5 ms·

It is cryptographically signed, so creating your own QR code that would be accepted by the apps would be difficult without the signing key. Even ignoring that

It is cryptographically signed, so creating your own QR code that would be accepted by the apps would be difficult without the signing key. Even ignoring that though: including both the ID and detail allows it to work both ways. In official situations (e.g. at a country border) you might be able to validate against a server, but the local nightclub probably doesn't have access to a validation server.

samuel 5y ago
You are right with regards to the technical side, but there is an important detail to note. Those certificates only can be used for travelling between eu states. Any other use is currently banned and would need to ammend the EU regulation. So the local nightclub cann't(legally) check these certificates.
- fabian2k 5y ago
  I don't think that is true, at least not universally in all EU countries. And here in Germany they're allowed to check the old paper vaccination pass, so there is no reason to think they're not allowed to check the digital version.
  - samuel 5y ago
    As far I have been told by the national authorities of my country, that's the case. I haven't read the whole regulation but this paragraph I think it addresses it: This Regulation establishes the legal ground for the processing of personal data within the meaning of point (c) of Article 6(1) and point (g) of Article 9(2) of Regulation (EU) 2016/679, necessary for the issuance and verification of the interoperable certificates provided for in this Regulation. It does not regulate the processing of personal data related to the documentation of a vaccination, a test or a recovery event for other purposes, such as for the purposes of pharmacovigilance or for the maintenance of individual personal health records Member States may process personal data for other purposes, if the legal basis for the processing of such data for other purposes, including the related retention periods, is provided for in national law, which must comply with Union data protection law and the principles of effectiveness, necessity and proportionality, and should contain provisions clearly identifying the scope and extent of the processing, the specific purpose involved, the categories of entity that can verify the certificate as well as the relevant safeguards to prevent discrimination and abuse, taking into account the risks to the rights and freedoms of data subjects So, if my interpretation is right, a national law backing those "secondary" uses must be in place.
    - the_mitsuhiko 5y ago
      And it is in a few countries. Austria and Germany included.
- mstolpm 5y ago
  Are you sure? Isn't https://greencheck.gv.at/ https://greencheck.gv.at/ a tool for private nightclubs, event managers, hospitality and so on to check the "grüner Pass" QR-Code certificate of their guests in Austria for accordance with their 3G rules (Genesen (recovered), Geimpft (vacinated), Getested (tested))? Am I missing something there?
  - samuel 5y ago
    That's interesting, but I guess it needs some legal support at the Austrian level, because the regulation doesn't prescribe those uses for the certificate.
    - the_mitsuhiko 5y ago
      There is a law in Austria for this.
  - ajsnigrutin 5y ago
    In slovenia, clubs/restaurants/etc. are not allowed to check any vaccination/test/recovered data (you still need to be one of those, they can ask if you are, but are not allowed to verify). Only health inspectors can do so, and they do random checks. Honestly, I don't know how this will end, because people are really fed up with this situation and all the lies from the government, and a club full of drunk people vs a few inspectors won't end well.
    - franga2000 5y ago
      I'm from Slovenia as well and get asked to show my ID and vaccination slip regularly. If I understand correctly, one of the pandemic laws requires them to verify, but the Information Commissioner's Office has countered that with one of their classic "well yes, but actually no" opinions saying that they're not actually allowed to demand that kind of information. What "demand" means here, of course, doesn't seem to be defined well, so I'm guessing they're still allowed to refuse service if you don't show them some proof. Or maybe all of that has changed in the 20h since I was last at a bar - the speed at which the current government is making seemingly entirely random changes to the covid rules is genuinely impressive.
- _ZeD_ 5y ago
  Each state can create (and have created) additional restriction. For example here in Italy I need the green pass to go to a wedding next week
deleted 5y ago
[deleted]
IshKebab 5y ago
You could just copy someone else's code though, unless they also check photo ID or something (seems unlikely for a pub).
- Dagonfly 5y ago
  Yes. This is officially acknowledged (at least in the german CovPass app) and is a feature. You are able to "manage" multiple passes in said app. This is intended for accessibility (elderly partners with a shared smartphone, legal guardians for people with disabilities). And yes, in theory at least the name should be crosschecked with a form of ID. It's just a digital copy of a legal document, you could easily borrow or copy the paper version from someone else as well.

samuel 5y ago

You are right with regards to the technical side, but there is an important detail to note. Those certificates only can be used for travelling between eu states. Any other use is currently banned and would need to ammend the EU regulation. So the local nightclub cann't(legally) check these certificates.

fabian2k 5y ago
I don't think that is true, at least not universally in all EU countries. And here in Germany they're allowed to check the old paper vaccination pass, so there is no reason to think they're not allowed to check the digital version.
- samuel 5y ago
  As far I have been told by the national authorities of my country, that's the case. I haven't read the whole regulation but this paragraph I think it addresses it: This Regulation establishes the legal ground for the processing of personal data within the meaning of point (c) of Article 6(1) and point (g) of Article 9(2) of Regulation (EU) 2016/679, necessary for the issuance and verification of the interoperable certificates provided for in this Regulation. It does not regulate the processing of personal data related to the documentation of a vaccination, a test or a recovery event for other purposes, such as for the purposes of pharmacovigilance or for the maintenance of individual personal health records Member States may process personal data for other purposes, if the legal basis for the processing of such data for other purposes, including the related retention periods, is provided for in national law, which must comply with Union data protection law and the principles of effectiveness, necessity and proportionality, and should contain provisions clearly identifying the scope and extent of the processing, the specific purpose involved, the categories of entity that can verify the certificate as well as the relevant safeguards to prevent discrimination and abuse, taking into account the risks to the rights and freedoms of data subjects So, if my interpretation is right, a national law backing those "secondary" uses must be in place.
  - the_mitsuhiko 5y ago
    And it is in a few countries. Austria and Germany included.
mstolpm 5y ago
Are you sure? Isn't https://greencheck.gv.at/ https://greencheck.gv.at/ a tool for private nightclubs, event managers, hospitality and so on to check the "grüner Pass" QR-Code certificate of their guests in Austria for accordance with their 3G rules (Genesen (recovered), Geimpft (vacinated), Getested (tested))? Am I missing something there?
- samuel 5y ago
  That's interesting, but I guess it needs some legal support at the Austrian level, because the regulation doesn't prescribe those uses for the certificate.
  - the_mitsuhiko 5y ago
    There is a law in Austria for this.
- ajsnigrutin 5y ago
  In slovenia, clubs/restaurants/etc. are not allowed to check any vaccination/test/recovered data (you still need to be one of those, they can ask if you are, but are not allowed to verify). Only health inspectors can do so, and they do random checks. Honestly, I don't know how this will end, because people are really fed up with this situation and all the lies from the government, and a club full of drunk people vs a few inspectors won't end well.
  - franga2000 5y ago
    I'm from Slovenia as well and get asked to show my ID and vaccination slip regularly. If I understand correctly, one of the pandemic laws requires them to verify, but the Information Commissioner's Office has countered that with one of their classic "well yes, but actually no" opinions saying that they're not actually allowed to demand that kind of information. What "demand" means here, of course, doesn't seem to be defined well, so I'm guessing they're still allowed to refuse service if you don't show them some proof. Or maybe all of that has changed in the 20h since I was last at a bar - the speed at which the current government is making seemingly entirely random changes to the covid rules is genuinely impressive.
_ZeD_ 5y ago
Each state can create (and have created) additional restriction. For example here in Italy I need the green pass to go to a wedding next week

deleted 5y ago

[deleted]

IshKebab 5y ago

You could just copy someone else's code though, unless they also check photo ID or something (seems unlikely for a pub).

Dagonfly 5y ago
Yes. This is officially acknowledged (at least in the german CovPass app) and is a feature. You are able to "manage" multiple passes in said app. This is intended for accessibility (elderly partners with a shared smartphone, legal guardians for people with disabilities). And yes, in theory at least the name should be crosschecked with a form of ID. It's just a digital copy of a legal document, you could easily borrow or copy the paper version from someone else as well.