3 ms·

With CoronaCheck (https://coronacheck.nl https://coronacheck.nl) we have implemented one of the most privacy preserving EU Green Systems for use within our coun

With CoronaCheck (https://coronacheck.nl https://coronacheck.nl) we have implemented one of the most privacy preserving EU Green Systems for use within our country. We use IDEMIX, a form of Verifiable Credentials. The nice feature of IDEMIX is that - unlike W3C VC - it also has the property of being able to create unlinkable credentials. Guess what? That's the reason that we've used them :) Read our technical designs here: https://github.com/minvws/nl-covid19-coronacheck-app-coordination/blob/main/architecture/Privacy%20Preserving%20Green%20Card.md https://github.com/minvws/nl-covid19-coronacheck-app-coordin...

radicalbyte 5y ago
The Ministry of Health here have been commendable in the way that they've approached these apps. The key re-usable components of the system been development in public and in open and made available with a permissive license.
gillesjacobs 5y ago
I wish the standard would have adopted your proof of concept! I don't think you will get a lot of support here though, privacy skepticism regarding COVID seems to be met with downvote brigades.
- radicalbyte 5y ago
  I wish that I could share my thoughts on that in public :(
- mmcnl 5y ago
  It's not a PoC, CoronaCheck is the app that will be used in The Netherlands for generating QR codes. The domestic QR code will be much more friendly with respect to privacy as explained by radicalbytes. The reason that it's not been adopted by the EU is because member states want to set their own rules for entry. For example, some countries consider previous infection + 1 dose as fully vaccinated, others do not. Some countries approve non-EMA approved vaccines, most do not. That's why it's necessary to include more details. I think you have to remember that everything is a trade-off, if you want a more privacy-friendly solution, there will be a cost at some point.
pzo 5y ago
Only gave it a fast look at technical designs and it seems it is still not tracking proof since QR code has: "The person's initials and birth month/day." This should be enough to create a pretty much unique profile ID especially for countries like Netherlands with small population.
- radicalbyte 5y ago
  That's why we do partial issuance - so in practise you have some combination of First_Name_Initial, Last_Name_Initial, Birth_Month, Birth_Day. I have a very common combination, and I get only my First_Name_Initial and Birth_Month. EDIT: I quite literally built this for the first version of the app. It's all in the repo (unless someone has cleaned it up since I last looked).

radicalbyte 5y ago

The Ministry of Health here have been commendable in the way that they've approached these apps. The key re-usable components of the system been development in public and in open and made available with a permissive license.

gillesjacobs 5y ago

I wish the standard would have adopted your proof of concept! I don't think you will get a lot of support here though, privacy skepticism regarding COVID seems to be met with downvote brigades.

radicalbyte 5y ago
I wish that I could share my thoughts on that in public :(
mmcnl 5y ago
It's not a PoC, CoronaCheck is the app that will be used in The Netherlands for generating QR codes. The domestic QR code will be much more friendly with respect to privacy as explained by radicalbytes. The reason that it's not been adopted by the EU is because member states want to set their own rules for entry. For example, some countries consider previous infection + 1 dose as fully vaccinated, others do not. Some countries approve non-EMA approved vaccines, most do not. That's why it's necessary to include more details. I think you have to remember that everything is a trade-off, if you want a more privacy-friendly solution, there will be a cost at some point.

pzo 5y ago

Only gave it a fast look at technical designs and it seems it is still not tracking proof since QR code has: "The person's initials and birth month/day." This should be enough to create a pretty much unique profile ID especially for countries like Netherlands with small population.

radicalbyte 5y ago
That's why we do partial issuance - so in practise you have some combination of First_Name_Initial, Last_Name_Initial, Birth_Month, Birth_Day. I have a very common combination, and I get only my First_Name_Initial and Birth_Month. EDIT: I quite literally built this for the first version of the app. It's all in the repo (unless someone has cleaned it up since I last looked).