8 ms·

This one [1] doesn't specifically mention facebook. You can run the text through a translator yourself, but the main quote: "Henover weekenden har vi allerede

by ziihrs 5y ago

This one [1] doesn't specifically mention facebook. You can run the text through a translator yourself, but the main quote: "Henover weekenden har vi allerede set de første eksempler på danskere, der sælger QR-koder i lukkede grupper på sociale medier" roughly translates to: "During the weekend we have experienced the first examples of people selling QR codes in closed groups on social media". Edit: This article [2] is about 6 teens being charged with forgery of the pass. [1]: https://www.inputmag.dk/snyd-med-coronapas-er-dokumentfalsk/ https://www.inputmag.dk/snyd-med-coronapas-er-dokumentfalsk/ [2]: https://www.dr.dk/nyheder/regionale/oestjylland/seks-gymnasieelever-sigtet-forfalske-coronatest-de-ville-frygtelig https://www.dr.dk/nyheder/regionale/oestjylland/seks-gymnasi...

CaptainZapp 5y ago
What I don't quite get is that the certificate is linked to me personally. Notably, it contains my full name, including middle name, and date of birth. It notably states that it's only valid together with an identification document. It's possible, of course, that gyms and nightclubs don't check very thoroughly, but I certainly wouldn't risk passing a border with a fake certificate.
- detaro 5y ago
  Yes, it's fairly obvious that none of this works if you don't verify that the identity matches the ID (the yellow paper pass won't either!), but you can nevertheless expect that plenty places won't do that. Or even just see "app shows the right color and a QR code", there was an embarrassing amount of media coverage of the fact that if you set the system time in the future the German app will show the "right" color even if someone hasn't waited long enough after their vaccination... which of course has zero effect on if validation succeeds or not.
  - Yaina 5y ago
    That's so strange, and almost suggests that the people implementing these apps don't understand the security model behind these codes. Any information on the users phone can 100% not be trusted. It should just show the QR code. On the other hand the scanning App has to validate the signature, check if the dates are correct and display a big info that the QR is only valid if the name is the same as the one on a presented ID. Maybe this should have been a design requirement from the EU spec.
    - logifail 5y ago
      > the people implementing these apps don't understand the security model behind these codes I'm not entirely sure that the people implementing the policies understand the 'herd immunity' model, nor the by now fairly comprehensive statistical data on who is and isn't at significant risk from Covid19.[0] Q: If a healthy 18 year-old chooses to attempt to go to a nightclub unvaccinated, who exactly is put at risk from this? [0] https://www.ons.gov.uk/aboutus/transparencyandgovernance/freedomofinformationfoi/averageageofthosewhohaddiedwithcovid19 https://www.ons.gov.uk/aboutus/transparencyandgovernance/fre...
      - razius 5y ago
        Tbh I don't think the goal is risk prevention, if you take that into consideration the app works perfectly.
      - aj3 5y ago
        A: non-immune people this 18-year comes in contact with later
        logifail 5y ago
        Public health bodies will struggle to convince healthy young people to take a vaccine that gives them very little direct benefit. "Children's risk of severe disease from Covid is tiny, deaths are extremely rare and have only occurred in UK children with profound underlying and life-limiting conditions. The direct benefits to them of vaccination would be low."[0] [0] https://www.bbc.com/news/health-57496074 https://www.bbc.com/news/health-57496074
        aj3 5y ago
        we live in society
        logifail 5y ago
        > we live in society Insert quote from Margaret Thatcher from 1987?[0] More seriously, there is no [longer] one approved way to live, thank goodness. We rightly demand that larger / mainstream groups respect minorities. At what point is it OK to stop listening or respecting minority views, and who gets to decide that? [0] "you know, there's no such thing as society. There are individual men and women and there are families" https://www.theguardian.com/politics/2013/apr/08/margaret-thatcher-quotes https://www.theguardian.com/politics/2013/apr/08/margaret-th...
  - vbezhenar 5y ago
    The only thing you should verify is photo. Because you can't really verify an ID either (other than checking a photo). So QR code should just encode a photo URL (and sign it) and QR scanner should display that photo.
    - distances 5y ago
      That would mean some centralized data store. I'd be against such a measure. Current approach is device only, with very limited risk of data breach.
      - vbezhenar 5y ago
        May be it's possible to encode some kind of low-res compressed image in QR-code? I did not run the math. Or may be it's even possible to scan photo from smartphone display, run some kind of image hash and compare it to hash inside QR-code. This way it would be possible to work completely offline. I think it's called perceptual hashing, though I'm not sure if it's cryptographically secure.
        dolmen 5y ago
        The issue is not about compression (well, it could be). It is is about the authority that delivers the QR code: if it doesn't have the data (photo) it can't produce the QR code. For example, I have been vaccinated in April, long before the green pass appeared. No one took my picture at that time (and that's not the task of doctors to take pictures and store them in central database, for privacy reasons). I still deserves a QR-code to go out of home. In France we have ID cards which can link a photo to the name and birth date. So encoding name and birth date in the QR-code are enough.
    - bonzini 5y ago
      Currently the image is retrieved via a very powerful distributed database with embedded authentication, consisting of millions of wallets and handbags. The authentication key is the name and date of birth, and is printed on both the pass and the medium that stores the image.
  - the_mitsuhiko 5y ago
    There is not even an app here, people just show QR codes from wherever they have stored them.
- neither_color 5y ago
  I don't give my name and date of birth to walk into a store or restaurant so why should this QR code force you to? Presumably all you want to know about this person is whether or not they are a toxic, contagious, diseased biohazard to you; everything else is none of your business.
  - _Microft 5y ago
    If someone is showing someone else's proof of vaccination while they are not vaccinated, they actually might be a threat. The QR code by itself is not proof of anything until you have verified that it actually belongs to the person showing it. That's where the ID comes in.
    - neither_color 5y ago
      Just out of curiosity, what is the minimum net improvement in public safety you think justifies asking every person to show their identity information every time they walk into a shop or restaurant? After all the progress made so far with traditional disease mitigation, what would happen if you simply don't choose to force everyone to show their IDs everywhere they go? If you're saying vaccines and lockdowns weren't enough, what is the target you're chasing exactly? Is it really worth it?
      - ajsnigrutin 5y ago
        This is what I don't understand either... vaccines work, health systems in most eu countries are pretty empty of covid patients now, anyone who wants a vaccine can get one... but we're still requiring people from countries with 99positive/100k to show vaccination proof to enter a country with 98positive/100k. We have the vacciness, anyone can get one for free, just open up, and let the antivaxxers risk it if they want.
        dolmen 5y ago
        It's not that simple. Even with a vaccine you can get COVID. Any body hosting a COVID virus is an environment where mutations happen. We don't just want people to stop dying from COVID. We also want to stop new more dangerous strains of the virus to emerge or propagate.
- ryanlol 5y ago
  > I certainly wouldn't risk passing a border with a fake certificate. Border guards are even less interested in the validity of your covid certificates than nightclub bouncers. They have very limited amounts of time they can spend on processing people without the whole system collapsing
  - CaptainZapp 5y ago
    Welcome to the Schengen area. You will not enter any Schengen country without the border guard checking if you have an entry in the Schengen Information System.[1] A reply is available within seconds after the border agent scans your ID document (passport or identification card). Travelling between Schengen countries doesn't require an id or a passport, but currently countries have restrictions on entry most of them either insisting on you being vaccinated or to present a current Covid test. I'm travelling to Paris by train on Friday. which has the following requirements for entry: From 9 June, fully vaccinated people from EU or Schengen Associated Countries will not be subject to testing or isolation requirements. Accepted vaccines: Pfizer/BioNTech Moderna AstraZeneca Johnson & Johnson (Janssen) further All travellers (from 9 June: all non-vaccinated travellers) are subject to the requirement for a pre- departure negative COVID-19 test taken within 72 hours prior to arrival. Now sure, chances are small that I'm even checked in the train. But if I am then it would be pretty dumb to present fake documentation. Don't you think so? [1] https://ec.europa.eu/home-affairs/what-we-do/policies/borders-and-visas/schengen-information-system_en https://ec.europa.eu/home-affairs/what-we-do/policies/border...
    - ajsnigrutin 5y ago
      What I don't understand is, why do countries require all that for people from countries which have pretty much the same number of infected as they do (per capita)? If chances of a local spreading the disease is the same as for the tourist, because both countries have eg. 95positive/100k people, why bother?
      - kzrdude 5y ago
        Recently, the argument has been that they don't want variants to cross borders. They eventually will, but it's one more reason to say that "covid outside" != "the covid we have at home".
- logifail 5y ago
  > I certainly wouldn't risk passing a border with a fake certificate [..] especially given that you can also cross a border with a negative antigen test, which is pretty easy to come by. I must have done getting on for 50 of them so far this year.

by ziihrs 5y ago

CaptainZapp 5y ago

What I don't quite get is that the certificate is linked to me personally. Notably, it contains my full name, including middle name, and date of birth. It notably states that it's only valid together with an identification document. It's possible, of course, that gyms and nightclubs don't check very thoroughly, but I certainly wouldn't risk passing a border with a fake certificate.

detaro 5y ago
Yes, it's fairly obvious that none of this works if you don't verify that the identity matches the ID (the yellow paper pass won't either!), but you can nevertheless expect that plenty places won't do that. Or even just see "app shows the right color and a QR code", there was an embarrassing amount of media coverage of the fact that if you set the system time in the future the German app will show the "right" color even if someone hasn't waited long enough after their vaccination... which of course has zero effect on if validation succeeds or not.
- Yaina 5y ago
  That's so strange, and almost suggests that the people implementing these apps don't understand the security model behind these codes. Any information on the users phone can 100% not be trusted. It should just show the QR code. On the other hand the scanning App has to validate the signature, check if the dates are correct and display a big info that the QR is only valid if the name is the same as the one on a presented ID. Maybe this should have been a design requirement from the EU spec.
  - logifail 5y ago
    > the people implementing these apps don't understand the security model behind these codes I'm not entirely sure that the people implementing the policies understand the 'herd immunity' model, nor the by now fairly comprehensive statistical data on who is and isn't at significant risk from Covid19.[0] Q: If a healthy 18 year-old chooses to attempt to go to a nightclub unvaccinated, who exactly is put at risk from this? [0] https://www.ons.gov.uk/aboutus/transparencyandgovernance/freedomofinformationfoi/averageageofthosewhohaddiedwithcovid19 https://www.ons.gov.uk/aboutus/transparencyandgovernance/fre...
    - razius 5y ago
      Tbh I don't think the goal is risk prevention, if you take that into consideration the app works perfectly.
    - aj3 5y ago
      A: non-immune people this 18-year comes in contact with later
      - logifail 5y ago
        Public health bodies will struggle to convince healthy young people to take a vaccine that gives them very little direct benefit. "Children's risk of severe disease from Covid is tiny, deaths are extremely rare and have only occurred in UK children with profound underlying and life-limiting conditions. The direct benefits to them of vaccination would be low."[0] [0] https://www.bbc.com/news/health-57496074 https://www.bbc.com/news/health-57496074
        aj3 5y ago
        we live in society
        logifail 5y ago
        > we live in society Insert quote from Margaret Thatcher from 1987?[0] More seriously, there is no [longer] one approved way to live, thank goodness. We rightly demand that larger / mainstream groups respect minorities. At what point is it OK to stop listening or respecting minority views, and who gets to decide that? [0] "you know, there's no such thing as society. There are individual men and women and there are families" https://www.theguardian.com/politics/2013/apr/08/margaret-thatcher-quotes https://www.theguardian.com/politics/2013/apr/08/margaret-th...
- vbezhenar 5y ago
  The only thing you should verify is photo. Because you can't really verify an ID either (other than checking a photo). So QR code should just encode a photo URL (and sign it) and QR scanner should display that photo.
  - distances 5y ago
    That would mean some centralized data store. I'd be against such a measure. Current approach is device only, with very limited risk of data breach.
    - vbezhenar 5y ago
      May be it's possible to encode some kind of low-res compressed image in QR-code? I did not run the math. Or may be it's even possible to scan photo from smartphone display, run some kind of image hash and compare it to hash inside QR-code. This way it would be possible to work completely offline. I think it's called perceptual hashing, though I'm not sure if it's cryptographically secure.
      - dolmen 5y ago
        The issue is not about compression (well, it could be). It is is about the authority that delivers the QR code: if it doesn't have the data (photo) it can't produce the QR code. For example, I have been vaccinated in April, long before the green pass appeared. No one took my picture at that time (and that's not the task of doctors to take pictures and store them in central database, for privacy reasons). I still deserves a QR-code to go out of home. In France we have ID cards which can link a photo to the name and birth date. So encoding name and birth date in the QR-code are enough.
  - bonzini 5y ago
    Currently the image is retrieved via a very powerful distributed database with embedded authentication, consisting of millions of wallets and handbags. The authentication key is the name and date of birth, and is printed on both the pass and the medium that stores the image.
- the_mitsuhiko 5y ago
  There is not even an app here, people just show QR codes from wherever they have stored them.
neither_color 5y ago
I don't give my name and date of birth to walk into a store or restaurant so why should this QR code force you to? Presumably all you want to know about this person is whether or not they are a toxic, contagious, diseased biohazard to you; everything else is none of your business.
- _Microft 5y ago
  If someone is showing someone else's proof of vaccination while they are not vaccinated, they actually might be a threat. The QR code by itself is not proof of anything until you have verified that it actually belongs to the person showing it. That's where the ID comes in.
  - neither_color 5y ago
    Just out of curiosity, what is the minimum net improvement in public safety you think justifies asking every person to show their identity information every time they walk into a shop or restaurant? After all the progress made so far with traditional disease mitigation, what would happen if you simply don't choose to force everyone to show their IDs everywhere they go? If you're saying vaccines and lockdowns weren't enough, what is the target you're chasing exactly? Is it really worth it?
    - ajsnigrutin 5y ago
      This is what I don't understand either... vaccines work, health systems in most eu countries are pretty empty of covid patients now, anyone who wants a vaccine can get one... but we're still requiring people from countries with 99positive/100k to show vaccination proof to enter a country with 98positive/100k. We have the vacciness, anyone can get one for free, just open up, and let the antivaxxers risk it if they want.
      - dolmen 5y ago
        It's not that simple. Even with a vaccine you can get COVID. Any body hosting a COVID virus is an environment where mutations happen. We don't just want people to stop dying from COVID. We also want to stop new more dangerous strains of the virus to emerge or propagate.
ryanlol 5y ago
> I certainly wouldn't risk passing a border with a fake certificate. Border guards are even less interested in the validity of your covid certificates than nightclub bouncers. They have very limited amounts of time they can spend on processing people without the whole system collapsing
- CaptainZapp 5y ago
  Welcome to the Schengen area. You will not enter any Schengen country without the border guard checking if you have an entry in the Schengen Information System.[1] A reply is available within seconds after the border agent scans your ID document (passport or identification card). Travelling between Schengen countries doesn't require an id or a passport, but currently countries have restrictions on entry most of them either insisting on you being vaccinated or to present a current Covid test. I'm travelling to Paris by train on Friday. which has the following requirements for entry: From 9 June, fully vaccinated people from EU or Schengen Associated Countries will not be subject to testing or isolation requirements. Accepted vaccines: Pfizer/BioNTech Moderna AstraZeneca Johnson & Johnson (Janssen) further All travellers (from 9 June: all non-vaccinated travellers) are subject to the requirement for a pre- departure negative COVID-19 test taken within 72 hours prior to arrival. Now sure, chances are small that I'm even checked in the train. But if I am then it would be pretty dumb to present fake documentation. Don't you think so? [1] https://ec.europa.eu/home-affairs/what-we-do/policies/borders-and-visas/schengen-information-system_en https://ec.europa.eu/home-affairs/what-we-do/policies/border...
  - ajsnigrutin 5y ago
    What I don't understand is, why do countries require all that for people from countries which have pretty much the same number of infected as they do (per capita)? If chances of a local spreading the disease is the same as for the tourist, because both countries have eg. 95positive/100k people, why bother?
    - kzrdude 5y ago
      Recently, the argument has been that they don't want variants to cross borders. They eventually will, but it's one more reason to say that "covid outside" != "the covid we have at home".
logifail 5y ago
> I certainly wouldn't risk passing a border with a fake certificate [..] especially given that you can also cross a border with a negative antigen test, which is pretty easy to come by. I must have done getting on for 50 of them so far this year.