27 ms·

Vaccine passport app exposed hundreds of thousands of users' personal data

189 points by jlos 5y ago

philwelch 5y ago
Working as designed?
- cguess 5y ago
  I get that you're being edgy, but I'll ask a serious question: If we assume this was a design purpose, to what end would it be useful?
  - version_five 5y ago
    I dont think it's necessary true (and certainly not helpful) to say the parent is being "edgy" - though I have noticed that's the new internet insult used to casually dismiss different ideas. His point also could have been that the app exists literally to share your sensitive personal information with other parties...
    - r00fus 5y ago
      Guessing at a 3-word comment's meaning ignores the point that it's nearly content free, so deserves the derision.
  - philwelch 5y ago
    This particular breach was, I admit, probably not a design purpose. Apparently they unintentionally exposed completely different personal data than they originally intended to. On a broader scale, it makes sense that people who build vaccine passport apps and people who are passionate about personal privacy are non-overlapping sets of people.
  - tyingq 5y ago
    I don't think they thought beyond the requirement of "scanning a barcode and submitting a query based on the contents of the barcode". The barcode probably returns a userid or something else that's guessable or iterable.
barbazoo 5y ago
> Hussein said Tuesday morning that the breach only lasted for minutes, and repeated that claim when CBC pointed out it had reviewed the personal information for more than an hour — and it's unknown how long the information was exposed before that tip was received. That person doesn't make the impression that they're honest and humble enough to handle people's personal information. > Alberta currently does not have an official proof-of-vaccination app, and the province's PDF vaccine record has been criticized for being easy to edit. This confused me. Don't they have a QR code that gets read and verified and must match the person's name?
- smnrchrds 5y ago
  No, but they are planning one. The current proof of vaccination is a simple PDF with no verification features or signature. Anyone with a PDF editor can take an existing PDF and put their name on it. Alberta was not planning on having a vaccine passport system until about two weeks ago, when the number of cases and hospitalizations got so high the government could no longer ignore it. Because of the late start, it's going to take a while until the QR code system is ready.
- katbyte 5y ago
  No, from what i understand just a PDF you download thats easy to edit: https://beta.ctvnews.ca/local/calgary/2021/9/14/1_5585393/_jcr_content/root/responsivegrid/image.coreimg.jpeg/1631715087586/1-5584975.jpeg https://beta.ctvnews.ca/local/calgary/2021/9/14/1_5585393/_j... alberta yet again drops the ball. Maybe you are thinking about BC who rolled out a signed QR code that could be saved on the phone/printed + an app from the government that does verification.
  - smnrchrds 5y ago
    Out of the four big provinces, two (BC and Quebec) have released their vaccine passport app and QR code system and the other two (Alberta and Ontario) are still in the process of rolling one out.
    - barbazoo 5y ago
adolph 5y ago
The first party asserts information a to third party which only the second party can verify. If the second party has no awareness of the third party or of a relationship between the first and third parties, how can the third party access the second party's verification without the ability to access the information of any first party?
- dmix 5y ago
  Indeed, this quote shows the app is basically useless: > > Hussein had denied that the app validated Yeung's false information, despite it appearing to do so, because he said the fake picture would be a giveaway. > "That's not true. We saw it on the back end and we were watching it.… So even if that user showed up, he wouldn't be able to utilize that picture because that's not him. So you wouldn't be able to get in. Secondly, that QR code, if someone scanned it, it would show that picture again," he said at the time. So there's basically no point in using this middleman then? You can just show them your ID... This app is just an overly complicated and dangerous middle man. You might as well take a photo of your IDs + vaccine PDF with your phones camera and use the photo gallery...
blacktriangle 5y ago
I'm old enough to remember back when those of us who said vaccine passports were coming were conspiracy theorists, now we're calmly talking about implementation details.
- gdulli 5y ago
  There have been conspiracies put forth about covid, but with various other vaccine mandates already in existence I don't know how it would ever have made sense to call it a conspiracy that we'd add one more. Nothing's changed, qualitatively. What's different here is that prior vaccine mandates were never weaponized into a mainstream culture war, so before this they weren't controversial to most and we rarely thought of them. Given that culture war hesitancy over this vaccine was expected early on, I think it was predictable that employers and venues would need to require it in order for it to reach enough of the population to be effective.
- ipspam 5y ago
  Some people may be, others are planning to get tickets and crash the system.
- traloid 5y ago
  Im old enough to remember that people thinking NSA/CIA is watching everyone's internet activity were universally considered deranged schizophrenics. Whatever fears we have about privacy always turn out to be grossly optimistic underestimates. The next step is, of course, that these emergency measures will remain in place forever.
- astura 5y ago
  This isn't a new concept - You've been required to show proof of immunizations to register for public school (including college) and get a visa (or immigrate) for decades. It's a bit annoying when you start college when you are 38 years old and you no longer have any of your pediatric medical records, which happened to a friend of mine. For my friend the school accepted an antibody test, which a friend of mine had to get.
  - 5y ago
richwater 5y ago
Wow, I'm flabbergasted.
yabones 5y ago
An important detail - this was a third party app, NOT an official government one. So, people were essentially uploading their PII to some guy's server and hoping for the best. This is what we all feared, and hoped wouldn't happen. But here it is.
- dvt 5y ago
  > NOT an official government one Not sure how this is an "important detail," as it doesn't even make any difference: governments have a god-awful track record of securing data[1][2]. Any sane infosec professional realizes vaccine passports (or any other "passport" app) is a terrible idea. Heck, Apple has zero-day exploits like every other week. [1] https://www.infosecurity-magazine.com/news/us-leaks-pii-two-million-disaster-1-1/ https://www.infosecurity-magazine.com/news/us-leaks-pii-two-... [2] https://federalnewsnetwork.com/defense-news/2020/02/disa-exposes-personal-data-of-200000-defense-employees/ https://federalnewsnetwork.com/defense-news/2020/02/disa-exp...
  - EamonnMR 5y ago
    What's the alternative? A plastic card in the mail? people are replacing those with apps anyway.
    - dvt 5y ago
      > What's the alternative? A plastic card in the mail? Yes. A passport is orders of magnitude harder to forge than for some app written by a random government contractor to leak data.
      - nanis 5y ago
        Except that the digital ones allow frequent invalidation as the commercial and bureaucratic power centers collude.
      - DiogenesKynikos 5y ago
        Europe already has a simple, secure digital vaccine passport. You get a QR code that contains your name, date of birth, and the doses you've received. It's digitally signed by your national government, so that it can't be faked. Nobody needs to hold a centralized database of vaccinated people. Because it's just a QR code, you can store it however you'd like. If you want, you can print it out and carry it around in your pocket. It's easy to check: you just need to read the information and check that it's digitally signed by a trusted authority (both of these can be done by an app), and check the the person listed in the QR code is the person in front of you (e.g., by asking for an ID).
makeworld 5y ago
Still waiting on info on the vaccine passport app for Ontario, which is supposed to be rolled out on Oct 22. I'm hoping it'll be open source, but no one's mentioned it. Lot of potential for logging where everyone's going with an app like what is being proposed. Edit: Looks like the BC one is not open source, can't find it on GitHub: https://github.com/bcgov https://github.com/bcgov I can't find the Quebec gov GitHub account, so no idea on that. Probably closed as well.
- lytfyre 5y ago
  The BC covid passport verifier apps are open source - https://github.com/bcgov/BCVAX-Android https://github.com/bcgov/BCVAX-Android and https://github.com/bcgov/BCVAX-iOS https://github.com/bcgov/BCVAX-iOS respectively. There is no "user" passport app - the BC Health Gateway website generates a standard (https://smarthealth.cards/ https://smarthealth.cards/) QR code that you can save on phone, or print. The QR codes are signed, but not encrypted - you can dump the contents to verify the payload contains only what's described. Because it's just signature validation of the payload, they can be verified offline.
  - makeworld 5y ago
    Thanks, that's great to see.
- jszymborski 5y ago
  Can confirm the QC app is closed source.
ChrisArchitect 5y ago
Change title to what the article actually is instead of fueling misinformation with a generic title: Portpass app may have exposed hundreds of thousands of users' personal data
deleted 5y ago
[deleted]
whatever1 5y ago
With all of these breaches, back doors, on device scanning etc, I just assume that anything digital of mine is public. Don’t digitalize anything that you don’t want to share with the entire planet.
neom 5y ago
"Earlier in the day, the Calgary-based company's CEO Zakir Hussein had denied the app had verification or security issues and accused those who raised concerns about it of breaking the law." ... "'Someone that's out there is trying to destroy us here, and we're trying to build something good for people," he said.' ... 'There's holes, and what I'm realizing is I think there are some things that we need to fix here. And you know, we're trying to play catch-up, I guess, and trying to figure out where these holes are.' " We're trying to do something good, so when someone discovers we've done something bad, they're automatically trying to destroy us. Uh huh....
- canada_dry 5y ago
  Being from Calgary (which some call the 'Canadian Texas') and promoting a vaccine passport you'd think the guy would have pretty thick skin for criticism.
  - maccolgan 5y ago
    A city is called the Canadian Texas?
    - neom 5y ago
      I'm sure they mean Alberta, however given Alberta is basically either Edmonton or Calgary, sure, why not. :)
riffic 5y ago
these apps are going to be complete garbage as far as security and privacy goes and we all know it.
rsync 5y ago
I just returned from Zurich[1] which involved, of course, two pair of International entry/exit. While I was there, I availed myself of rapid antigen testing and my proof of vaccination with the canton of Zurich to attend several jazz shows and concerts (!) unmasked and with no covid restrictions. I used QR codes throughout. QR codes printed on paper, QR codes on a website that I pulled up in my phones browser, and once I even used a picture of a QR code in my photoreel that I pinch-zoomed into and properly scanned.[2] It appears that there is no use for, nor appetite for, covid vaccine passport apps. This makes me very happy because I have envisioned, through the entire pandemic, some perfect storm of pairing a smartphone to yourself, as an individual, and tying identification to it and being forced to register the phone and the app and yourself and the SIM card ... and what a mess that would end up being. Instead, it appears we are all just going to produce QR codes in whatever way works best for us and if the scanner beeps and turns green, nobody cares what else is going on. [1] https://twitter.com/rsyncnet/status/1435981763864584201 https://twitter.com/rsyncnet/status/1435981763864584201 [2] ... and just to be clear, the photograph showed an entire printout with my name, etc., on it - so it still was a proof of identitiy. Once that was cleared up, she zoomed in on the QR code and scanned. Easy.
vlad88sv 5y ago
I think El Salvador's Vaccine passport is the one of the best around.
cloudedcordial 5y ago
I am from Canada (not Alberta) and am waiting for an in-depth analysis of how this breach works. The quotes from the CEO makes the development team has not carry out the basis of well-known security practices. The CEO denied the issue but the app has been offline. Playing catch up is too late. Security is something you stay ahead of the game continuously.
theHIDninja 5y ago
It's almost like granting access to people's medical records would cause problems. Who would have thought? Authoritarians were insanely opportunistic in using this Chinese virus to ruin people's lives.
johngod 5y ago
Welcome to the Clown World. You visit the Circus, expect a show.
deleted 5y ago
[deleted]
penultimatebro 5y ago
Let’s think outside the box a bit here. If we see a few more of these leaks, it’s reasonable to assume that they’re leaked on purpose. Why? So that vaccination status won’t be private health data anymore, it will slowly work it’s way towards being public information. With the data public, non-compliers can be harassed, threatened or worse without governments having to lift a finger to oppress them.
HelixEndeavor 5y ago
I have a great solution for not having to worry about your data being leaked from these apps: don't install them. Fuck COVID passports.
joelbondurant 5y ago
Great list of gullible betacucks.

189 points by jlos 5y ago

philwelch 5y ago

Working as designed?

cguess 5y ago
I get that you're being edgy, but I'll ask a serious question: If we assume this was a design purpose, to what end would it be useful?
- version_five 5y ago
  I dont think it's necessary true (and certainly not helpful) to say the parent is being "edgy" - though I have noticed that's the new internet insult used to casually dismiss different ideas. His point also could have been that the app exists literally to share your sensitive personal information with other parties...
  - r00fus 5y ago
    Guessing at a 3-word comment's meaning ignores the point that it's nearly content free, so deserves the derision.
- philwelch 5y ago
  This particular breach was, I admit, probably not a design purpose. Apparently they unintentionally exposed completely different personal data than they originally intended to. On a broader scale, it makes sense that people who build vaccine passport apps and people who are passionate about personal privacy are non-overlapping sets of people.
- tyingq 5y ago
  I don't think they thought beyond the requirement of "scanning a barcode and submitting a query based on the contents of the barcode". The barcode probably returns a userid or something else that's guessable or iterable.

barbazoo 5y ago

> Hussein said Tuesday morning that the breach only lasted for minutes, and repeated that claim when CBC pointed out it had reviewed the personal information for more than an hour — and it's unknown how long the information was exposed before that tip was received. That person doesn't make the impression that they're honest and humble enough to handle people's personal information. > Alberta currently does not have an official proof-of-vaccination app, and the province's PDF vaccine record has been criticized for being easy to edit. This confused me. Don't they have a QR code that gets read and verified and must match the person's name?

smnrchrds 5y ago
No, but they are planning one. The current proof of vaccination is a simple PDF with no verification features or signature. Anyone with a PDF editor can take an existing PDF and put their name on it. Alberta was not planning on having a vaccine passport system until about two weeks ago, when the number of cases and hospitalizations got so high the government could no longer ignore it. Because of the late start, it's going to take a while until the QR code system is ready.
katbyte 5y ago
No, from what i understand just a PDF you download thats easy to edit: https://beta.ctvnews.ca/local/calgary/2021/9/14/1_5585393/_jcr_content/root/responsivegrid/image.coreimg.jpeg/1631715087586/1-5584975.jpeg https://beta.ctvnews.ca/local/calgary/2021/9/14/1_5585393/_j... alberta yet again drops the ball. Maybe you are thinking about BC who rolled out a signed QR code that could be saved on the phone/printed + an app from the government that does verification.
- smnrchrds 5y ago
  Out of the four big provinces, two (BC and Quebec) have released their vaccine passport app and QR code system and the other two (Alberta and Ontario) are still in the process of rolling one out.
  - barbazoo 5y ago

adolph 5y ago

The first party asserts information a to third party which only the second party can verify. If the second party has no awareness of the third party or of a relationship between the first and third parties, how can the third party access the second party's verification without the ability to access the information of any first party?

dmix 5y ago
Indeed, this quote shows the app is basically useless: > > Hussein had denied that the app validated Yeung's false information, despite it appearing to do so, because he said the fake picture would be a giveaway. > "That's not true. We saw it on the back end and we were watching it.… So even if that user showed up, he wouldn't be able to utilize that picture because that's not him. So you wouldn't be able to get in. Secondly, that QR code, if someone scanned it, it would show that picture again," he said at the time. So there's basically no point in using this middleman then? You can just show them your ID... This app is just an overly complicated and dangerous middle man. You might as well take a photo of your IDs + vaccine PDF with your phones camera and use the photo gallery...

blacktriangle 5y ago

I'm old enough to remember back when those of us who said vaccine passports were coming were conspiracy theorists, now we're calmly talking about implementation details.

gdulli 5y ago
There have been conspiracies put forth about covid, but with various other vaccine mandates already in existence I don't know how it would ever have made sense to call it a conspiracy that we'd add one more. Nothing's changed, qualitatively. What's different here is that prior vaccine mandates were never weaponized into a mainstream culture war, so before this they weren't controversial to most and we rarely thought of them. Given that culture war hesitancy over this vaccine was expected early on, I think it was predictable that employers and venues would need to require it in order for it to reach enough of the population to be effective.
ipspam 5y ago
Some people may be, others are planning to get tickets and crash the system.
traloid 5y ago
Im old enough to remember that people thinking NSA/CIA is watching everyone's internet activity were universally considered deranged schizophrenics. Whatever fears we have about privacy always turn out to be grossly optimistic underestimates. The next step is, of course, that these emergency measures will remain in place forever.
astura 5y ago
This isn't a new concept - You've been required to show proof of immunizations to register for public school (including college) and get a visa (or immigrate) for decades. It's a bit annoying when you start college when you are 38 years old and you no longer have any of your pediatric medical records, which happened to a friend of mine. For my friend the school accepted an antibody test, which a friend of mine had to get.
- 5y ago

richwater 5y ago

Wow, I'm flabbergasted.

yabones 5y ago

An important detail - this was a third party app, NOT an official government one. So, people were essentially uploading their PII to some guy's server and hoping for the best. This is what we all feared, and hoped wouldn't happen. But here it is.

dvt 5y ago
> NOT an official government one Not sure how this is an "important detail," as it doesn't even make any difference: governments have a god-awful track record of securing data[1][2]. Any sane infosec professional realizes vaccine passports (or any other "passport" app) is a terrible idea. Heck, Apple has zero-day exploits like every other week. [1] https://www.infosecurity-magazine.com/news/us-leaks-pii-two-million-disaster-1-1/ https://www.infosecurity-magazine.com/news/us-leaks-pii-two-... [2] https://federalnewsnetwork.com/defense-news/2020/02/disa-exposes-personal-data-of-200000-defense-employees/ https://federalnewsnetwork.com/defense-news/2020/02/disa-exp...
- EamonnMR 5y ago
  What's the alternative? A plastic card in the mail? people are replacing those with apps anyway.
  - dvt 5y ago
    > What's the alternative? A plastic card in the mail? Yes. A passport is orders of magnitude harder to forge than for some app written by a random government contractor to leak data.
    - nanis 5y ago
      Except that the digital ones allow frequent invalidation as the commercial and bureaucratic power centers collude.
    - DiogenesKynikos 5y ago
      Europe already has a simple, secure digital vaccine passport. You get a QR code that contains your name, date of birth, and the doses you've received. It's digitally signed by your national government, so that it can't be faked. Nobody needs to hold a centralized database of vaccinated people. Because it's just a QR code, you can store it however you'd like. If you want, you can print it out and carry it around in your pocket. It's easy to check: you just need to read the information and check that it's digitally signed by a trusted authority (both of these can be done by an app), and check the the person listed in the QR code is the person in front of you (e.g., by asking for an ID).

makeworld 5y ago

Still waiting on info on the vaccine passport app for Ontario, which is supposed to be rolled out on Oct 22. I'm hoping it'll be open source, but no one's mentioned it. Lot of potential for logging where everyone's going with an app like what is being proposed. Edit: Looks like the BC one is not open source, can't find it on GitHub: https://github.com/bcgov https://github.com/bcgov I can't find the Quebec gov GitHub account, so no idea on that. Probably closed as well.

lytfyre 5y ago
The BC covid passport verifier apps are open source - https://github.com/bcgov/BCVAX-Android https://github.com/bcgov/BCVAX-Android and https://github.com/bcgov/BCVAX-iOS https://github.com/bcgov/BCVAX-iOS respectively. There is no "user" passport app - the BC Health Gateway website generates a standard (https://smarthealth.cards/ https://smarthealth.cards/) QR code that you can save on phone, or print. The QR codes are signed, but not encrypted - you can dump the contents to verify the payload contains only what's described. Because it's just signature validation of the payload, they can be verified offline.
- makeworld 5y ago
  Thanks, that's great to see.
jszymborski 5y ago
Can confirm the QC app is closed source.

ChrisArchitect 5y ago

Change title to what the article actually is instead of fueling misinformation with a generic title: Portpass app may have exposed hundreds of thousands of users' personal data

deleted 5y ago

[deleted]

whatever1 5y ago

With all of these breaches, back doors, on device scanning etc, I just assume that anything digital of mine is public. Don’t digitalize anything that you don’t want to share with the entire planet.

neom 5y ago

"Earlier in the day, the Calgary-based company's CEO Zakir Hussein had denied the app had verification or security issues and accused those who raised concerns about it of breaking the law." ... "'Someone that's out there is trying to destroy us here, and we're trying to build something good for people," he said.' ... 'There's holes, and what I'm realizing is I think there are some things that we need to fix here. And you know, we're trying to play catch-up, I guess, and trying to figure out where these holes are.' " We're trying to do something good, so when someone discovers we've done something bad, they're automatically trying to destroy us. Uh huh....

canada_dry 5y ago
Being from Calgary (which some call the 'Canadian Texas') and promoting a vaccine passport you'd think the guy would have pretty thick skin for criticism.
- maccolgan 5y ago
  A city is called the Canadian Texas?
  - neom 5y ago
    I'm sure they mean Alberta, however given Alberta is basically either Edmonton or Calgary, sure, why not. :)

riffic 5y ago

these apps are going to be complete garbage as far as security and privacy goes and we all know it.

rsync 5y ago

I just returned from Zurich[1] which involved, of course, two pair of International entry/exit. While I was there, I availed myself of rapid antigen testing and my proof of vaccination with the canton of Zurich to attend several jazz shows and concerts (!) unmasked and with no covid restrictions. I used QR codes throughout. QR codes printed on paper, QR codes on a website that I pulled up in my phones browser, and once I even used a picture of a QR code in my photoreel that I pinch-zoomed into and properly scanned.[2] It appears that there is no use for, nor appetite for, covid vaccine passport apps. This makes me very happy because I have envisioned, through the entire pandemic, some perfect storm of pairing a smartphone to yourself, as an individual, and tying identification to it and being forced to register the phone and the app and yourself and the SIM card ... and what a mess that would end up being. Instead, it appears we are all just going to produce QR codes in whatever way works best for us and if the scanner beeps and turns green, nobody cares what else is going on. [1] https://twitter.com/rsyncnet/status/1435981763864584201 https://twitter.com/rsyncnet/status/1435981763864584201 [2] ... and just to be clear, the photograph showed an entire printout with my name, etc., on it - so it still was a proof of identitiy. Once that was cleared up, she zoomed in on the QR code and scanned. Easy.

vlad88sv 5y ago

I think El Salvador's Vaccine passport is the one of the best around.

cloudedcordial 5y ago

I am from Canada (not Alberta) and am waiting for an in-depth analysis of how this breach works. The quotes from the CEO makes the development team has not carry out the basis of well-known security practices. The CEO denied the issue but the app has been offline. Playing catch up is too late. Security is something you stay ahead of the game continuously.

theHIDninja 5y ago

It's almost like granting access to people's medical records would cause problems. Who would have thought? Authoritarians were insanely opportunistic in using this Chinese virus to ruin people's lives.

johngod 5y ago

Welcome to the Clown World. You visit the Circus, expect a show.

deleted 5y ago

[deleted]

penultimatebro 5y ago

Let’s think outside the box a bit here. If we see a few more of these leaks, it’s reasonable to assume that they’re leaked on purpose. Why? So that vaccination status won’t be private health data anymore, it will slowly work it’s way towards being public information. With the data public, non-compliers can be harassed, threatened or worse without governments having to lift a finger to oppress them.

HelixEndeavor 5y ago

I have a great solution for not having to worry about your data being leaked from these apps: don't install them. Fuck COVID passports.

joelbondurant 5y ago

Great list of gullible betacucks.