4 ms·

It contains your name. That seems like the absolute minimum personal information you could possibly include.

bloak 5y ago
It seems to contain name and date of birth. Would it be better if it contained the person's ID card number, assuming they have such a thing?
- pmontra 5y ago
  Id cards expire and are replaced by new ones with new ids. In my country they expire after 10 years, on the birthday. So about 7 / (365 * 10) = 0.002 % of id cards expired this week here, or 115k cards. I'd store only the name and birthday and let officers check the id card with the usual procedure.
  - bloak 5y ago
    It would presumably not be a problem for people to regenerate their QR code when they replace their ID card. They have to regenerate it every day or so anyway. (The QR code in the article expires after 48 hours.) Linking to an ID card number has the slight advantage that the ID card number is unique whereas several people can have the same name and date of birth. It doesn't really help with keeping the name or date of birth private because in practice those things are printed on the ID card which has to be shown together with the QR code. The ideal would be to reveal only the information that is needed in a particular situation. For example, if you're trying to get into an Austrian pub all that's needed is the photograph of the face and confirmation that the person with that face is over 18 and vaccinated. Though in practice people like pub bouncers are not very good at checking faces so having a physical ID card that is hard to counterfeit is an important part of the security. That line of reasoning suggests that what's needed is an ID card with banknote-style anti-counterfeiting measures that shows only a unique number and a photograph while all other information is provided through another channel such as a QR code.
    - pmontra 5y ago
      I generally agree with what you wrote. However: > It would presumably not be a problem for people to regenerate their QR code when they replace their ID card. They have to regenerate it every day or so anyway. (The QR code in the article expires after 48 hours.) A not small number of those 115k people per week are elders without a smartphone or no digital abilities except video calling their children and nephews. Luckily it seems that in my country we'll be able to get a permanent QR code (paper or plastic, don't know.) I'm thinking about getting that one instead of the digital certificate: one less app, no worries about batteries and if it worked for my passport, id card and driver license it will be OK for my covid pass too.
      - pmontra 5y ago
        Autoreply: I got the code to download the certificate. A one page PDF or a PNG with only the QR code. Printed, folded and stored inside my wallet.
nomercy400 5y ago
It links 'name' to 'vaccination details'. I can imagine you would want to prevent that link. If you cannot hide 'name', because you need that for identification, you could hide 'vaccination details', for example by linking 'name' to 'is properly vaccinated?'. No need to specify what vaccin gotten where and when in how many doses. The signed-certificate part could still be present, as a tampering protection.
- squarefoot 5y ago
  > I can imagine you would want to prevent that link. This very likely is a subjective matter. I absolutely would want my name to be associated to my vaccination details, and will certainly do when it will be my turn to get the shot (still have high antibodies level after catching symptomatic Covid months ago).
  - nomercy400 5y ago
    Yes, I can understand for registering who has been vaccinated and when, it is necessary to combine these pieces of data. The part I am worried about is, do I want to give anybody and everybody access to this information, or only a select group which is in my control. Do I want to share my full Google/Facebook account, with password, with everybody that I show a QR-code to (for example a 'Login with Facebook' button), or do I want to be selective and only allow for 'verify and give permission to access part of profile'? Do I want to share my full contacts list with a random app I installed from an app store, just because I started it? Or do I want to be selective and deny 'access to contacts' for a game which has no business looking through my contacts.
    - squarefoot 5y ago
      I understand your point. It's probably a grey area in which the need for surrounding people to feel safe outweighs the risk of someone accessing this data and using them against us. Also, any discrimination based on that data would also be against the law. Having been infected with Covid19, and subsequently hospitalized for nearly 2 months in a Covid ward after a road accident [0], I've seen scenes of death and panic, but also negligence from denialists, therefore I believe it's our responsibility to be as much clear as possible with information so that they know what is going on and can feel safe thanks to correct information and not by ignoring the problem. 0: (I beat symptomatic Covid at home, then tested negative, then after 3 weeks had a road accident and the mandatory ER triage swab told I was positive again, although this time with no symptoms).

It seems to contain name and date of birth. Would it be better if it contained the person's ID card number, assuming they have such a thing?

pmontra 5y ago
Id cards expire and are replaced by new ones with new ids. In my country they expire after 10 years, on the birthday. So about 7 / (365 * 10) = 0.002 % of id cards expired this week here, or 115k cards. I'd store only the name and birthday and let officers check the id card with the usual procedure.
- bloak 5y ago
  It would presumably not be a problem for people to regenerate their QR code when they replace their ID card. They have to regenerate it every day or so anyway. (The QR code in the article expires after 48 hours.) Linking to an ID card number has the slight advantage that the ID card number is unique whereas several people can have the same name and date of birth. It doesn't really help with keeping the name or date of birth private because in practice those things are printed on the ID card which has to be shown together with the QR code. The ideal would be to reveal only the information that is needed in a particular situation. For example, if you're trying to get into an Austrian pub all that's needed is the photograph of the face and confirmation that the person with that face is over 18 and vaccinated. Though in practice people like pub bouncers are not very good at checking faces so having a physical ID card that is hard to counterfeit is an important part of the security. That line of reasoning suggests that what's needed is an ID card with banknote-style anti-counterfeiting measures that shows only a unique number and a photograph while all other information is provided through another channel such as a QR code.
  - pmontra 5y ago
    I generally agree with what you wrote. However: > It would presumably not be a problem for people to regenerate their QR code when they replace their ID card. They have to regenerate it every day or so anyway. (The QR code in the article expires after 48 hours.) A not small number of those 115k people per week are elders without a smartphone or no digital abilities except video calling their children and nephews. Luckily it seems that in my country we'll be able to get a permanent QR code (paper or plastic, don't know.) I'm thinking about getting that one instead of the digital certificate: one less app, no worries about batteries and if it worked for my passport, id card and driver license it will be OK for my covid pass too.
    - pmontra 5y ago
      Autoreply: I got the code to download the certificate. A one page PDF or a PNG with only the QR code. Printed, folded and stored inside my wallet.

nomercy400 5y ago

It links 'name' to 'vaccination details'. I can imagine you would want to prevent that link. If you cannot hide 'name', because you need that for identification, you could hide 'vaccination details', for example by linking 'name' to 'is properly vaccinated?'. No need to specify what vaccin gotten where and when in how many doses. The signed-certificate part could still be present, as a tampering protection.

squarefoot 5y ago
> I can imagine you would want to prevent that link. This very likely is a subjective matter. I absolutely would want my name to be associated to my vaccination details, and will certainly do when it will be my turn to get the shot (still have high antibodies level after catching symptomatic Covid months ago).
- nomercy400 5y ago
  Yes, I can understand for registering who has been vaccinated and when, it is necessary to combine these pieces of data. The part I am worried about is, do I want to give anybody and everybody access to this information, or only a select group which is in my control. Do I want to share my full Google/Facebook account, with password, with everybody that I show a QR-code to (for example a 'Login with Facebook' button), or do I want to be selective and only allow for 'verify and give permission to access part of profile'? Do I want to share my full contacts list with a random app I installed from an app store, just because I started it? Or do I want to be selective and deny 'access to contacts' for a game which has no business looking through my contacts.
  - squarefoot 5y ago
    I understand your point. It's probably a grey area in which the need for surrounding people to feel safe outweighs the risk of someone accessing this data and using them against us. Also, any discrimination based on that data would also be against the law. Having been infected with Covid19, and subsequently hospitalized for nearly 2 months in a Covid ward after a road accident [0], I've seen scenes of death and panic, but also negligence from denialists, therefore I believe it's our responsibility to be as much clear as possible with information so that they know what is going on and can feel safe thanks to correct information and not by ignoring the problem. 0: (I beat symptomatic Covid at home, then tested negative, then after 3 weeks had a road accident and the mandatory ER triage swab told I was positive again, although this time with no symptoms).