3 ms·

They're not based on public key crypto like in the rest of the world?

by tonfa 5y ago

isoskeles 5y ago
They are. They’re trivial to create with your own issuer but not to forge an existing issuer, unless their private key is leaked.
- fy20 5y ago
  And what's the point of that? Aren't the verification apps going to check the issuer?
  - isoskeles 5y ago
    Verification apps should check the issuer. But you can issue and sign your own vaccine codes trivially. Some apps will go a step further to check that the issuer is “trusted.” For example, there is a good list of issuers considered trusted here: https://github.com/the-commons-project/vci-directory/blob/main/vci-issuers.json https://github.com/the-commons-project/vci-directory/blob/ma... The most popular reader app I know of will mark issuers that are not on this list as “Partially-verified.” I’m not going to get too deep into this because it’s clear that HN is, for some reason, very antagonistic toward any discussion on the matter unless some correct permutation of words is used. Nonetheless, I’ve researched this quite a bit. Anyone can make and issue their own SMART Health Card.
    - tonfa 5y ago
      This seems odd given that EU+CH did implement things properly wrt to cryto and trusted certs, but yes I guess there's a possibility that UK messed it up :)
      - isoskeles 5y ago
        Oh yeah, I don’t know exactly what they’re doing in UK. SMART Health Card is an open standard that requires using ES256 for signing (more here: https://spec.smarthealth.cards/ https://spec.smarthealth.cards/). I assumed we were just talking about SHC, but UK could do something outside that standard. These all look the same, like a QR code, but the underlying structure could be different. I believe NY’s Excelsior Pass is also doing something slightly different, although I won’t claim it has anything to do with the signing aspect.
        levinb 5y ago
        NY has the “Excelsior Pass Plus” that can also include recent CoV test results. In my experience only high end restaurants, union industries, and major public institutions are requiring either, but the number and type of venues is increasing. Both types are publicly funded apps for both the QR pass and reader apps, and they have data privacy terms that I think most of the HN crowd would find palatable. One can debate the effectiveness of the mandates in NY, but the state did play a reasonably proper role in providing the tech to facilitate it. And yes, anyone can create and sign a SHC, but the VCI initiative is trying to create trust networks so that only certain signing keys may be considered valid. Not moving fast enough there, IMO.
        tonfa 5y ago
        If you're from the US, that might explain the misunderstanding. The apps in Europe (EU+other countries) have standardized trusted certs roots. So being able to create a qr code doesn't help at all, it won't pass the verifier apps.

They're not based on public key crypto like in the rest of the world?

by tonfa 5y ago

They're not based on public key crypto like in the rest of the world?

They are. They’re trivial to create with your own issuer but not to forge an existing issuer, unless their private key is leaked.

fy20 5y ago
And what's the point of that? Aren't the verification apps going to check the issuer?
- isoskeles 5y ago
  Verification apps should check the issuer. But you can issue and sign your own vaccine codes trivially. Some apps will go a step further to check that the issuer is “trusted.” For example, there is a good list of issuers considered trusted here: https://github.com/the-commons-project/vci-directory/blob/main/vci-issuers.json https://github.com/the-commons-project/vci-directory/blob/ma... The most popular reader app I know of will mark issuers that are not on this list as “Partially-verified.” I’m not going to get too deep into this because it’s clear that HN is, for some reason, very antagonistic toward any discussion on the matter unless some correct permutation of words is used. Nonetheless, I’ve researched this quite a bit. Anyone can make and issue their own SMART Health Card.
  - tonfa 5y ago
    This seems odd given that EU+CH did implement things properly wrt to cryto and trusted certs, but yes I guess there's a possibility that UK messed it up :)
    - isoskeles 5y ago
      Oh yeah, I don’t know exactly what they’re doing in UK. SMART Health Card is an open standard that requires using ES256 for signing (more here: https://spec.smarthealth.cards/ https://spec.smarthealth.cards/). I assumed we were just talking about SHC, but UK could do something outside that standard. These all look the same, like a QR code, but the underlying structure could be different. I believe NY’s Excelsior Pass is also doing something slightly different, although I won’t claim it has anything to do with the signing aspect.
      - levinb 5y ago
        NY has the “Excelsior Pass Plus” that can also include recent CoV test results. In my experience only high end restaurants, union industries, and major public institutions are requiring either, but the number and type of venues is increasing. Both types are publicly funded apps for both the QR pass and reader apps, and they have data privacy terms that I think most of the HN crowd would find palatable. One can debate the effectiveness of the mandates in NY, but the state did play a reasonably proper role in providing the tech to facilitate it. And yes, anyone can create and sign a SHC, but the VCI initiative is trying to create trust networks so that only certain signing keys may be considered valid. Not moving fast enough there, IMO.
      - tonfa 5y ago
        If you're from the US, that might explain the misunderstanding. The apps in Europe (EU+other countries) have standardized trusted certs roots. So being able to create a qr code doesn't help at all, it won't pass the verifier apps.