3 ms·
> Quebec (I believe, they don’t have a public spec) > Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT th
by BeefWellington 5y ago
> Quebec (I believe, they don’t have a public spec)
> Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me.
In the case of Quebec's app, there are significant issues. It's not just that they permit privacy violations; it's that the other side of it is broken.[1]
[1]: https://www.cbc.ca/news/canada/montreal/vaccination-passport-safety-security-hacker-1.6155488 https://www.cbc.ca/news/canada/montreal/vaccination-passport...
- noodlesUK 5y agoIt sounds like what’s happening there is that whatever backend is feeding the data into the system that generates the vaccine passes is vulnerable. Obviously I don’t know for sure, but lots of US states have really old Immunisation Information Systems, and I wouldn’t be at all surprised if they had some gaping holes in them. I imagine Quebec has a similar system of approx the same age with gaping holes. Edit: that obviously doesn’t reduce the severity of the PII breach issue though, or change the fact that it undermines the security of the covid passes. If anything it’s worse because you’d be able to see other stuff like childhood vaccinations.