11 ms·

Danish teens just took screenshot of their QR code and shared it with friend. It only valid for an hour, the your friend needs to send you a new one, but it was

Danish teens just took screenshot of their QR code and shared it with friend. It only valid for an hour, the your friend needs to send you a new one, but it was enough to get in to the gym and stuff like that. Some even sold screenshots on Facebook. Now the app have all sorts of cool colour effects when you tilt your phone.

intellirogue 5y ago
Does the Danish one not contain name etc? The idea was that you'd be comparing that against photo ID.
- ziihrs 5y ago
  The Danish app gives the user two options. You can either show one that contains name and DOB or one that doesn't. It's not clear (to me) when you are supposed to show the code with additional information, and I haven't been asked to do so.
  - Svip 5y ago
    > It's not clear (to me) when you are supposed to show the code with additional information, and I haven't been asked to do so. The option with more data is only for official situations, like border control. That version is also in English and French.
    - colde 5y ago
      No, actually the danish app has 3 versions. 1. No personal information at all. It only says valid or not valid. 2. Name and date of birth 3. Foreign travel, with name, date of birth as well as information about test type or vaccination type etc.
    - dolmen 5y ago
      The French app (Tous AntiCovid) shows my name along with the 2D-DOC (QR code).
- mrweasel 5y ago
  It does not, well it does, but you have to click to unhide it. There isn’t a Danish ID withou a SSN on it, and that’s secret. There where some resistance to allow resturant and other venues like that see your name and SSN. So no, due to privacy, there no nane show by default.
Yaina 5y ago
I can't find any articles that either talk about "danish teens" or "sold screenshots on facebook". Do you have any sources you can link? The QR codes design is pretty sound, so as long as they are validated correctly and checked against an ID this should not be possible.
- ziihrs 5y ago
  This one [1] doesn't specifically mention facebook. You can run the text through a translator yourself, but the main quote: "Henover weekenden har vi allerede set de første eksempler på danskere, der sælger QR-koder i lukkede grupper på sociale medier" roughly translates to: "During the weekend we have experienced the first examples of people selling QR codes in closed groups on social media". Edit: This article [2] is about 6 teens being charged with forgery of the pass. [1]: https://www.inputmag.dk/snyd-med-coronapas-er-dokumentfalsk/ https://www.inputmag.dk/snyd-med-coronapas-er-dokumentfalsk/ [2]: https://www.dr.dk/nyheder/regionale/oestjylland/seks-gymnasieelever-sigtet-forfalske-coronatest-de-ville-frygtelig https://www.dr.dk/nyheder/regionale/oestjylland/seks-gymnasi...
  - CaptainZapp 5y ago
    What I don't quite get is that the certificate is linked to me personally. Notably, it contains my full name, including middle name, and date of birth. It notably states that it's only valid together with an identification document. It's possible, of course, that gyms and nightclubs don't check very thoroughly, but I certainly wouldn't risk passing a border with a fake certificate.
    - detaro 5y ago
      Yes, it's fairly obvious that none of this works if you don't verify that the identity matches the ID (the yellow paper pass won't either!), but you can nevertheless expect that plenty places won't do that. Or even just see "app shows the right color and a QR code", there was an embarrassing amount of media coverage of the fact that if you set the system time in the future the German app will show the "right" color even if someone hasn't waited long enough after their vaccination... which of course has zero effect on if validation succeeds or not.
jeffrallen 5y ago
The Swiss verifier app reminds you in big letters that it's only valid with photo ID.
deleted 5y ago
[deleted]
est 5y ago
> Now the app have all sorts of cool colour effects when you tilt your phone. Any video for that?
kag0 5y ago
A two way handshake/challenge would be the ideal way to solve that. ie. the patient would scan a qr code (containing a nonce) on the checkpoint, and include that number in the token which was then shown to the checkpoint.

intellirogue 5y ago

Does the Danish one not contain name etc? The idea was that you'd be comparing that against photo ID.

ziihrs 5y ago
The Danish app gives the user two options. You can either show one that contains name and DOB or one that doesn't. It's not clear (to me) when you are supposed to show the code with additional information, and I haven't been asked to do so.
- Svip 5y ago
  > It's not clear (to me) when you are supposed to show the code with additional information, and I haven't been asked to do so. The option with more data is only for official situations, like border control. That version is also in English and French.
  - colde 5y ago
    No, actually the danish app has 3 versions. 1. No personal information at all. It only says valid or not valid. 2. Name and date of birth 3. Foreign travel, with name, date of birth as well as information about test type or vaccination type etc.
  - dolmen 5y ago
    The French app (Tous AntiCovid) shows my name along with the 2D-DOC (QR code).
mrweasel 5y ago
It does not, well it does, but you have to click to unhide it. There isn’t a Danish ID withou a SSN on it, and that’s secret. There where some resistance to allow resturant and other venues like that see your name and SSN. So no, due to privacy, there no nane show by default.

Yaina 5y ago

I can't find any articles that either talk about "danish teens" or "sold screenshots on facebook". Do you have any sources you can link? The QR codes design is pretty sound, so as long as they are validated correctly and checked against an ID this should not be possible.

ziihrs 5y ago
This one [1] doesn't specifically mention facebook. You can run the text through a translator yourself, but the main quote: "Henover weekenden har vi allerede set de første eksempler på danskere, der sælger QR-koder i lukkede grupper på sociale medier" roughly translates to: "During the weekend we have experienced the first examples of people selling QR codes in closed groups on social media". Edit: This article [2] is about 6 teens being charged with forgery of the pass. [1]: https://www.inputmag.dk/snyd-med-coronapas-er-dokumentfalsk/ https://www.inputmag.dk/snyd-med-coronapas-er-dokumentfalsk/ [2]: https://www.dr.dk/nyheder/regionale/oestjylland/seks-gymnasieelever-sigtet-forfalske-coronatest-de-ville-frygtelig https://www.dr.dk/nyheder/regionale/oestjylland/seks-gymnasi...
- CaptainZapp 5y ago
  What I don't quite get is that the certificate is linked to me personally. Notably, it contains my full name, including middle name, and date of birth. It notably states that it's only valid together with an identification document. It's possible, of course, that gyms and nightclubs don't check very thoroughly, but I certainly wouldn't risk passing a border with a fake certificate.
  - detaro 5y ago
    Yes, it's fairly obvious that none of this works if you don't verify that the identity matches the ID (the yellow paper pass won't either!), but you can nevertheless expect that plenty places won't do that. Or even just see "app shows the right color and a QR code", there was an embarrassing amount of media coverage of the fact that if you set the system time in the future the German app will show the "right" color even if someone hasn't waited long enough after their vaccination... which of course has zero effect on if validation succeeds or not.

jeffrallen 5y ago

The Swiss verifier app reminds you in big letters that it's only valid with photo ID.

deleted 5y ago

[deleted]

est 5y ago

> Now the app have all sorts of cool colour effects when you tilt your phone. Any video for that?

kag0 5y ago

A two way handshake/challenge would be the ideal way to solve that. ie. the patient would scan a qr code (containing a nonce) on the checkpoint, and include that number in the token which was then shown to the checkpoint.