3 ms·

Vaccine passports in Canada are implemented using the https://smarthealth.cards/ https://smarthealth.cards/ standard. The QR codes are verifiable offline using

Vaccine passports in Canada are implemented using the https://smarthealth.cards/ https://smarthealth.cards/ standard. The QR codes are verifiable offline using digital signatures. The app used in BC is open source and available on Github: https://github.com/bcgov/BCVAX-iOS https://github.com/bcgov/BCVAX-iOS https://github.com/bcgov/BCVAX-Android https://github.com/bcgov/BCVAX-Android It works just fine with the device in airplane mode, and does not maintain a record of the QR codes it has verified.

twofornone 5y ago
Yet? Why are you people so trusting when you know that these sorts of apps are one library and one function call away from mass surveillance mandated by some misleadingly titled bill? Surely Canada has a spiritual equivalent to the Patriot Act, no?
ipaddr 5y ago
Let's look at the details a little closer. You download a QR code from the government. You are identified at this point and linked to your test results given your QR code. Those open source clients are for BC only. Assuming the app store version matches those clients that ensures you are not being track in private businesses during a vaccine check. This doesn't ensure the federal system is using the same clients or other provinces. This doesn't ensure a vaccine passport check before boarding a train by a government official doesn't link your travel/location. The only thing we are sure is this will protect tracking at the private level in BC if the business has airplane mode on and both have downloaded and built the client themselves.
- coronqueue 5y ago
  In BC, secretly engaging in tracking would be both illegal and contrary to public policy. The system was reviewed by https://www.oipc.bc.ca/ https://www.oipc.bc.ca/ as part of the rollout, and it's privacy-preserving properties were an essential part of the system being deemed acceptable. There are multiple independent open source implementations of the SMART Health Card QR standard. It's really just some JSON + compression/encoding/digital signature. The approach I have described is being used across Canada, and based on what has been indicated so far, this is in fact the intended direction of the federal government. Vaccine passport checks are not conducted by government officials. They are conducted by the private businesses where the checks take place. iOS 15 includes "app privacy report" functionality, and if the government were secretly submitting a different version to the app store than they claim they are (with secret reporting of scan data back to the mothership included in the app store builds), they would be trivially caught by anybody using this feature. It would show up in the network traffic logs that are available for anybody to inspect. Mobile applications are also not that difficult to decompile to identify hidden functionality. We can both be pretty sure that no tracking is taking place, and that it would be unrealistic for this system to be used for tracking purposes without that becoming a matter of public knowledge rather quickly.
  - ipaddr 5y ago
    At all travel points trains/planes the government will require a vaccine passport check. This check will require the person to provide id to match against the vaccine passport information. At this point your information/location are verified and entered into a government system. As for tracking by private companies. At your local pizza shop your location may not be tracked through the open source clients you list but at larger venues the opportunity for information gathering/sharing is possible. Previously one could buy a ticket to a game from someone outside now everyone eventing must identify themselves.

twofornone 5y ago

Yet? Why are you people so trusting when you know that these sorts of apps are one library and one function call away from mass surveillance mandated by some misleadingly titled bill? Surely Canada has a spiritual equivalent to the Patriot Act, no?

ipaddr 5y ago

Let's look at the details a little closer. You download a QR code from the government. You are identified at this point and linked to your test results given your QR code. Those open source clients are for BC only. Assuming the app store version matches those clients that ensures you are not being track in private businesses during a vaccine check. This doesn't ensure the federal system is using the same clients or other provinces. This doesn't ensure a vaccine passport check before boarding a train by a government official doesn't link your travel/location. The only thing we are sure is this will protect tracking at the private level in BC if the business has airplane mode on and both have downloaded and built the client themselves.

coronqueue 5y ago
In BC, secretly engaging in tracking would be both illegal and contrary to public policy. The system was reviewed by https://www.oipc.bc.ca/ https://www.oipc.bc.ca/ as part of the rollout, and it's privacy-preserving properties were an essential part of the system being deemed acceptable. There are multiple independent open source implementations of the SMART Health Card QR standard. It's really just some JSON + compression/encoding/digital signature. The approach I have described is being used across Canada, and based on what has been indicated so far, this is in fact the intended direction of the federal government. Vaccine passport checks are not conducted by government officials. They are conducted by the private businesses where the checks take place. iOS 15 includes "app privacy report" functionality, and if the government were secretly submitting a different version to the app store than they claim they are (with secret reporting of scan data back to the mothership included in the app store builds), they would be trivially caught by anybody using this feature. It would show up in the network traffic logs that are available for anybody to inspect. Mobile applications are also not that difficult to decompile to identify hidden functionality. We can both be pretty sure that no tracking is taking place, and that it would be unrealistic for this system to be used for tracking purposes without that becoming a matter of public knowledge rather quickly.
- ipaddr 5y ago
  At all travel points trains/planes the government will require a vaccine passport check. This check will require the person to provide id to match against the vaccine passport information. At this point your information/location are verified and entered into a government system. As for tracking by private companies. At your local pizza shop your location may not be tracked through the open source clients you list but at larger venues the opportunity for information gathering/sharing is possible. Previously one could buy a ticket to a game from someone outside now everyone eventing must identify themselves.