10 ms·

Given the structure seems simple, what would prevent someone making their own QR with fake data and a randomly selected ID number? If the answer is that a serv

by billpg 5y ago

Given the structure seems simple, what would prevent someone making their own QR with fake data and a randomly selected ID number? If the answer is that a service can validate the data, then why not just have the ID value if its all going to be on a server?

DangerousPie 5y ago
It's signed.
- deleted 5y ago
  [deleted]
nousermane 5y ago
Digital signature would prevent that (assuming scanner does a good job at verifying one). "Looking at the hexdump" section of TFA, last 64 bytes (cyan-coloured). On top of that, online verification (e.g. by certificate ID) might be possible, too.
- thierryzoller 5y ago
  Yeah, didn't fine the hash in that JSON
asutekku 5y ago
Most likely because it’s not 100% guaranteed the server will be accessible, as then having that data will be a good backup system.
kawsper 5y ago
I guess the certificate id is the id value you speak of. It would be cool if the whole thing was signed by a government public key, then you could verify it offline.
- fabian2k 5y ago
  It is. This is signed by the relevant health authority in each country as far as I understand. And the official apps for reading them can verify the signature offline.
eivarv 5y ago
I think at least partial offline-support was a requirement.
mrweasel 5y ago
Danish teens just took screenshot of their QR code and shared it with friend. It only valid for an hour, the your friend needs to send you a new one, but it was enough to get in to the gym and stuff like that. Some even sold screenshots on Facebook. Now the app have all sorts of cool colour effects when you tilt your phone.
- intellirogue 5y ago
  Does the Danish one not contain name etc? The idea was that you'd be comparing that against photo ID.
  - ziihrs 5y ago
    The Danish app gives the user two options. You can either show one that contains name and DOB or one that doesn't. It's not clear (to me) when you are supposed to show the code with additional information, and I haven't been asked to do so.
    - Svip 5y ago
      > It's not clear (to me) when you are supposed to show the code with additional information, and I haven't been asked to do so. The option with more data is only for official situations, like border control. That version is also in English and French.
      - colde 5y ago
        No, actually the danish app has 3 versions. 1. No personal information at all. It only says valid or not valid. 2. Name and date of birth 3. Foreign travel, with name, date of birth as well as information about test type or vaccination type etc.
      - dolmen 5y ago
        The French app (Tous AntiCovid) shows my name along with the 2D-DOC (QR code).
  - 5y ago
intellirogue 5y ago
It is cryptographically signed, so creating your own QR code that would be accepted by the apps would be difficult without the signing key. Even ignoring that though: including both the ID and detail allows it to work both ways. In official situations (e.g. at a country border) you might be able to validate against a server, but the local nightclub probably doesn't have access to a validation server.
- samuel 5y ago
  You are right with regards to the technical side, but there is an important detail to note. Those certificates only can be used for travelling between eu states. Any other use is currently banned and would need to ammend the EU regulation. So the local nightclub cann't(legally) check these certificates.
  - fabian2k 5y ago
    I don't think that is true, at least not universally in all EU countries. And here in Germany they're allowed to check the old paper vaccination pass, so there is no reason to think they're not allowed to check the digital version.
    - samuel 5y ago
      As far I have been told by the national authorities of my country, that's the case. I haven't read the whole regulation but this paragraph I think it addresses it: This Regulation establishes the legal ground for the processing of personal data within the meaning of point (c) of Article 6(1) and point (g) of Article 9(2) of Regulation (EU) 2016/679, necessary for the issuance and verification of the interoperable certificates provided for in this Regulation. It does not regulate the processing of personal data related to the documentation of a vaccination, a test or a recovery event for other purposes, such as for the purposes of pharmacovigilance or for the maintenance of individual personal health records Member States may process personal data for other purposes, if the legal basis for the processing of such data for other purposes, including the related retention periods, is provided for in national law, which must comply with Union data protection law and the principles of effectiveness, necessity and proportionality, and should contain provisions clearly identifying the scope and extent of the processing, the specific purpose involved, the categories of entity that can verify the certificate as well as the relevant safeguards to prevent discrimination and abuse, taking into account the risks to the rights and freedoms of data subjects So, if my interpretation is right, a national law backing those "secondary" uses must be in place.

by billpg 5y ago

DangerousPie 5y ago

It's signed.

deleted 5y ago
[deleted]

nousermane 5y ago

Digital signature would prevent that (assuming scanner does a good job at verifying one). "Looking at the hexdump" section of TFA, last 64 bytes (cyan-coloured). On top of that, online verification (e.g. by certificate ID) might be possible, too.

thierryzoller 5y ago
Yeah, didn't fine the hash in that JSON

asutekku 5y ago

Most likely because it’s not 100% guaranteed the server will be accessible, as then having that data will be a good backup system.

kawsper 5y ago

I guess the certificate id is the id value you speak of. It would be cool if the whole thing was signed by a government public key, then you could verify it offline.

fabian2k 5y ago
It is. This is signed by the relevant health authority in each country as far as I understand. And the official apps for reading them can verify the signature offline.

eivarv 5y ago

I think at least partial offline-support was a requirement.

mrweasel 5y ago

Danish teens just took screenshot of their QR code and shared it with friend. It only valid for an hour, the your friend needs to send you a new one, but it was enough to get in to the gym and stuff like that. Some even sold screenshots on Facebook. Now the app have all sorts of cool colour effects when you tilt your phone.

intellirogue 5y ago
Does the Danish one not contain name etc? The idea was that you'd be comparing that against photo ID.
- ziihrs 5y ago
  The Danish app gives the user two options. You can either show one that contains name and DOB or one that doesn't. It's not clear (to me) when you are supposed to show the code with additional information, and I haven't been asked to do so.
  - Svip 5y ago
    > It's not clear (to me) when you are supposed to show the code with additional information, and I haven't been asked to do so. The option with more data is only for official situations, like border control. That version is also in English and French.
    - colde 5y ago
      No, actually the danish app has 3 versions. 1. No personal information at all. It only says valid or not valid. 2. Name and date of birth 3. Foreign travel, with name, date of birth as well as information about test type or vaccination type etc.
    - dolmen 5y ago
      The French app (Tous AntiCovid) shows my name along with the 2D-DOC (QR code).
- 5y ago

intellirogue 5y ago

It is cryptographically signed, so creating your own QR code that would be accepted by the apps would be difficult without the signing key. Even ignoring that though: including both the ID and detail allows it to work both ways. In official situations (e.g. at a country border) you might be able to validate against a server, but the local nightclub probably doesn't have access to a validation server.

samuel 5y ago
You are right with regards to the technical side, but there is an important detail to note. Those certificates only can be used for travelling between eu states. Any other use is currently banned and would need to ammend the EU regulation. So the local nightclub cann't(legally) check these certificates.
- fabian2k 5y ago
  I don't think that is true, at least not universally in all EU countries. And here in Germany they're allowed to check the old paper vaccination pass, so there is no reason to think they're not allowed to check the digital version.
  - samuel 5y ago
    As far I have been told by the national authorities of my country, that's the case. I haven't read the whole regulation but this paragraph I think it addresses it: This Regulation establishes the legal ground for the processing of personal data within the meaning of point (c) of Article 6(1) and point (g) of Article 9(2) of Regulation (EU) 2016/679, necessary for the issuance and verification of the interoperable certificates provided for in this Regulation. It does not regulate the processing of personal data related to the documentation of a vaccination, a test or a recovery event for other purposes, such as for the purposes of pharmacovigilance or for the maintenance of individual personal health records Member States may process personal data for other purposes, if the legal basis for the processing of such data for other purposes, including the related retention periods, is provided for in national law, which must comply with Union data protection law and the principles of effectiveness, necessity and proportionality, and should contain provisions clearly identifying the scope and extent of the processing, the specific purpose involved, the categories of entity that can verify the certificate as well as the relevant safeguards to prevent discrimination and abuse, taking into account the risks to the rights and freedoms of data subjects So, if my interpretation is right, a national law backing those "secondary" uses must be in place.