4 ms·

What's the alternative? A plastic card in the mail? people are replacing those with apps anyway.

dvt 5y ago
> What's the alternative? A plastic card in the mail? Yes. A passport is orders of magnitude harder to forge than for some app written by a random government contractor to leak data.
- nanis 5y ago
  Except that the digital ones allow frequent invalidation as the commercial and bureaucratic power centers collude.
- DiogenesKynikos 5y ago
  Europe already has a simple, secure digital vaccine passport. You get a QR code that contains your name, date of birth, and the doses you've received. It's digitally signed by your national government, so that it can't be faked. Nobody needs to hold a centralized database of vaccinated people. Because it's just a QR code, you can store it however you'd like. If you want, you can print it out and carry it around in your pocket. It's easy to check: you just need to read the information and check that it's digitally signed by a trusted authority (both of these can be done by an app), and check the the person listed in the QR code is the person in front of you (e.g., by asking for an ID).
3np 5y ago
Utilizing zero-knowledge proofs and cryptography so things can be proven without sharing of the underlying data needed for traditional validation. There has been a lot of progress both in fundamentals and implementations on this front over recent years but even decades old schemes using attestations would have been a huge improvement over “dump and read data through trusted server”. Here’s a trivial one that anyone could implement without using anything new from the past decade: Whoever stands as “trusted party” could have signing certificates distributed to the verifier-side of the app. They sign hashes of the relevant info. All data sharing needed is once per issuance of “vaccination certificate”. No persistence of PII necessary. If you don’t want to have to disclose PII as part of validation, that’s where the fancier schemes come in. If you can’t or won’t spend resources to do it properly then yes, physical card is preferred.
- DiogenesKynikos 5y ago
  This is exactly what Europe does. In a sane world, every country would just adopt the same QR-code standard.
  - 3np 5y ago
    It’s still not great from a privacy perspective. Date of birth, names, and granular details on vaccinations are cleartext, among other things. It’s not that terrible compared to what’s out there and falls in the “trivial” category (which is not necessarily a negative; less complexity is good) but it’s far from ideal and it’d have to improve before pushing it globally.
    - melolife 5y ago
      The challenge is that the validator sets the rules for who is vaccinated. As an example, some jurisdictions might declare individuals with single doses protected. Another real example: the EU is unwilling to accept Covishield vaccinations, despite it being AstraZeneca/Vaxzevria manufactured in India.
    - DiogenesKynikos 5y ago
      The whole point of a vaccine passport is to expose information about your vaccination status to third parties. I don't see this as any different than carrying around any other ID in my wallet. My driver's license also has my name and date of birth (plus information about my eyesight and home address). The nice thing about the vaccination passport is that it is like a card in your wallet. There's no centralized server that's being queried. It's offline and distributed.
_Algernon_ 5y ago
A verifiable QR-code system where the medium doesn't matter such as the one in Europe. Use a screenshot, print it on paper, doesn't matter.
- rsync 5y ago
  I can confirm. See my comment upthread about recent trip to Switzerland. I did all of these things (printed, screenshot, pulled up a webpage) and also had a successful scan of a picture of a QR code that I had in my photoreel (which showed the entire printout, of course, with my name, etc. on it).
- __turbobrew__ 5y ago
  This is how BC does it. You get a QR code which you can either present on your phone or as a print out.
  - fknorangesite 5y ago
    Manitoba as well.
- EamonnMR 5y ago
  That sounds pretty reasonable, yeah.
MadeThisToReply 5y ago
Not bothering with a movement license (sorry, "vaccine passport") in the first place?
syshum 5y ago
Umm no Vaccine Passport at all... How about that. The amount of tyranny people are willing to accept as a response to this is still baffling to me, it is like this is the first time humanity has ever encountered a communicable illness... This is not the proper way to respond to said illness and does not bode well for the future of individual liberty

dvt 5y ago

> What's the alternative? A plastic card in the mail? Yes. A passport is orders of magnitude harder to forge than for some app written by a random government contractor to leak data.

nanis 5y ago
Except that the digital ones allow frequent invalidation as the commercial and bureaucratic power centers collude.
DiogenesKynikos 5y ago
Europe already has a simple, secure digital vaccine passport. You get a QR code that contains your name, date of birth, and the doses you've received. It's digitally signed by your national government, so that it can't be faked. Nobody needs to hold a centralized database of vaccinated people. Because it's just a QR code, you can store it however you'd like. If you want, you can print it out and carry it around in your pocket. It's easy to check: you just need to read the information and check that it's digitally signed by a trusted authority (both of these can be done by an app), and check the the person listed in the QR code is the person in front of you (e.g., by asking for an ID).

3np 5y ago

Utilizing zero-knowledge proofs and cryptography so things can be proven without sharing of the underlying data needed for traditional validation. There has been a lot of progress both in fundamentals and implementations on this front over recent years but even decades old schemes using attestations would have been a huge improvement over “dump and read data through trusted server”. Here’s a trivial one that anyone could implement without using anything new from the past decade: Whoever stands as “trusted party” could have signing certificates distributed to the verifier-side of the app. They sign hashes of the relevant info. All data sharing needed is once per issuance of “vaccination certificate”. No persistence of PII necessary. If you don’t want to have to disclose PII as part of validation, that’s where the fancier schemes come in. If you can’t or won’t spend resources to do it properly then yes, physical card is preferred.

DiogenesKynikos 5y ago
This is exactly what Europe does. In a sane world, every country would just adopt the same QR-code standard.
- 3np 5y ago
  It’s still not great from a privacy perspective. Date of birth, names, and granular details on vaccinations are cleartext, among other things. It’s not that terrible compared to what’s out there and falls in the “trivial” category (which is not necessarily a negative; less complexity is good) but it’s far from ideal and it’d have to improve before pushing it globally.
  - melolife 5y ago
    The challenge is that the validator sets the rules for who is vaccinated. As an example, some jurisdictions might declare individuals with single doses protected. Another real example: the EU is unwilling to accept Covishield vaccinations, despite it being AstraZeneca/Vaxzevria manufactured in India.
  - DiogenesKynikos 5y ago
    The whole point of a vaccine passport is to expose information about your vaccination status to third parties. I don't see this as any different than carrying around any other ID in my wallet. My driver's license also has my name and date of birth (plus information about my eyesight and home address). The nice thing about the vaccination passport is that it is like a card in your wallet. There's no centralized server that's being queried. It's offline and distributed.

_Algernon_ 5y ago

A verifiable QR-code system where the medium doesn't matter such as the one in Europe. Use a screenshot, print it on paper, doesn't matter.

rsync 5y ago
I can confirm. See my comment upthread about recent trip to Switzerland. I did all of these things (printed, screenshot, pulled up a webpage) and also had a successful scan of a picture of a QR code that I had in my photoreel (which showed the entire printout, of course, with my name, etc. on it).
__turbobrew__ 5y ago
This is how BC does it. You get a QR code which you can either present on your phone or as a print out.
- fknorangesite 5y ago
  Manitoba as well.
EamonnMR 5y ago
That sounds pretty reasonable, yeah.

MadeThisToReply 5y ago

Not bothering with a movement license (sorry, "vaccine passport") in the first place?

syshum 5y ago

Umm no Vaccine Passport at all... How about that. The amount of tyranny people are willing to accept as a response to this is still baffling to me, it is like this is the first time humanity has ever encountered a communicable illness... This is not the proper way to respond to said illness and does not bode well for the future of individual liberty