6 ms·

> Hussein said Tuesday morning that the breach only lasted for minutes, and repeated that claim when CBC pointed out it had reviewed the personal information fo

> Hussein said Tuesday morning that the breach only lasted for minutes, and repeated that claim when CBC pointed out it had reviewed the personal information for more than an hour — and it's unknown how long the information was exposed before that tip was received. That person doesn't make the impression that they're honest and humble enough to handle people's personal information. > Alberta currently does not have an official proof-of-vaccination app, and the province's PDF vaccine record has been criticized for being easy to edit. This confused me. Don't they have a QR code that gets read and verified and must match the person's name?

smnrchrds 5y ago
No, but they are planning one. The current proof of vaccination is a simple PDF with no verification features or signature. Anyone with a PDF editor can take an existing PDF and put their name on it. Alberta was not planning on having a vaccine passport system until about two weeks ago, when the number of cases and hospitalizations got so high the government could no longer ignore it. Because of the late start, it's going to take a while until the QR code system is ready.
katbyte 5y ago
No, from what i understand just a PDF you download thats easy to edit: https://beta.ctvnews.ca/local/calgary/2021/9/14/1_5585393/_jcr_content/root/responsivegrid/image.coreimg.jpeg/1631715087586/1-5584975.jpeg https://beta.ctvnews.ca/local/calgary/2021/9/14/1_5585393/_j... alberta yet again drops the ball. Maybe you are thinking about BC who rolled out a signed QR code that could be saved on the phone/printed + an app from the government that does verification.
- smnrchrds 5y ago
  Out of the four big provinces, two (BC and Quebec) have released their vaccine passport app and QR code system and the other two (Alberta and Ontario) are still in the process of rolling one out.
  - barbazoo 5y ago
    I hope at least some of the tech is shared between provinces
    - morvita 5y ago
      I'm not sure how Quebec's system works, but BC's vaccine cards are based on the SMART Health Card [0] standard. The validation app they've put out is open source [1]. I haven't looked at the validation app's code, but I assume the main reason the have their own app instead of pointing businesses to one of the existing SMART Health Card validators is so they can bundle the public keys used for verifying the QR data wasn't tampered with allowing the app to work offline. The SMART Health Card system does provide a way to download the public keys (I've checked and BC does publish them as expected), but it's probably easier to guarantee offline functionality here. [0] https://smarthealth.cards/index.html https://smarthealth.cards/index.html [1] https://github.com/bcgov/BCVAX-iOS https://github.com/bcgov/BCVAX-iOS, https://github.com/bcgov/BCVAX-Android https://github.com/bcgov/BCVAX-Android
      - fknorangesite 5y ago
        > I'm not sure how Quebec's system works An explanation: https://mikkel.ca/blog/digging-into-quebecs-proof-of-vaccination/ https://mikkel.ca/blog/digging-into-quebecs-proof-of-vaccina...
    - halostatue 5y ago
      snort Not with the bozos in charge of Alberta and Ontario. I _believe_ that Québec _offered_ Ontario parts of its app (the backend medical systems part would require something different) and our chuckleheads said “nah; we can build this in less than 90 days” (it took Québec ~4 months).
  - fknorangesite 5y ago
    Manitoba has had a system in place for several weeks. It's simple: the QR code is just a URL that exposes a yes/no and the person's name to be matched against photo ID. The person scanning has to download the (free) official app to avoid someone setting up a copycat site, but that's trivial.
- raxxorrax 5y ago
  Wouldn't I only need an image viewer? I have my QR code saved as an image. Didn't need it yet and I think I might delete it after I went for holidays. To be honest, I think this form of passport isn't worthy to support, so I wouldn't condemn Alberta here too much (not from the US)
  - katbyte 5y ago
    to show it? yea you just show the QR code. then someone with the app scans it to verify it
deanclatworthy 5y ago
Can someone tell me how the verification works? From what I understand the data is signed. So someone has the key? Who controls the keys? We have an EU wide passport so are governments sharing the keys? There is an app for validating the codes in some countries so is that happening by hitting an API or are the keys in the apps? What I’m getting at here is how are they validating keys without leaking the keys used to sign?
- jeromegv 5y ago
  It's not signed (yet) in Alberta. It's a PDF with vaccine data on it.
- mqus 5y ago
  just a pretty standard certificate hierarchy, in germany the pharmacies can sign your information (when given your paper vaccination pass) and give you a QR Code, or you get it right when you get vaccinated. Obviously those are then the weak points and afaik there are ~25 root(/revocable?) keys for germany alone. Contained in the QR code are your name, DOB and which vaccinations you already got. So the QR code is only valid together with your Photo ID. > What I’m getting at here is how are they validating keys without leaking the keys used to sign? Public and private keys. Pharmacies and doctors have control over private keys/keys signed by the "root" keys. The checking app has the public keys and can check if the signature of the data is valid (matches the data and the private keys).
  - deanclatworthy 5y ago
    This isn’t secure re: your last point. If every country in Europe has numerous private keys it’s inevitable they’re leaked and used to sign fake vaccine passes.
    - mqus 5y ago
      They have numerous private keys precisely because of leakage risk. In that case only one (or two) of them will get leaked (and then hopefully revoked), leaving the others intact.
Johnie 5y ago
>"Someone that's out there is trying to destroy us here, and we're trying to build something good for people," he said. >"There's holes, and what I'm realizing is I think there are some things that we need to fix here. And you know, we're trying to play catch-up, I guess, and trying to figure out where these holes are." This is not very reassuring statements from the CEO of a company that is handling sensitive data!
- siruncledrew 5y ago
  Jeez… that’s about as much of a “fuck off it’s not our problem” response the CEO could have given… I bet it would be different if their data was open to the public.
- colpabar 5y ago
  I'm wondering how they were even allowed to store this data. Doesn't storing personal medical info of any kind require a bunch of official certifications?

smnrchrds 5y ago

No, but they are planning one. The current proof of vaccination is a simple PDF with no verification features or signature. Anyone with a PDF editor can take an existing PDF and put their name on it. Alberta was not planning on having a vaccine passport system until about two weeks ago, when the number of cases and hospitalizations got so high the government could no longer ignore it. Because of the late start, it's going to take a while until the QR code system is ready.

katbyte 5y ago

No, from what i understand just a PDF you download thats easy to edit: https://beta.ctvnews.ca/local/calgary/2021/9/14/1_5585393/_jcr_content/root/responsivegrid/image.coreimg.jpeg/1631715087586/1-5584975.jpeg https://beta.ctvnews.ca/local/calgary/2021/9/14/1_5585393/_j... alberta yet again drops the ball. Maybe you are thinking about BC who rolled out a signed QR code that could be saved on the phone/printed + an app from the government that does verification.

smnrchrds 5y ago
Out of the four big provinces, two (BC and Quebec) have released their vaccine passport app and QR code system and the other two (Alberta and Ontario) are still in the process of rolling one out.
- barbazoo 5y ago
  I hope at least some of the tech is shared between provinces
  - morvita 5y ago
    I'm not sure how Quebec's system works, but BC's vaccine cards are based on the SMART Health Card [0] standard. The validation app they've put out is open source [1]. I haven't looked at the validation app's code, but I assume the main reason the have their own app instead of pointing businesses to one of the existing SMART Health Card validators is so they can bundle the public keys used for verifying the QR data wasn't tampered with allowing the app to work offline. The SMART Health Card system does provide a way to download the public keys (I've checked and BC does publish them as expected), but it's probably easier to guarantee offline functionality here. [0] https://smarthealth.cards/index.html https://smarthealth.cards/index.html [1] https://github.com/bcgov/BCVAX-iOS https://github.com/bcgov/BCVAX-iOS, https://github.com/bcgov/BCVAX-Android https://github.com/bcgov/BCVAX-Android
    - fknorangesite 5y ago
      > I'm not sure how Quebec's system works An explanation: https://mikkel.ca/blog/digging-into-quebecs-proof-of-vaccination/ https://mikkel.ca/blog/digging-into-quebecs-proof-of-vaccina...
  - halostatue 5y ago
    snort Not with the bozos in charge of Alberta and Ontario. I _believe_ that Québec _offered_ Ontario parts of its app (the backend medical systems part would require something different) and our chuckleheads said “nah; we can build this in less than 90 days” (it took Québec ~4 months).
- fknorangesite 5y ago
  Manitoba has had a system in place for several weeks. It's simple: the QR code is just a URL that exposes a yes/no and the person's name to be matched against photo ID. The person scanning has to download the (free) official app to avoid someone setting up a copycat site, but that's trivial.
raxxorrax 5y ago
Wouldn't I only need an image viewer? I have my QR code saved as an image. Didn't need it yet and I think I might delete it after I went for holidays. To be honest, I think this form of passport isn't worthy to support, so I wouldn't condemn Alberta here too much (not from the US)
- katbyte 5y ago
  to show it? yea you just show the QR code. then someone with the app scans it to verify it

deanclatworthy 5y ago

Can someone tell me how the verification works? From what I understand the data is signed. So someone has the key? Who controls the keys? We have an EU wide passport so are governments sharing the keys? There is an app for validating the codes in some countries so is that happening by hitting an API or are the keys in the apps? What I’m getting at here is how are they validating keys without leaking the keys used to sign?

jeromegv 5y ago
It's not signed (yet) in Alberta. It's a PDF with vaccine data on it.
mqus 5y ago
just a pretty standard certificate hierarchy, in germany the pharmacies can sign your information (when given your paper vaccination pass) and give you a QR Code, or you get it right when you get vaccinated. Obviously those are then the weak points and afaik there are ~25 root(/revocable?) keys for germany alone. Contained in the QR code are your name, DOB and which vaccinations you already got. So the QR code is only valid together with your Photo ID. > What I’m getting at here is how are they validating keys without leaking the keys used to sign? Public and private keys. Pharmacies and doctors have control over private keys/keys signed by the "root" keys. The checking app has the public keys and can check if the signature of the data is valid (matches the data and the private keys).
- deanclatworthy 5y ago
  This isn’t secure re: your last point. If every country in Europe has numerous private keys it’s inevitable they’re leaked and used to sign fake vaccine passes.
  - mqus 5y ago
    They have numerous private keys precisely because of leakage risk. In that case only one (or two) of them will get leaked (and then hopefully revoked), leaving the others intact.

Johnie 5y ago

>"Someone that's out there is trying to destroy us here, and we're trying to build something good for people," he said. >"There's holes, and what I'm realizing is I think there are some things that we need to fix here. And you know, we're trying to play catch-up, I guess, and trying to figure out where these holes are." This is not very reassuring statements from the CEO of a company that is handling sensitive data!

siruncledrew 5y ago
Jeez… that’s about as much of a “fuck off it’s not our problem” response the CEO could have given… I bet it would be different if their data was open to the public.
colpabar 5y ago
I'm wondering how they were even allowed to store this data. Doesn't storing personal medical info of any kind require a bunch of official certifications?