obey.

user-the-name 5y ago

It contains your name. That seems like the absolute minimum personal information you could possibly include.

bloak 5y ago
It seems to contain name and date of birth. Would it be better if it contained the person's ID card number, assuming they have such a thing?
- pmontra 5y ago
  Id cards expire and are replaced by new ones with new ids. In my country they expire after 10 years, on the birthday. So about 7 / (365 * 10) = 0.002 % of id cards expired this week here, or 115k cards. I'd store only the name and birthday and let officers check the id card with the usual procedure.
  - bloak 5y ago
    It would presumably not be a problem for people to regenerate their QR code when they replace their ID card. They have to regenerate it every day or so anyway. (The QR code in the article expires after 48 hours.) Linking to an ID card number has the slight advantage that the ID card number is unique whereas several people can have the same name and date of birth. It doesn't really help with keeping the name or date of birth private because in practice those things are printed on the ID card which has to be shown together with the QR code. The ideal would be to reveal only the information that is needed in a particular situation. For example, if you're trying to get into an Austrian pub all that's needed is the photograph of the face and confirmation that the person with that face is over 18 and vaccinated. Though in practice people like pub bouncers are not very good at checking faces so having a physical ID card that is hard to counterfeit is an important part of the security. That line of reasoning suggests that what's needed is an ID card with banknote-style anti-counterfeiting measures that shows only a unique number and a photograph while all other information is provided through another channel such as a QR code.