5 ms·

Serious privacy/security concerns raised about Portpass vaccine verification app

48 points by mmastrac 5y ago

noodlesUK 5y ago
There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others. EU DGC - All eu countries, some others like the UK. Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me. In many of these instances it seems like the public health department is getting scammed by local players who say they can do something like this and then have Not Invented Here causing massive issues. I’d love to work on a verifier which supported both the EU and SMART standards in one app.
- BeefWellington 5y ago
  > Quebec (I believe, they don’t have a public spec) > Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me. In the case of Quebec's app, there are significant issues. It's not just that they permit privacy violations; it's that the other side of it is broken.[1] [1]: https://www.cbc.ca/news/canada/montreal/vaccination-passport-safety-security-hacker-1.6155488 https://www.cbc.ca/news/canada/montreal/vaccination-passport...
  - noodlesUK 5y ago
    It sounds like what’s happening there is that whatever backend is feeding the data into the system that generates the vaccine passes is vulnerable. Obviously I don’t know for sure, but lots of US states have really old Immunisation Information Systems, and I wouldn’t be at all surprised if they had some gaping holes in them. I imagine Quebec has a similar system of approx the same age with gaping holes. Edit: that obviously doesn’t reduce the severity of the PII breach issue though, or change the fact that it undermines the security of the covid passes. If anything it’s worse because you’d be able to see other stuff like childhood vaccinations.
- noodlesUK 5y ago
  If anyone sees this later, I just looked and found a more “universal” verifier by a group called Path Check. I don’t know much about it but it seems to support both standards. https://github.com/Path-Check/universal-verifier-app https://github.com/Path-Check/universal-verifier-app
- tlavoie 5y ago
  British Columbia uses the SMART Health Cards as well, as written up in this blog post: https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-19-vaccine-card-technical-analysis/ https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-1... What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as key to being able to trust it. The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. I'd be more curious how it would be able to handle any other jurisdictions' codes, unless it has US keys available as well.
  - m-p-3 5y ago
    > The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. Quebec's app does the same thing, it has the public key builtin for validation. The only time the app can connect is to download an updated list of rules that determine if the enclosed information in the QR code related to vaccine status still protects the owner (and label them as adequately protected if they meet those criterias).
    - tlavoie 5y ago
      Thanks, I was curious about updates here as well. To that end, I don't know if ours does any such updates directly, or if that would come in the form of an app update.
  - tlavoie 5y ago
    Also, while the details of the vaccination are contained in the payload, the app displays only the bare minimum of data to the user: verified vaccination status, and the holder's name to compare with photo ID (required in BC for adults). I appreciate that the data contained in the code is as minimal as it can be, while the official app is displaying even less. Working off-line should keep it reliable as well, since it does not make or require server calls. This too would be different from Portpass, since it apparently stopped working.
- m-p-3 5y ago
  > Quebec I confirm that Quebec uses SHC.
BoHerfVJrEsq 5y ago
It's a distraction to talk about specific vulnerabilities in specific implementations of 'vaccine passports'. The entire idea is incredibly dangerous to free society. If you wouldn't want to live in China because of its freedom situation, do not allow vaccine passports to be implemented in your area.
bratcomplex 5y ago
This is getting more hilarious by the minute. -the modern tech sector is a big scam at this point. -the personal data silos is archaic, and most of the time kyc isn’t necessary. -the idea of proof of vaccination seems like a bad idea in that the ease of creating a faked proof has much much larger Societal consequences compared to a fake id a teenager uses to get booze. I think I’m in Favour of the idea, that if your not interested in personal vaccination, certain areas have restricted access. for the sake of human... economic... protection.
- bratcomplex 5y ago
  Down voted,really? explain
  - ggm 5y ago
    you upped the jargon for expressing an opinion.The KYC is indeed necessary because people will fake these. You mixed up a technology whine, with politics, in one sentence. Unpack things a bit and you might have got less downvote. I want to travel. The sector needs a reboot. I want a vaxx QR code tied to me, which has good fake protection which lets me travel. I am not stupid (very, maybe a bit) and I know there are all kinds of complications. but, we've had yellow fever "passports" forever and they work: they help prevent wildcat breakout of yellow fever in tropical climates. Australia down-voted a health card 30 years ago (the "australia card") on civil liberties grounds. Right now, I think it would be bloody useful. The online mygov ID is not actually badly done, and I know people who work in medical data structures, and how complex it is to structure health information to share even amongst health professionals.
    - exodust 5y ago
      > I want a vaxx QR code tied to me I don't. Nor do I want to be micro-chipped like the family pet. The article is not about travel, it's about gaining entry to an ice hockey match. It's in same realm as gaining entry to a restaurant or any local business. Not everyone wants KYC enforced on basic human activity such as satisfying your hunger for dumplings or meeting a friend for coffee. They claim it's a temporary measure at certain venues, but they claim a lot of things. "We're announcing a 2 week snap lockdown" was said hundreds of days ago here in Melbourne. Only the tip of the Untruth iceberg. Australians have already been tricked into a mandatory MyGov account. You can't delete that online account like you can your social media. Technically it's fine, but the concept and heading is concerning. The voting public have less and less say in these things, and the fog of a pandemic is perfect cover to introduce a range of new mandates, otherwise shelved for being too unpopular. Some will call this paranoia, others due diligence or an integrity test / pub test. I don't think it helps to exempt things like an Australia Card from the pub test because you think it would be "bloody useful". That's inviting the Trojan horse in with full knowledge of what's inside, and being okay with it because of the travel permissions it grants you.
rapind 5y ago
> The app claims to use AI and blockchain to verify records and keep data secure Yeah, as soon as I read this I know it's going to be complete horse manure.
- cratermoon 5y ago
  Obligatory xkcd https://xkcd.com/2030/ https://xkcd.com/2030/ Take 2 https://xkcd.com/2267/ https://xkcd.com/2267/
narrator 5y ago
Can this be used for a China style social credit score system? I have explained how the social credit score system works in China and people think I'm talking about a TV show. They refuse to believe it's actually real.
- redis_mlc 5y ago
  In China, the vaccine testing data is already integrated into their social credit score system, so you can't get on public transit, etc. without completing the vaccine milestones. In the US, the govt. has an internal system called XKeyScore that tracks your email, web and credit history. In Australia, they have a "private" vaccine tracking app, but from Day One the police admitted having access to the database. (The police called reporters stupid for believing the app data was ever private.)
  - narrator 5y ago
    This is why you don't accept the vaccine passport. It will be the camel's nose under the tent that will be used to gameify every aspect of our lives. In the social credit score future, everyone gets UBI, but only people who jump through every little tiny hoop the government can think up can actually do anything with that money.
roody15 5y ago
Seriously no need for a vaccine verification app at all. I work in Illinois and am vaccinated with Moderna. The state maintains a database with my vaccine record including Moderna. The idea that some third party app needs to show my record as “proof” to a store or venue is asinine. Just my two cents.
sk2020 5y ago
That “privacy” is a concern for a “papers, please” surveillance system is a bit surprising.
- tlavoie 5y ago
  Done properly, there is no surveillance, no record of where your code is being scanned. This includes by the scanning app. The SMART Health Card format at least, contains everything needed in the code, and little else. The app just needs the issuer's public keys to verify the signature. That the anti-everything crowd will pout and stay home is precisely the point.
- bool3max 5y ago
  Hasn't everyone in the modern world lived under a "papers, please" surveillance type system for multiple decades now?
  - ashwagary 5y ago
    This is mostly only true with international travel.
TurkishPoptart 5y ago
Why is this vaccine verification app even needed at all? If the vaccine works as intended, then the individual and those around him or her are protected. If it doesn't, then this is not really about public health at all but something far more nefarious and concerning.

48 points by mmastrac 5y ago

There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others. EU DGC - All eu countries, some others like the UK. Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me. In many of these instances it seems like the public health department is getting scammed by local players who say they can do something like this and then have Not Invented Here causing massive issues. I’d love to work on a verifier which supported both the EU and SMART standards in one app.

BeefWellington 5y ago
> Quebec (I believe, they don’t have a public spec) > Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me. In the case of Quebec's app, there are significant issues. It's not just that they permit privacy violations; it's that the other side of it is broken.[1] [1]: https://www.cbc.ca/news/canada/montreal/vaccination-passport-safety-security-hacker-1.6155488 https://www.cbc.ca/news/canada/montreal/vaccination-passport...
- noodlesUK 5y ago
  It sounds like what’s happening there is that whatever backend is feeding the data into the system that generates the vaccine passes is vulnerable. Obviously I don’t know for sure, but lots of US states have really old Immunisation Information Systems, and I wouldn’t be at all surprised if they had some gaping holes in them. I imagine Quebec has a similar system of approx the same age with gaping holes. Edit: that obviously doesn’t reduce the severity of the PII breach issue though, or change the fact that it undermines the security of the covid passes. If anything it’s worse because you’d be able to see other stuff like childhood vaccinations.
noodlesUK 5y ago
If anyone sees this later, I just looked and found a more “universal” verifier by a group called Path Check. I don’t know much about it but it seems to support both standards. https://github.com/Path-Check/universal-verifier-app https://github.com/Path-Check/universal-verifier-app
tlavoie 5y ago
British Columbia uses the SMART Health Cards as well, as written up in this blog post: https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-19-vaccine-card-technical-analysis/ https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-1... What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as key to being able to trust it. The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. I'd be more curious how it would be able to handle any other jurisdictions' codes, unless it has US keys available as well.
- m-p-3 5y ago
  > The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. Quebec's app does the same thing, it has the public key builtin for validation. The only time the app can connect is to download an updated list of rules that determine if the enclosed information in the QR code related to vaccine status still protects the owner (and label them as adequately protected if they meet those criterias).
  - tlavoie 5y ago
    Thanks, I was curious about updates here as well. To that end, I don't know if ours does any such updates directly, or if that would come in the form of an app update.
- tlavoie 5y ago
  Also, while the details of the vaccination are contained in the payload, the app displays only the bare minimum of data to the user: verified vaccination status, and the holder's name to compare with photo ID (required in BC for adults). I appreciate that the data contained in the code is as minimal as it can be, while the official app is displaying even less. Working off-line should keep it reliable as well, since it does not make or require server calls. This too would be different from Portpass, since it apparently stopped working.
m-p-3 5y ago
> Quebec I confirm that Quebec uses SHC.

BoHerfVJrEsq 5y ago

It's a distraction to talk about specific vulnerabilities in specific implementations of 'vaccine passports'. The entire idea is incredibly dangerous to free society. If you wouldn't want to live in China because of its freedom situation, do not allow vaccine passports to be implemented in your area.

bratcomplex 5y ago

This is getting more hilarious by the minute. -the modern tech sector is a big scam at this point. -the personal data silos is archaic, and most of the time kyc isn’t necessary. -the idea of proof of vaccination seems like a bad idea in that the ease of creating a faked proof has much much larger Societal consequences compared to a fake id a teenager uses to get booze. I think I’m in Favour of the idea, that if your not interested in personal vaccination, certain areas have restricted access. for the sake of human... economic... protection.

bratcomplex 5y ago
Down voted,really? explain
- ggm 5y ago
  you upped the jargon for expressing an opinion.The KYC is indeed necessary because people will fake these. You mixed up a technology whine, with politics, in one sentence. Unpack things a bit and you might have got less downvote. I want to travel. The sector needs a reboot. I want a vaxx QR code tied to me, which has good fake protection which lets me travel. I am not stupid (very, maybe a bit) and I know there are all kinds of complications. but, we've had yellow fever "passports" forever and they work: they help prevent wildcat breakout of yellow fever in tropical climates. Australia down-voted a health card 30 years ago (the "australia card") on civil liberties grounds. Right now, I think it would be bloody useful. The online mygov ID is not actually badly done, and I know people who work in medical data structures, and how complex it is to structure health information to share even amongst health professionals.
  - exodust 5y ago
    > I want a vaxx QR code tied to me I don't. Nor do I want to be micro-chipped like the family pet. The article is not about travel, it's about gaining entry to an ice hockey match. It's in same realm as gaining entry to a restaurant or any local business. Not everyone wants KYC enforced on basic human activity such as satisfying your hunger for dumplings or meeting a friend for coffee. They claim it's a temporary measure at certain venues, but they claim a lot of things. "We're announcing a 2 week snap lockdown" was said hundreds of days ago here in Melbourne. Only the tip of the Untruth iceberg. Australians have already been tricked into a mandatory MyGov account. You can't delete that online account like you can your social media. Technically it's fine, but the concept and heading is concerning. The voting public have less and less say in these things, and the fog of a pandemic is perfect cover to introduce a range of new mandates, otherwise shelved for being too unpopular. Some will call this paranoia, others due diligence or an integrity test / pub test. I don't think it helps to exempt things like an Australia Card from the pub test because you think it would be "bloody useful". That's inviting the Trojan horse in with full knowledge of what's inside, and being okay with it because of the travel permissions it grants you.

rapind 5y ago

> The app claims to use AI and blockchain to verify records and keep data secure Yeah, as soon as I read this I know it's going to be complete horse manure.

cratermoon 5y ago
Obligatory xkcd https://xkcd.com/2030/ https://xkcd.com/2030/ Take 2 https://xkcd.com/2267/ https://xkcd.com/2267/

narrator 5y ago

Can this be used for a China style social credit score system? I have explained how the social credit score system works in China and people think I'm talking about a TV show. They refuse to believe it's actually real.

redis_mlc 5y ago
In China, the vaccine testing data is already integrated into their social credit score system, so you can't get on public transit, etc. without completing the vaccine milestones. In the US, the govt. has an internal system called XKeyScore that tracks your email, web and credit history. In Australia, they have a "private" vaccine tracking app, but from Day One the police admitted having access to the database. (The police called reporters stupid for believing the app data was ever private.)
- narrator 5y ago
  This is why you don't accept the vaccine passport. It will be the camel's nose under the tent that will be used to gameify every aspect of our lives. In the social credit score future, everyone gets UBI, but only people who jump through every little tiny hoop the government can think up can actually do anything with that money.

roody15 5y ago

Seriously no need for a vaccine verification app at all. I work in Illinois and am vaccinated with Moderna. The state maintains a database with my vaccine record including Moderna. The idea that some third party app needs to show my record as “proof” to a store or venue is asinine. Just my two cents.

sk2020 5y ago

That “privacy” is a concern for a “papers, please” surveillance system is a bit surprising.

tlavoie 5y ago
Done properly, there is no surveillance, no record of where your code is being scanned. This includes by the scanning app. The SMART Health Card format at least, contains everything needed in the code, and little else. The app just needs the issuer's public keys to verify the signature. That the anti-everything crowd will pout and stay home is precisely the point.
bool3max 5y ago
Hasn't everyone in the modern world lived under a "papers, please" surveillance type system for multiple decades now?
- ashwagary 5y ago
  This is mostly only true with international travel.

TurkishPoptart 5y ago

Why is this vaccine verification app even needed at all? If the vaccine works as intended, then the individual and those around him or her are protected. If it doesn't, then this is not really about public health at all but something far more nefarious and concerning.