3 ms·
This seems odd given that EU+CH did implement things properly wrt to cryto and trusted certs, but yes I guess there's a possibility that UK messed it up :)
by tonfa 5y ago
This seems odd given that EU+CH did implement things properly wrt to cryto and trusted certs, but yes I guess there's a possibility that UK messed it up :)
- isoskeles 5y agoOh yeah, I don’t know exactly what they’re doing in UK. SMART Health Card is an open standard that requires using ES256 for signing (more here: https://spec.smarthealth.cards/ https://spec.smarthealth.cards/). I assumed we were just talking about SHC, but UK could do something outside that standard. These all look the same, like a QR code, but the underlying structure could be different. I believe NY’s Excelsior Pass is also doing something slightly different, although I won’t claim it has anything to do with the signing aspect.
- levinb 5y agoNY has the “Excelsior Pass Plus” that can also include recent CoV test results. In my experience only high end restaurants, union industries, and major public institutions are requiring either, but the number and type of venues is increasing. Both types are publicly funded apps for both the QR pass and reader apps, and they have data privacy terms that I think most of the HN crowd would find palatable. One can debate the effectiveness of the mandates in NY, but the state did play a reasonably proper role in providing the tech to facilitate it. And yes, anyone can create and sign a SHC, but the VCI initiative is trying to create trust networks so that only certain signing keys may be considered valid. Not moving fast enough there, IMO.
- tonfa 5y agoIf you're from the US, that might explain the misunderstanding. The apps in Europe (EU+other countries) have standardized trusted certs roots. So being able to create a qr code doesn't help at all, it won't pass the verifier apps.