30 ms·

What about people who got legit certificates but now the key it used has been revoked?

by lmilcin 5y ago

gpderetta 5y ago
At least in UK the app will generate a new certificate on the fly.
- lmilcin 5y ago
  I am not using an app. I am not installing any third party apps on my phone, government or not, period. The certificate I am using is printed on a piece of paper I carry with me.
  - gpderetta 5y ago
    well, print it again then.
    - lmilcin 5y ago
      I know this, but a lot of people may not know because they don't care to read HN. Then they try to board a plane and get rejected.
      - deleted 5y ago
        [deleted]
      - gpderetta 5y ago
        to be fair, yes, you are right, it is going to be a pain for a lot of people.
  - Aachen 5y ago
    Similar here. I use the app since it doesn't do anything invasive, but I also have a paper backup (I don't always carry it) because it's a bit too important to be dependent on a phone only. I bet I'd first find out about my certificate being revoked at some check point where my phone isn't working and I can't easily get a new one...
  - ben_w 5y ago
    In general? Or just COVID apps?
  - bilekas 5y ago
    > not installing any third party apps on my phone Just out of curiosity, is that for privacy reasons or ? Seems rather strange for a smartphone ?
  - GoblinSlayer 5y ago
    Can't you keep it in a jpeg file and show that?
    - TacticalCoder 5y ago
      You can do both. In addition to these two methods I also have a print of that QR code in my car.
- Aachen 5y ago
  So it also automatically resigns the forged certs, or how does it tell the difference?
  - deleted 5y ago
    [deleted]
  - jonathanstrange 5y ago
    It tells the difference by looking up the test results in a database. At least that's how it works in Portugal. You can also use the app to look up other health related information.
  - gpderetta 5y ago
    As far as I understand, it connect to some NHS server and after authentication it fetches a certificate that has been signed by the server.
- cm2187 5y ago
  Don't know for covid passport (since it is not enforced in the UK), but for travel certificates I believe the QR code has a validity of 3 months.
  - secondcoming 5y ago
    The covid passport is enforced in Scotland.
- cwizou 5y ago
  It's definitely a solution when you have an app (assuming you have a 3rd party source of identification of users), but since it's a French key, a sizeable portion of people, mostly elderly, are not using the "official" app but a paper printed QR code that was given to them at the time of the second injection (or a picture of said code). Since the French app is pretty terrible (it used to be the barely functional contact tracing app that didn't want to use Google/Apple's API, so there's a pretty strong popular stigma against it), even a sizeable portion of smartphone users use an alternative too (I personally have my QR code in Apple's Wallet, but there are other 3rd party solutions). Depending on when that key was in use, this may be an epic bureaucratic mess to solve here in France if they have to reissue many. Edit : I'll quickly add that while there's a database of vaccinated people handled by CNAM (the single payer social security administration), it doesn't seem extremely accurate : my best friend and one of his collegues were vaccinated, issued a QR code, but they weren't added to said database and had a terrible time getting the situation fixed. In the end, a pharmacist reissued a "vaccination" for them to "get them in the system". So that database is probably at best incomplete (for the process of reissuing).
  - distances 5y ago
    Does carrying just a QR code work fine for you? My experience from Germany is that nobody scans the code, they just scroll to details to see there's two vaccinations recorded. This far my QR code has only actually been scanned at the airport.
    - VortexDream 5y ago
      I've had my QR code scanned going to bars and restaurants in Germany. Works fine.
    - cwizou 5y ago
      So I haven't had an issue yet and having the QR code is definitely sufficient in France (and always attempted to check when appropriate in my personal experience, no ID check though as that was deemed illegal). There is however a prevalent issue with QR code scanning that I noticed twice personally (and friends reported the same experiences at other places), which is that most restaurants use a super cheap phone/tablet with a terrible camera that usually is unable to focus on a smartphone screen correctly. Once, the person was honest about it and explained they kept having issues with it, and I tried to help him focus correctly his device (QR code size + luminosity seems to be the issue from what I saw). The second one tried a couple of time, didn't manage to focus and told me "all ok" despite it's device not having scanned me (I could see the screen). If I had to travel though, I'd definitely take the paper certificate on top of it, as, at least here in France, that's considered for better of for worse the source of truth.
nyxaiur 5y ago
It doesn't matter because the key was used to sign before it got revoked. You should know this on a site like hackernews.
- roblabla 5y ago
  Please don't belittle people for not knowing things like this, it's entirely rude and unnecessary. See https://xkcd.com/1053/ https://xkcd.com/1053/
  - lmilcin 5y ago
    It is also wrong for one other funny reason. I have been a security officer for a credit card acquiring business and have been designing cryptographic infrastructure for credit card payment systems. I have also implemented a complete credit card terminal application with magstripe, chip&pin and contactless. I know (or at least known at some point in time) pretty much everything practical there is to know about certificates and I have even been able to parse TLV of X.509 by looking at the hex dump of it. So that was pretty poor shot at me.
- cm2187 5y ago
  What prevents you from backdating a forged certificate then?
  - roblabla 5y ago
    I'm not aware of how the COVID certs work, but the way that's solved in TLS certificates (used for https) is that when signing, you have to use an approved timestamping authority. A timestamping authority will basically say "Yes, this action was taken at exactly this time". See [0]. [0]: https://en.wikipedia.org/wiki/Trusted_timestamping https://en.wikipedia.org/wiki/Trusted_timestamping
    - tialaramex 5y ago
      Timestamping does exist but it isn't used in the Web PKI (what you're calling "TLS certificates") Both backdating and forward dating have been done in the Web PKI for various reasons, both legitimate (e.g. historically if you couldn't randomise serial numbers enough it was acceptable to randomise the notBefore time parameters slightly, this is no longer allowed) and illegitimate (we have pretty good circumstantial evidence that StartCom issued SHA-1 certificates long after such issuance was forbidden, probably for $$$ from companies that realised they should have bought one before the cut-off) but there is no inclination to insist upon timestamping to try to prevent that. The most likely place you'll see timestamping in arguably publicly trusted certificates is code signing.

What about people who got legit certificates but now the key it used has been revoked?

gpderetta 5y ago

At least in UK the app will generate a new certificate on the fly.

lmilcin 5y ago
I am not using an app. I am not installing any third party apps on my phone, government or not, period. The certificate I am using is printed on a piece of paper I carry with me.
- gpderetta 5y ago
  well, print it again then.
  - lmilcin 5y ago
    I know this, but a lot of people may not know because they don't care to read HN. Then they try to board a plane and get rejected.
    - deleted 5y ago
      [deleted]
    - gpderetta 5y ago
      to be fair, yes, you are right, it is going to be a pain for a lot of people.
- Aachen 5y ago
  Similar here. I use the app since it doesn't do anything invasive, but I also have a paper backup (I don't always carry it) because it's a bit too important to be dependent on a phone only. I bet I'd first find out about my certificate being revoked at some check point where my phone isn't working and I can't easily get a new one...
- ben_w 5y ago
  In general? Or just COVID apps?
- bilekas 5y ago
  > not installing any third party apps on my phone Just out of curiosity, is that for privacy reasons or ? Seems rather strange for a smartphone ?
- GoblinSlayer 5y ago
  Can't you keep it in a jpeg file and show that?
  - TacticalCoder 5y ago
    You can do both. In addition to these two methods I also have a print of that QR code in my car.
Aachen 5y ago
So it also automatically resigns the forged certs, or how does it tell the difference?
- deleted 5y ago
  [deleted]
- jonathanstrange 5y ago
  It tells the difference by looking up the test results in a database. At least that's how it works in Portugal. You can also use the app to look up other health related information.
- gpderetta 5y ago
  As far as I understand, it connect to some NHS server and after authentication it fetches a certificate that has been signed by the server.
cm2187 5y ago
Don't know for covid passport (since it is not enforced in the UK), but for travel certificates I believe the QR code has a validity of 3 months.
- secondcoming 5y ago
  The covid passport is enforced in Scotland.
cwizou 5y ago
It's definitely a solution when you have an app (assuming you have a 3rd party source of identification of users), but since it's a French key, a sizeable portion of people, mostly elderly, are not using the "official" app but a paper printed QR code that was given to them at the time of the second injection (or a picture of said code). Since the French app is pretty terrible (it used to be the barely functional contact tracing app that didn't want to use Google/Apple's API, so there's a pretty strong popular stigma against it), even a sizeable portion of smartphone users use an alternative too (I personally have my QR code in Apple's Wallet, but there are other 3rd party solutions). Depending on when that key was in use, this may be an epic bureaucratic mess to solve here in France if they have to reissue many. Edit : I'll quickly add that while there's a database of vaccinated people handled by CNAM (the single payer social security administration), it doesn't seem extremely accurate : my best friend and one of his collegues were vaccinated, issued a QR code, but they weren't added to said database and had a terrible time getting the situation fixed. In the end, a pharmacist reissued a "vaccination" for them to "get them in the system". So that database is probably at best incomplete (for the process of reissuing).
- distances 5y ago
  Does carrying just a QR code work fine for you? My experience from Germany is that nobody scans the code, they just scroll to details to see there's two vaccinations recorded. This far my QR code has only actually been scanned at the airport.
  - VortexDream 5y ago
    I've had my QR code scanned going to bars and restaurants in Germany. Works fine.
  - cwizou 5y ago
    So I haven't had an issue yet and having the QR code is definitely sufficient in France (and always attempted to check when appropriate in my personal experience, no ID check though as that was deemed illegal). There is however a prevalent issue with QR code scanning that I noticed twice personally (and friends reported the same experiences at other places), which is that most restaurants use a super cheap phone/tablet with a terrible camera that usually is unable to focus on a smartphone screen correctly. Once, the person was honest about it and explained they kept having issues with it, and I tried to help him focus correctly his device (QR code size + luminosity seems to be the issue from what I saw). The second one tried a couple of time, didn't manage to focus and told me "all ok" despite it's device not having scanned me (I could see the screen). If I had to travel though, I'd definitely take the paper certificate on top of it, as, at least here in France, that's considered for better of for worse the source of truth.

nyxaiur 5y ago

It doesn't matter because the key was used to sign before it got revoked. You should know this on a site like hackernews.

roblabla 5y ago
Please don't belittle people for not knowing things like this, it's entirely rude and unnecessary. See https://xkcd.com/1053/ https://xkcd.com/1053/
- lmilcin 5y ago
  It is also wrong for one other funny reason. I have been a security officer for a credit card acquiring business and have been designing cryptographic infrastructure for credit card payment systems. I have also implemented a complete credit card terminal application with magstripe, chip&pin and contactless. I know (or at least known at some point in time) pretty much everything practical there is to know about certificates and I have even been able to parse TLV of X.509 by looking at the hex dump of it. So that was pretty poor shot at me.
cm2187 5y ago
What prevents you from backdating a forged certificate then?
- roblabla 5y ago
  I'm not aware of how the COVID certs work, but the way that's solved in TLS certificates (used for https) is that when signing, you have to use an approved timestamping authority. A timestamping authority will basically say "Yes, this action was taken at exactly this time". See [0]. [0]: https://en.wikipedia.org/wiki/Trusted_timestamping https://en.wikipedia.org/wiki/Trusted_timestamping
  - tialaramex 5y ago
    Timestamping does exist but it isn't used in the Web PKI (what you're calling "TLS certificates") Both backdating and forward dating have been done in the Web PKI for various reasons, both legitimate (e.g. historically if you couldn't randomise serial numbers enough it was acceptable to randomise the notBefore time parameters slightly, this is no longer allowed) and illegitimate (we have pretty good circumstantial evidence that StartCom issued SHA-1 certificates long after such issuance was forbidden, probably for $$$ from companies that realised they should have bought one before the cut-off) but there is no inclination to insist upon timestamping to try to prevent that. The most likely place you'll see timestamping in arguably publicly trusted certificates is code signing.