4 ms·

How can I verify that the QR code is of the person in front of me, if there's no name or anything included? Screenshots are old you know.

gillesjacobs 5y ago
There are zero-knowledge and differential privacy solutions to this issue. For more critical applications there probably is an ID cross-check and online verification being performed. The nightclub does not need to know my full name, residence and birthdate.
- skeeks 5y ago
  On most ID cards, there is the full name and the birthdate of the person. So it does not matter if it's on the QR code too. The place of residence is neither on the ID card nor on the QR code.
nomercy400 5y ago
Name seems like a good field to include, but you will want to remove the 'vaccination details'. Does a bouncer at a nightclub really need to know I received one dose of a Pfizer vaccine against COVID-19 in Austria on February 18, 2021? Or does he need to know that 'I am fully vaccinated to enter this venue according to local laws'?
- jeroenhd 5y ago
  How would you encode the local laws into a code that is generated by an app, published by another government? The type of shot, and the amount of shots, even the date of the shot, are all perfectly valid requirements that can end up in local law. Astrazenica doesn't work well against the British covid variant, so in an outbreak you might end up with laws restricting the type of vaccination, easily. To determine what is and what isn't allowed, the logic should be built into the verification code, which each government can make their own for. If all of Europe were to use the same laws and regulations then I'd agree that this information does not need to be stored in the QR code. This is impossible to manage in practice, though.
  - nomercy400 5y ago
    I'm not sure. What or who generates these QR-codes? Can't that system also provide the verification check? It is a European-wide 'system' after all. Who do you trust more with your data: your (european) government or a (non-european) government/private entity?
- skeeks 5y ago
  The official validation apps will not show this detail to the user. Unofficial apps may come up but app stores will probably quickly ban those (they are very careful about the whole COVID topic in the playstores). There is still the chance of sideloading the app, but one does also need to consider if the vaccination information must really be protected that hard. In most countries, it's more or less randomly when and with what kind of vaccine you got vaccinated. And the really important information in my opinion is: is someone vaccinated or not? And this information is what the bouncer needs to know to let you in...
  - nomercy400 5y ago
    Imagine Facebook sending any app that would have 'Login with Facebook' functionality, your full profile, including your plaintext password. Would you trust every and all third-party applications with this 'Login with Facebook' functionality, to not look at your plaintext password? Or would you rather have Facebook not send your password in the first place?
yarcob 5y ago
You could include a photo of the person in the QR code, but I'm pretty sure most people would prefer just the name to be included.

gillesjacobs 5y ago

There are zero-knowledge and differential privacy solutions to this issue. For more critical applications there probably is an ID cross-check and online verification being performed. The nightclub does not need to know my full name, residence and birthdate.

skeeks 5y ago
On most ID cards, there is the full name and the birthdate of the person. So it does not matter if it's on the QR code too. The place of residence is neither on the ID card nor on the QR code.

nomercy400 5y ago

Name seems like a good field to include, but you will want to remove the 'vaccination details'. Does a bouncer at a nightclub really need to know I received one dose of a Pfizer vaccine against COVID-19 in Austria on February 18, 2021? Or does he need to know that 'I am fully vaccinated to enter this venue according to local laws'?

jeroenhd 5y ago
How would you encode the local laws into a code that is generated by an app, published by another government? The type of shot, and the amount of shots, even the date of the shot, are all perfectly valid requirements that can end up in local law. Astrazenica doesn't work well against the British covid variant, so in an outbreak you might end up with laws restricting the type of vaccination, easily. To determine what is and what isn't allowed, the logic should be built into the verification code, which each government can make their own for. If all of Europe were to use the same laws and regulations then I'd agree that this information does not need to be stored in the QR code. This is impossible to manage in practice, though.
- nomercy400 5y ago
  I'm not sure. What or who generates these QR-codes? Can't that system also provide the verification check? It is a European-wide 'system' after all. Who do you trust more with your data: your (european) government or a (non-european) government/private entity?
skeeks 5y ago
The official validation apps will not show this detail to the user. Unofficial apps may come up but app stores will probably quickly ban those (they are very careful about the whole COVID topic in the playstores). There is still the chance of sideloading the app, but one does also need to consider if the vaccination information must really be protected that hard. In most countries, it's more or less randomly when and with what kind of vaccine you got vaccinated. And the really important information in my opinion is: is someone vaccinated or not? And this information is what the bouncer needs to know to let you in...
- nomercy400 5y ago
  Imagine Facebook sending any app that would have 'Login with Facebook' functionality, your full profile, including your plaintext password. Would you trust every and all third-party applications with this 'Login with Facebook' functionality, to not look at your plaintext password? Or would you rather have Facebook not send your password in the first place?

yarcob 5y ago

You could include a photo of the person in the QR code, but I'm pretty sure most people would prefer just the name to be included.