17 ms·

Private keys used to sign EU Digital Covid Certificate might have been leaked

207 points by qsort 5y ago

menimaxi 5y ago
Just wonder, how any of you vaccine masterminds would explain how vax scanners for PEOPLE are comming and how will they detect if you really had the shot? How would that be possible without some magnetic stuff in you blood? Now you know why is so "important" to let go on the green pass, cause you ganna be a walking magnet for simple metal detectors, presented as state of the art new science.
- xdennis 5y ago
  Not sure why downvoted. This is a legitimate point. In Romania it's possible to get "sink vaccinated". That is, the doctor squirts the syringe into a sink instead of in you, and you get 100 % valid papers to show your local wannabe Arstotzka agent. Having a covid passport proves nothing. They'll have to scan your blood like in Gattaca.
i_have_an_idea 5y ago
Very worrying if true
- xdennis 5y ago
  It's also a ray of hope for people shut off from the world.
- ryanlol 5y ago
  Great news, just further demonstrates that these systems should never have been built.
  - i_have_an_idea 5y ago
    What's the alternative? Every winter months of lockdowns, economic disruption, overflowing hospitals and hundreds of thousands of needless deaths? Just get your shots. Stop being pricks about it, it's not a big deal.
    - kri8 5y ago
      the alternative is not being a fucking loser and stop accepting whatever your government demands from you. Where do you draw the line?
    - ryanlol 5y ago
      >What’s the alternative? You said it yourself: >Just get your shots. Stop being pricks about it, it's not a big deal. Since fucking when do we need to build mass surveillance systems to encourage people to vaccinate? Why does it need to be a big deal? I don’t give a shit about vaccines (had my 2 shots as soon as they were available), but I genuinely believe that people pushing for pervasive vaccine passes do not deserve to live. Fucking develop technology to test if I actually had the vaccine, don’t try to use this as an excuse to check my documents.
- sgjohnson 5y ago
  No, very good. There are European countries that have went full stasi with "papers, please". Leaked private keys are liberation.
  - malermeister 5y ago
    Imagine comparing a simple health measure to the Stasi. Some folks on here take individualism to pathological levels.
    - sgjohnson 5y ago
      Starting with November 15, it will be illegal to employ unvaccinated people. They already can't enter supermarkets or access any "non-essential" services. "simple health measure", you literally need that + a form of ID to leave the home. And I cannot support that.
      - malermeister 5y ago
        You need a passport to leave your country. You need a drivers license to drive a car. It's illegal to employ people without a work visa. Relax. Don't pretend this is something new or the end of the world. This is how civilization works, through society making decisions on whats acceptable and what isn't. There's all sorts of sensible restrictions already and this is another one that makes sense.
        sgjohnson 5y ago
        There's no point in reasoning with you, if you believe that someone's private health information is a blanket reason to completely ruin their livelihood. Would be lovely if you were put in a position where it's something you don't want to (or can't) do, or your own government takes away your entire livelihood. But it would be fine, because that's how civilisation works, through society making decisions on whats acceptable and what isn't. There's all sorts of sensible. I would have a sweet, sweet "I told you so" moment, but I would still stand up for your rights.
mwint 5y ago
Did literally anyone not see this coming? We all know the government can’t hold on to keys. I fear this will be used as an excuse to make the passport system even more centralized.
- Bancakes 5y ago
  Why the downvotes? For sure, this will just have us install (or have preinstalled) DRM-locked proprietary apps on our phones. Ugh.
  - ethanbond 5y ago
    Downvotes because governments regularly hold secrets for years, decades, sometimes centuries. But yeah yeah, you can point to more than a few failures in the massive sample pool of “the government” so “government can’t hold keys.”
- gpderetta 5y ago
  As opposed to private entities that are known to be able to keep keys secret all the time?
  - switch007 5y ago
    They didn’t suggest that at all.
  - cm2187 5y ago
    Don't know if this is whst the OP has in mind, but the first thing that comes to my mind is the backdoor that many states want to impose on all encrypted communications. That would create a single point of attack, so even assuming competence, it makes the system significantly weaker. And this episode if confirmed makes competence a strong assumption.
    - gpderetta 5y ago
      It very much points to incompetence. I just don't think governments are specifically more incompetent than private entities in this case.
CodesInChaos 5y ago
Nobody verified my code so far, they just eyeball the app. So the practical impact of such a leak is probably small, since people will fall for dumb forgeries already.
- raxxorrax 5y ago
  Exactly my experience. Not a fan of a vaccine pass, but I did show it at a restaurant they didn't even know what to do with it. Looked at it a bit confused, said 'yes, yes' and that was it. No check whatsoever. I don't mind that at all to be honest. Airports check it, but other than that...
- deleted 5y ago
  [deleted]
- stavros 5y ago
  In Greece, the vast majority verifies certificates, with high-density venues like clubs asking for ID as well.
  - LammyL 5y ago
    I was in Greece (Santorini) for the past 5 days and nobody asked about COVID certificate and hardly anyone wore a mask.
- torben-friis 5y ago
  I had it verified constantly, both in airports and (on a trip to Italy) on pretty much every restaurant or bar I went to. I think it was only once that they were fine with showing it, all the others had scanners.
  - lixtra 5y ago
    But did you have to show an ID or could you just show a John Doe certificate?
    - 5y ago
archi42 5y ago
There is a second link that's also popular right now: https://github.com/ehn-dcc-development/hcert-spec/issues/103 https://github.com/ehn-dcc-development/hcert-spec/issues/103 Discussion: https://news.ycombinator.com/item?id=29011537 https://news.ycombinator.com/item?id=29011537 (1 comment) The alternate seems to be actually more popular (22 pts vs 6 pts), but I suppose that the HN algorithm seems to rate it down due to pointing to GitHub?
Hokusai 5y ago
Certificates in Sweden are valid for 3 months. So, if it's the same for Italy then it's not good but not catastrophic either.
- gpderetta 5y ago
  Apparently the leaked keys have already been blacklisted. So all certificates signed with the leaked keys will need to be reissued. FWIW, it wasn't the Italian key that was leaked.
  - ginko 5y ago
    They seem to be quite thorough with checking QR certificates in Italy so it doesn't surprize me if this was discovered there.
    - gpderetta 5y ago
      Very anecdotally I spent three weeks in Italy this summer and my (UK) covid pass wasn't checked even once (In fact I also had to spend 5 days or something in isolation and nobody ever bothered to check or followup). I understand that compliance is very location specific.
      - darkwater 5y ago
        In summer it wasn't yet mandatory AFAIK (and in fact Italy was using a slightly different certificate back then)
      - toyg 5y ago
        They got strict in the last month; now if you can't present a pass you might even be refused your salary. There have been demonstrations about this, as you might expect. I agree that the tracing this summer was less than perfunctory, my brother had your same experience (his girlfriend wasn't even "declared", and nobody checked), and there was no Green Pass at all. Everyone wanted the tourists back so badly that the overall approach was to basically tick checkboxes and leave it at that. They got serious when it became clear the virus would be around all winter because of the Delta variant.
capableweb 5y ago
Seems the keys have already been revoked. Doesn't mean it can't leak again, but doesn't seem to be a problem with a leaked key at the moment. Actual source seems to be here: https://rfmirror.com/Thread-TRADING-make-EU-green-pass?page=46 https://rfmirror.com/Thread-TRADING-make-EU-green-pass?page=...
- tiagod 5y ago
  Certificate still works on the Portuguese cert checking app as of 13:35 GMT
- lmilcin 5y ago
  What about people who got legit certificates but now the key it used has been revoked?
  - gpderetta 5y ago
    At least in UK the app will generate a new certificate on the fly.
    - lmilcin 5y ago
      I am not using an app. I am not installing any third party apps on my phone, government or not, period. The certificate I am using is printed on a piece of paper I carry with me.
      - gpderetta 5y ago
        well, print it again then.
        lmilcin 5y ago
        I know this, but a lot of people may not know because they don't care to read HN. Then they try to board a plane and get rejected.
kuroguro 5y ago
Does it have to be the keys that are leaked? There should be hundreds of healthcare workers who have access to the covid certificate system. I find it more likely there's an option to enter custom data for non-citizens and someone was just messing around.
- gpderetta 5y ago
  Maybe some unprotected API gateway?
- tkfu 5y ago
  I think that's absolutely the most likely. And it's not hundreds, it's probably more like tens of thousands (or more). For example, when I got mine issued in Germany, I just went to a pharmacy, gave them my ID and (paper) vaccination record, and the pharmacist came back in a couple of minutes with my QR code. The interesting thing to watch, over the coming days, is this: will the public policy response do the technically correct thing, and make sure that you need all your original documentation (signed records from the doctor's office, etc.) to get your new covpass issued? Or will they do something incorrect (but easy), like let people come in with their now-invalid pass plus a government ID to get a new one issued?
  - csunbird 5y ago
    I am not sure how the key management works, maybe they are just issuing private keys to each pharmacy, and if any pharmacy just went rogue, it should be extremely easy to know which one the certificate is coming from. Also, it is easy to get a valid vaccination code anyways, for example, I took a friend of mine, who was vaccinated out of EU, to a pharmacy and nicely asked if he can have a certificate for travel. They just glanced at the his vaccination dates and gave us qr codes, no questions asked. The yellow booklet is easy to forge as well.
    - jagger27 5y ago
      > maybe they are just issuing private keys to each pharmacy That seems too complicated for every single pharmacy in Europe. I bet they just punch in some data to a web app and it does the actual cryptographic signing. > I took a friend of mine, who was vaccinated out of EU, to a pharmacy and nicely asked if he can have a certificate for travel. They just glanced at the his vaccination dates and gave us qr codes, no questions asked. This seems no different than Joe pharmacist punching in Hitler. It's still a big problem, but it's not nearly as bad as leaking the actual private key.
mensetmanusman 5y ago
What will last longer, the pandemic or a poorly implemented digital identity platform?
- blitzar 5y ago
  Given it is the same "poorly implemented digital identity platform" that has been in use for the last 40 years, and secures basically every form of non in person communication you conduct, I am expecting that to continue for a bit longer.
  - adevx 5y ago
    It's a shame the comment of throwawayfear has been flagged/censored as it is a valid discussion about the oppressive nature of these passports (and apparently the discussion about it). In the Netherlands: As an unvaccinated individual you have to show a recent negative test before being able to enter a club/restaurant. So very low risk of unvaccinated people spreading Covid19. Yet, vaccinated individuals are allowed in, even when tested positive and feeling ill. There are numerous [0] cases of vaccinated individuals causing major outbreaks, resulting in the temporary closure of clubs and restaurants. It's hard to believe these passports are about reducing hospital admissions or the public health especially in light of increased breakthrough cases [1]. [0] (Dutch) http://www.destentor.nl/zutphen/zutphens-cafe-camelot-weekend-dicht-vanwege-coronabesmetting-het-kan-bij-elk-bedrijf-gebeuren~a9a6fde1/ http://www.destentor.nl/zutphen/zutphens-cafe-camelot-weeken... https://www.rtvutrecht.nl/nieuws/3106637/ https://www.rtvutrecht.nl/nieuws/3106637/ [1] https://www.nature.com/articles/s41591-021-01413-7 https://www.nature.com/articles/s41591-021-01413-7
    - blitzar 5y ago
      > It's hard to believe these passports are about reducing hospital admissions or the public health Go ahead.
- throwawayfear 5y ago
  These tyrants would love to hold on to these these digital “covid passports” because it gives them complete control over who can participate in society. They’d be able to exclude people who don’t comply with increasingly invasive protocols. It’s about power. The pandemic technically should already be considered endemic. For example in the USA the vast majority of the population has antibodies, in a significantly higher number than the 60 to 70 percent threshold that Fauci and other public servants claimed as the target over the last year. More than 80% of Americans have coronavirus antibodies acquired through infection or vaccination, according to a new study of over 1.4 million blood donations across the U.S. https://www.miamiherald.com/news/coronavirus/article253987048.html https://www.miamiherald.com/news/coronavirus/article25398704... And as reported on by Bloomberg and other media, the antibodies from past infection confer protection equal to or greater than Pfizer. https://www.bloomberg.com/news/articles/2021-08-27/previous-covid-prevents-delta-infection-better-than-pfizer-shot https://www.bloomberg.com/news/articles/2021-08-27/previous-... "Previous Covid Prevents Delta Infection Better Than Pfizer Shot" And those are slated to last for decades. Source: https://www.nature.com/ https://www.nature.com/ articles/d41586-021-01442-9 "Had COVID? You’ll probably make antibodies for a lifetime" On the exact terms given to us by Fauci and other public servants, there is no more reason for these covid mandates to exist. Should be optional across the board, including in EU countries where the threshold has been reached. Then there’s no more need to secure these keys.
traspler 5y ago
It seems like the Keys of one of the issuers got leaked, not the root keys so it looks like the fallout might be confined the the people who got their cert from that issuer (seems to be a french one). Or am I missing something?
deleted 5y ago
[deleted]
clon 5y ago
https://g.nh.ee/images/pix/1200x0/lYFSVUXJ5XY/1d2e261794d4d304e0-94980189.jpg?up=1 https://g.nh.ee/images/pix/1200x0/lYFSVUXJ5XY/1d2e261794d4d3... This QR code proves Adolf Hitler has received 2 doses of Pfizer vaccine. At the moment you can still use the Estonian app to verify this (https://kontroll.digilugu.ee https://kontroll.digilugu.ee). Probably this specific cert will be revoked soon in all the apps. But the cat is out of the bag. Everyone's grandparents will need to do the certificate retrieval dance again, which is another confusion that we did not need at this critical junction. Someone out there has a serious problem with ethics. Or someone really screwed up to the point where it was obvious that a responsible disclosure was already a moot point. In my experience, CERT-EU is normally very competent and would have handled it professionally.
- piaste 5y ago
  It (already?) records as invalid in the Italian app.
  - jerheinze 5y ago
    I think they might be checking against the online database, can you try to see if you replicate it offline? (if that's even possible)
  - ProZsolt 5y ago
    It works with the latest VerificaC19(Android)
- rmetzler 5y ago
  It's also shown as valid by the German CovPassCheck app.
  - soco 5y ago
    Maybe there's a real person named Adolf Hitler? Not from Germany for sure.
    - 5y ago
benkkey 5y ago
Is there any particular reason for the leakage? I can't seem to find any on the website
herodotus 5y ago
If you are wondering about Vaccine QR codes, see this article that explains how the "shc" (SMART Health Card) protocol is used to generate and decode the QR. https://marcan2020.medium.com/reversing-smart-health-cards-e765157fae9 https://marcan2020.medium.com/reversing-smart-health-cards-e...
- gnabgib 5y ago
  This isn't an SHC[0] it's an HC1[1] [0]: https://smarthealth.cards/ https://smarthealth.cards/ [1]: https://www.hc1.com/ https://www.hc1.com/
motohagiography 5y ago
What I read was they were seeing fake certificates - but these could be created by compromising the vax registration application and certificate download process. It could be done by compromising a vaccine clinic tablet and issuing new records into the main WHO CoVAX record database under arbitrary names, and then collecting the fake passport image from the web interface citizens use. I don't think you need to compromise the root certificate or signing keys to do this, there are easier ways. (But if I could put in a request for a Josef K., and an A. Solzhenitsyn novelty certificate, it would be a nice to have on my phone.)
intunderflow 5y ago
Repository to verify QR codes locally: https://github.com/ehn-dcc-development/ehn-sign-verify-python-trivial https://github.com/ehn-dcc-development/ehn-sign-verify-pytho...
sgjohnson 5y ago
Based on the information I've received, the private keys for all European countries have been leaked. There appears to be a centralised EU system where they all are stored.
mithron 5y ago
Finnish app[1] verifies as valid as of now. [1] https://thl.fi/en/web/infectious-diseases-and-vaccinations/what-s-new/coronavirus-covid-19-latest-updates/vaccines-and-coronavirus/covid-19-vaccination-certificate/covid-certificate-reader https://thl.fi/en/web/infectious-diseases-and-vaccinations/w...
framecowbird 5y ago
For all practical everyday use, this doesn't matter. Nobody has ever even checked my ID card has the same name as in the app, let alone scanned the QR code to verify. They just glance and that gives them though plausible deniability to let me in.
mdrzn 5y ago
Turns out there's no certificate or keys leaked, but there was an exposed unsecured web service to generate GP from Poland. It has since been fixed, but apparently there's a couple more still around (Vietnam and such it seems).
kri8 5y ago
where can I get one?

207 points by qsort 5y ago

Just wonder, how any of you vaccine masterminds would explain how vax scanners for PEOPLE are comming and how will they detect if you really had the shot? How would that be possible without some magnetic stuff in you blood? Now you know why is so "important" to let go on the green pass, cause you ganna be a walking magnet for simple metal detectors, presented as state of the art new science.

xdennis 5y ago
Not sure why downvoted. This is a legitimate point. In Romania it's possible to get "sink vaccinated". That is, the doctor squirts the syringe into a sink instead of in you, and you get 100 % valid papers to show your local wannabe Arstotzka agent. Having a covid passport proves nothing. They'll have to scan your blood like in Gattaca.

i_have_an_idea 5y ago

Very worrying if true

xdennis 5y ago
It's also a ray of hope for people shut off from the world.
ryanlol 5y ago
Great news, just further demonstrates that these systems should never have been built.
- i_have_an_idea 5y ago
  What's the alternative? Every winter months of lockdowns, economic disruption, overflowing hospitals and hundreds of thousands of needless deaths? Just get your shots. Stop being pricks about it, it's not a big deal.
  - kri8 5y ago
    the alternative is not being a fucking loser and stop accepting whatever your government demands from you. Where do you draw the line?
  - ryanlol 5y ago
    >What’s the alternative? You said it yourself: >Just get your shots. Stop being pricks about it, it's not a big deal. Since fucking when do we need to build mass surveillance systems to encourage people to vaccinate? Why does it need to be a big deal? I don’t give a shit about vaccines (had my 2 shots as soon as they were available), but I genuinely believe that people pushing for pervasive vaccine passes do not deserve to live. Fucking develop technology to test if I actually had the vaccine, don’t try to use this as an excuse to check my documents.
sgjohnson 5y ago
No, very good. There are European countries that have went full stasi with "papers, please". Leaked private keys are liberation.
- malermeister 5y ago
  Imagine comparing a simple health measure to the Stasi. Some folks on here take individualism to pathological levels.
  - sgjohnson 5y ago
    Starting with November 15, it will be illegal to employ unvaccinated people. They already can't enter supermarkets or access any "non-essential" services. "simple health measure", you literally need that + a form of ID to leave the home. And I cannot support that.
    - malermeister 5y ago
      You need a passport to leave your country. You need a drivers license to drive a car. It's illegal to employ people without a work visa. Relax. Don't pretend this is something new or the end of the world. This is how civilization works, through society making decisions on whats acceptable and what isn't. There's all sorts of sensible restrictions already and this is another one that makes sense.
      - sgjohnson 5y ago
        There's no point in reasoning with you, if you believe that someone's private health information is a blanket reason to completely ruin their livelihood. Would be lovely if you were put in a position where it's something you don't want to (or can't) do, or your own government takes away your entire livelihood. But it would be fine, because that's how civilisation works, through society making decisions on whats acceptable and what isn't. There's all sorts of sensible. I would have a sweet, sweet "I told you so" moment, but I would still stand up for your rights.

mwint 5y ago

Did literally anyone not see this coming? We all know the government can’t hold on to keys. I fear this will be used as an excuse to make the passport system even more centralized.

Bancakes 5y ago
Why the downvotes? For sure, this will just have us install (or have preinstalled) DRM-locked proprietary apps on our phones. Ugh.
- ethanbond 5y ago
  Downvotes because governments regularly hold secrets for years, decades, sometimes centuries. But yeah yeah, you can point to more than a few failures in the massive sample pool of “the government” so “government can’t hold keys.”
gpderetta 5y ago
As opposed to private entities that are known to be able to keep keys secret all the time?
- switch007 5y ago
  They didn’t suggest that at all.
- cm2187 5y ago
  Don't know if this is whst the OP has in mind, but the first thing that comes to my mind is the backdoor that many states want to impose on all encrypted communications. That would create a single point of attack, so even assuming competence, it makes the system significantly weaker. And this episode if confirmed makes competence a strong assumption.
  - gpderetta 5y ago
    It very much points to incompetence. I just don't think governments are specifically more incompetent than private entities in this case.

CodesInChaos 5y ago

Nobody verified my code so far, they just eyeball the app. So the practical impact of such a leak is probably small, since people will fall for dumb forgeries already.

raxxorrax 5y ago
Exactly my experience. Not a fan of a vaccine pass, but I did show it at a restaurant they didn't even know what to do with it. Looked at it a bit confused, said 'yes, yes' and that was it. No check whatsoever. I don't mind that at all to be honest. Airports check it, but other than that...
deleted 5y ago
[deleted]
stavros 5y ago
In Greece, the vast majority verifies certificates, with high-density venues like clubs asking for ID as well.
- LammyL 5y ago
  I was in Greece (Santorini) for the past 5 days and nobody asked about COVID certificate and hardly anyone wore a mask.
torben-friis 5y ago
I had it verified constantly, both in airports and (on a trip to Italy) on pretty much every restaurant or bar I went to. I think it was only once that they were fine with showing it, all the others had scanners.
- lixtra 5y ago
  But did you have to show an ID or could you just show a John Doe certificate?
  - 5y ago

archi42 5y ago

There is a second link that's also popular right now: https://github.com/ehn-dcc-development/hcert-spec/issues/103 https://github.com/ehn-dcc-development/hcert-spec/issues/103 Discussion: https://news.ycombinator.com/item?id=29011537 https://news.ycombinator.com/item?id=29011537 (1 comment) The alternate seems to be actually more popular (22 pts vs 6 pts), but I suppose that the HN algorithm seems to rate it down due to pointing to GitHub?

Hokusai 5y ago

Certificates in Sweden are valid for 3 months. So, if it's the same for Italy then it's not good but not catastrophic either.

gpderetta 5y ago
Apparently the leaked keys have already been blacklisted. So all certificates signed with the leaked keys will need to be reissued. FWIW, it wasn't the Italian key that was leaked.
- ginko 5y ago
  They seem to be quite thorough with checking QR certificates in Italy so it doesn't surprize me if this was discovered there.
  - gpderetta 5y ago
    Very anecdotally I spent three weeks in Italy this summer and my (UK) covid pass wasn't checked even once (In fact I also had to spend 5 days or something in isolation and nobody ever bothered to check or followup). I understand that compliance is very location specific.
    - darkwater 5y ago
      In summer it wasn't yet mandatory AFAIK (and in fact Italy was using a slightly different certificate back then)
    - toyg 5y ago
      They got strict in the last month; now if you can't present a pass you might even be refused your salary. There have been demonstrations about this, as you might expect. I agree that the tracing this summer was less than perfunctory, my brother had your same experience (his girlfriend wasn't even "declared", and nobody checked), and there was no Green Pass at all. Everyone wanted the tourists back so badly that the overall approach was to basically tick checkboxes and leave it at that. They got serious when it became clear the virus would be around all winter because of the Delta variant.

capableweb 5y ago

Seems the keys have already been revoked. Doesn't mean it can't leak again, but doesn't seem to be a problem with a leaked key at the moment. Actual source seems to be here: https://rfmirror.com/Thread-TRADING-make-EU-green-pass?page=46 https://rfmirror.com/Thread-TRADING-make-EU-green-pass?page=...

tiagod 5y ago
Certificate still works on the Portuguese cert checking app as of 13:35 GMT
lmilcin 5y ago
What about people who got legit certificates but now the key it used has been revoked?
- gpderetta 5y ago
  At least in UK the app will generate a new certificate on the fly.
  - lmilcin 5y ago
    I am not using an app. I am not installing any third party apps on my phone, government or not, period. The certificate I am using is printed on a piece of paper I carry with me.
    - gpderetta 5y ago
      well, print it again then.
      - lmilcin 5y ago
        I know this, but a lot of people may not know because they don't care to read HN. Then they try to board a plane and get rejected.

kuroguro 5y ago

Does it have to be the keys that are leaked? There should be hundreds of healthcare workers who have access to the covid certificate system. I find it more likely there's an option to enter custom data for non-citizens and someone was just messing around.

gpderetta 5y ago
Maybe some unprotected API gateway?
tkfu 5y ago
I think that's absolutely the most likely. And it's not hundreds, it's probably more like tens of thousands (or more). For example, when I got mine issued in Germany, I just went to a pharmacy, gave them my ID and (paper) vaccination record, and the pharmacist came back in a couple of minutes with my QR code. The interesting thing to watch, over the coming days, is this: will the public policy response do the technically correct thing, and make sure that you need all your original documentation (signed records from the doctor's office, etc.) to get your new covpass issued? Or will they do something incorrect (but easy), like let people come in with their now-invalid pass plus a government ID to get a new one issued?
- csunbird 5y ago
  I am not sure how the key management works, maybe they are just issuing private keys to each pharmacy, and if any pharmacy just went rogue, it should be extremely easy to know which one the certificate is coming from. Also, it is easy to get a valid vaccination code anyways, for example, I took a friend of mine, who was vaccinated out of EU, to a pharmacy and nicely asked if he can have a certificate for travel. They just glanced at the his vaccination dates and gave us qr codes, no questions asked. The yellow booklet is easy to forge as well.
  - jagger27 5y ago
    > maybe they are just issuing private keys to each pharmacy That seems too complicated for every single pharmacy in Europe. I bet they just punch in some data to a web app and it does the actual cryptographic signing. > I took a friend of mine, who was vaccinated out of EU, to a pharmacy and nicely asked if he can have a certificate for travel. They just glanced at the his vaccination dates and gave us qr codes, no questions asked. This seems no different than Joe pharmacist punching in Hitler. It's still a big problem, but it's not nearly as bad as leaking the actual private key.

mensetmanusman 5y ago

What will last longer, the pandemic or a poorly implemented digital identity platform?

blitzar 5y ago
Given it is the same "poorly implemented digital identity platform" that has been in use for the last 40 years, and secures basically every form of non in person communication you conduct, I am expecting that to continue for a bit longer.
- adevx 5y ago
  It's a shame the comment of throwawayfear has been flagged/censored as it is a valid discussion about the oppressive nature of these passports (and apparently the discussion about it). In the Netherlands: As an unvaccinated individual you have to show a recent negative test before being able to enter a club/restaurant. So very low risk of unvaccinated people spreading Covid19. Yet, vaccinated individuals are allowed in, even when tested positive and feeling ill. There are numerous [0] cases of vaccinated individuals causing major outbreaks, resulting in the temporary closure of clubs and restaurants. It's hard to believe these passports are about reducing hospital admissions or the public health especially in light of increased breakthrough cases [1]. [0] (Dutch) http://www.destentor.nl/zutphen/zutphens-cafe-camelot-weekend-dicht-vanwege-coronabesmetting-het-kan-bij-elk-bedrijf-gebeuren~a9a6fde1/ http://www.destentor.nl/zutphen/zutphens-cafe-camelot-weeken... https://www.rtvutrecht.nl/nieuws/3106637/ https://www.rtvutrecht.nl/nieuws/3106637/ [1] https://www.nature.com/articles/s41591-021-01413-7 https://www.nature.com/articles/s41591-021-01413-7
  - blitzar 5y ago
    > It's hard to believe these passports are about reducing hospital admissions or the public health Go ahead.
throwawayfear 5y ago
These tyrants would love to hold on to these these digital “covid passports” because it gives them complete control over who can participate in society. They’d be able to exclude people who don’t comply with increasingly invasive protocols. It’s about power. The pandemic technically should already be considered endemic. For example in the USA the vast majority of the population has antibodies, in a significantly higher number than the 60 to 70 percent threshold that Fauci and other public servants claimed as the target over the last year. More than 80% of Americans have coronavirus antibodies acquired through infection or vaccination, according to a new study of over 1.4 million blood donations across the U.S. https://www.miamiherald.com/news/coronavirus/article253987048.html https://www.miamiherald.com/news/coronavirus/article25398704... And as reported on by Bloomberg and other media, the antibodies from past infection confer protection equal to or greater than Pfizer. https://www.bloomberg.com/news/articles/2021-08-27/previous-covid-prevents-delta-infection-better-than-pfizer-shot https://www.bloomberg.com/news/articles/2021-08-27/previous-... "Previous Covid Prevents Delta Infection Better Than Pfizer Shot" And those are slated to last for decades. Source: https://www.nature.com/ https://www.nature.com/ articles/d41586-021-01442-9 "Had COVID? You’ll probably make antibodies for a lifetime" On the exact terms given to us by Fauci and other public servants, there is no more reason for these covid mandates to exist. Should be optional across the board, including in EU countries where the threshold has been reached. Then there’s no more need to secure these keys.

traspler 5y ago

It seems like the Keys of one of the issuers got leaked, not the root keys so it looks like the fallout might be confined the the people who got their cert from that issuer (seems to be a french one). Or am I missing something?

deleted 5y ago

[deleted]

clon 5y ago

https://g.nh.ee/images/pix/1200x0/lYFSVUXJ5XY/1d2e261794d4d304e0-94980189.jpg?up=1 https://g.nh.ee/images/pix/1200x0/lYFSVUXJ5XY/1d2e261794d4d3... This QR code proves Adolf Hitler has received 2 doses of Pfizer vaccine. At the moment you can still use the Estonian app to verify this (https://kontroll.digilugu.ee https://kontroll.digilugu.ee). Probably this specific cert will be revoked soon in all the apps. But the cat is out of the bag. Everyone's grandparents will need to do the certificate retrieval dance again, which is another confusion that we did not need at this critical junction. Someone out there has a serious problem with ethics. Or someone really screwed up to the point where it was obvious that a responsible disclosure was already a moot point. In my experience, CERT-EU is normally very competent and would have handled it professionally.

piaste 5y ago
It (already?) records as invalid in the Italian app.
- jerheinze 5y ago
  I think they might be checking against the online database, can you try to see if you replicate it offline? (if that's even possible)
- ProZsolt 5y ago
  It works with the latest VerificaC19(Android)
rmetzler 5y ago
It's also shown as valid by the German CovPassCheck app.
- soco 5y ago
  Maybe there's a real person named Adolf Hitler? Not from Germany for sure.
  - 5y ago

benkkey 5y ago

Is there any particular reason for the leakage? I can't seem to find any on the website

herodotus 5y ago

If you are wondering about Vaccine QR codes, see this article that explains how the "shc" (SMART Health Card) protocol is used to generate and decode the QR. https://marcan2020.medium.com/reversing-smart-health-cards-e765157fae9 https://marcan2020.medium.com/reversing-smart-health-cards-e...

gnabgib 5y ago
This isn't an SHC[0] it's an HC1[1] [0]: https://smarthealth.cards/ https://smarthealth.cards/ [1]: https://www.hc1.com/ https://www.hc1.com/

motohagiography 5y ago

What I read was they were seeing fake certificates - but these could be created by compromising the vax registration application and certificate download process. It could be done by compromising a vaccine clinic tablet and issuing new records into the main WHO CoVAX record database under arbitrary names, and then collecting the fake passport image from the web interface citizens use. I don't think you need to compromise the root certificate or signing keys to do this, there are easier ways. (But if I could put in a request for a Josef K., and an A. Solzhenitsyn novelty certificate, it would be a nice to have on my phone.)

intunderflow 5y ago

Repository to verify QR codes locally: https://github.com/ehn-dcc-development/ehn-sign-verify-python-trivial https://github.com/ehn-dcc-development/ehn-sign-verify-pytho...

sgjohnson 5y ago

Based on the information I've received, the private keys for all European countries have been leaked. There appears to be a centralised EU system where they all are stored.

mithron 5y ago

Finnish app[1] verifies as valid as of now. [1] https://thl.fi/en/web/infectious-diseases-and-vaccinations/what-s-new/coronavirus-covid-19-latest-updates/vaccines-and-coronavirus/covid-19-vaccination-certificate/covid-certificate-reader https://thl.fi/en/web/infectious-diseases-and-vaccinations/w...

framecowbird 5y ago

For all practical everyday use, this doesn't matter. Nobody has ever even checked my ID card has the same name as in the app, let alone scanned the QR code to verify. They just glance and that gives them though plausible deniability to let me in.

mdrzn 5y ago

Turns out there's no certificate or keys leaked, but there was an exposed unsecured web service to generate GP from Poland. It has since been fixed, but apparently there's a couple more still around (Vietnam and such it seems).

kri8 5y ago

where can I get one?