4 ms·

There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York an

There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others. EU DGC - All eu countries, some others like the UK. Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me. In many of these instances it seems like the public health department is getting scammed by local players who say they can do something like this and then have Not Invented Here causing massive issues. I’d love to work on a verifier which supported both the EU and SMART standards in one app.

BeefWellington 5y ago
> Quebec (I believe, they don’t have a public spec) > Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me. In the case of Quebec's app, there are significant issues. It's not just that they permit privacy violations; it's that the other side of it is broken.[1] [1]: https://www.cbc.ca/news/canada/montreal/vaccination-passport-safety-security-hacker-1.6155488 https://www.cbc.ca/news/canada/montreal/vaccination-passport...
- noodlesUK 5y ago
  It sounds like what’s happening there is that whatever backend is feeding the data into the system that generates the vaccine passes is vulnerable. Obviously I don’t know for sure, but lots of US states have really old Immunisation Information Systems, and I wouldn’t be at all surprised if they had some gaping holes in them. I imagine Quebec has a similar system of approx the same age with gaping holes. Edit: that obviously doesn’t reduce the severity of the PII breach issue though, or change the fact that it undermines the security of the covid passes. If anything it’s worse because you’d be able to see other stuff like childhood vaccinations.
noodlesUK 5y ago
If anyone sees this later, I just looked and found a more “universal” verifier by a group called Path Check. I don’t know much about it but it seems to support both standards. https://github.com/Path-Check/universal-verifier-app https://github.com/Path-Check/universal-verifier-app
tlavoie 5y ago
British Columbia uses the SMART Health Cards as well, as written up in this blog post: https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-19-vaccine-card-technical-analysis/ https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-1... What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as key to being able to trust it. The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. I'd be more curious how it would be able to handle any other jurisdictions' codes, unless it has US keys available as well.
- m-p-3 5y ago
  > The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. Quebec's app does the same thing, it has the public key builtin for validation. The only time the app can connect is to download an updated list of rules that determine if the enclosed information in the QR code related to vaccine status still protects the owner (and label them as adequately protected if they meet those criterias).
  - tlavoie 5y ago
    Thanks, I was curious about updates here as well. To that end, I don't know if ours does any such updates directly, or if that would come in the form of an app update.
- tlavoie 5y ago
  Also, while the details of the vaccination are contained in the payload, the app displays only the bare minimum of data to the user: verified vaccination status, and the holder's name to compare with photo ID (required in BC for adults). I appreciate that the data contained in the code is as minimal as it can be, while the official app is displaying even less. Working off-line should keep it reliable as well, since it does not make or require server calls. This too would be different from Portpass, since it apparently stopped working.
m-p-3 5y ago
> Quebec I confirm that Quebec uses SHC.

BeefWellington 5y ago

> Quebec (I believe, they don’t have a public spec) > Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me. In the case of Quebec's app, there are significant issues. It's not just that they permit privacy violations; it's that the other side of it is broken.[1] [1]: https://www.cbc.ca/news/canada/montreal/vaccination-passport-safety-security-hacker-1.6155488 https://www.cbc.ca/news/canada/montreal/vaccination-passport...

noodlesUK 5y ago
It sounds like what’s happening there is that whatever backend is feeding the data into the system that generates the vaccine passes is vulnerable. Obviously I don’t know for sure, but lots of US states have really old Immunisation Information Systems, and I wouldn’t be at all surprised if they had some gaping holes in them. I imagine Quebec has a similar system of approx the same age with gaping holes. Edit: that obviously doesn’t reduce the severity of the PII breach issue though, or change the fact that it undermines the security of the covid passes. If anything it’s worse because you’d be able to see other stuff like childhood vaccinations.

noodlesUK 5y ago

If anyone sees this later, I just looked and found a more “universal” verifier by a group called Path Check. I don’t know much about it but it seems to support both standards. https://github.com/Path-Check/universal-verifier-app https://github.com/Path-Check/universal-verifier-app

tlavoie 5y ago

British Columbia uses the SMART Health Cards as well, as written up in this blog post: https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-19-vaccine-card-technical-analysis/ https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-1... What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as key to being able to trust it. The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. I'd be more curious how it would be able to handle any other jurisdictions' codes, unless it has US keys available as well.

m-p-3 5y ago
> The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. Quebec's app does the same thing, it has the public key builtin for validation. The only time the app can connect is to download an updated list of rules that determine if the enclosed information in the QR code related to vaccine status still protects the owner (and label them as adequately protected if they meet those criterias).
- tlavoie 5y ago
  Thanks, I was curious about updates here as well. To that end, I don't know if ours does any such updates directly, or if that would come in the form of an app update.
tlavoie 5y ago
Also, while the details of the vaccination are contained in the payload, the app displays only the bare minimum of data to the user: verified vaccination status, and the holder's name to compare with photo ID (required in BC for adults). I appreciate that the data contained in the code is as minimal as it can be, while the official app is displaying even less. Working off-line should keep it reliable as well, since it does not make or require server calls. This too would be different from Portpass, since it apparently stopped working.

m-p-3 5y ago

> Quebec I confirm that Quebec uses SHC.