10 ms·

So… Fun story about how I submitted semi false COVID paperwork in order to gain entry into Italy. In September my wife and I went on a delayed vacation to Ital

So… Fun story about how I submitted semi false COVID paperwork in order to gain entry into Italy. In September my wife and I went on a delayed vacation to Italy. At the time they required Covid tests to be completed no more than three days before arrival (we were flying all day Tuesday). {Sidebar… In Italy it took us 15 minutes to get Covid tests with no scheduling. Walked right in and on our way. No wonder they thought a couple days was enough time.} We scheduled Covid tests for Sunday and could only do PCR since no one was offering rapid tests within Ohio - or at least, nearby. As we pull up to the window, we are told that, since it is Sunday and the next day is memorial day the lab will get our samples on Tuesday and we’ll have our results on Wednesday (remember, we arrive on Tuesday). So we declined testing and happened to find the last two Binax Now non-proctored self-tests in the area. We take the tests and both test negative. We submit a negative result to the Binax website (no one has checked anything. - I think it was a literal “not positive” checkbox), get confirmation emails, and upload them to the United website. They take hers but declined mine for being taken too far outside of the three day window… even though we took them and uploaded same day. I tried two more times, declined two more times. So I think… My birthday was a few days before we took the test, I wonder if the automated systems or screeners are picking up on my birthday and rejecting it. *So I take the email into Mac’s preview app, drag a white box over my date of birth, save, upload.* Success. No one stops us at United, no one stops us at customs, no one questions us at all. After we arrived in Rome I realized I could have literally found a copy of the email on the Internet, put my name and test time in, and uploaded. And that’s how we got to go on vacation to Italy.

0xdeadb00f 5y ago
This is literally what people are doing in my area to fake COVID vaccine verification PDFs.
andrew_ 5y ago
I recently gained entry to an NBA game out of state (away from home and without access to any valid paperwork) by using devtools to edit the results page of a test I had last year, to make it valid for that day, and then printing the page. The clinic in question is all over the state and partnered with a major regional hospital, and they use a very basic means to print the page; just some media css. For every burden of proof, enterprising people are going to find a way around it. There's now a vast market of spoofed, lookalike QR code destinations on the web that your average Joe isn't going to be able to spot the difference for in a quick glance. WRT gaining entry to the NBA game, the person inspecting paperwork didn't spend more than a half second looking at what I presented. I could have simple printed "negative" on a piece of paper with a bunch of Lorem Ipsum. It was complete theater.
throw8932894 5y ago
You can do rapid test remotely, by doing self test via skype with doctor. It gives you EU valid cert, all legal.
yosito 5y ago
I flew to Cyprus in October from within the EU. Had an EU vaccine certificate which was supposed to mean that no test was required for me. Also had some Cyprus health form I filled out with a QR code. But they made our whole flight stand in a crowded line, inside a building, and instead of scanning the QR codes from our documents, they manually wrote down our names and phone number on a piece of paper, and then made each of us take a COVID test on the spot, and then sent us through immigration before our results came in. Our vaccine certificates and other documents were never checked. Apparently, their plan was to call us a few days later if a test came back positive.
SilasX 5y ago
Related: I got a big snicker out of DefCon this year requiring proof of vaccination. "Uhhh don't y'all host presentations on how to fabricate credentials?"
- MrDunham 5y ago
  Hah! This got a nice laugh out of me. Can't imagine the number of unique challenges that arise due to DefCon's audience and content. (Not implying bad, just... different. For example fabricating credentials.) I used to host some small-mid sized events (100-200 person hackathons) and that was difficult enough without having anyone poking around at my security/processes.
fy20 5y ago
I flew to Spain (from elsewhere in the EU) in September, my wife was not vaccinated so had to do all the extra paperwork and antigen tests both ways. We registered online with the Spanish health ministry before flying and were provided with a QR code, you have to say whether you are vaccinated, and if not are told you need to show a private negative test result on arrival. On the way we were asked if we had a negative test at the airport, we showed it but they didn't look at it. On arrival they just asked to see the QR codes, not the test result. The actual private antigen test results could very easily be altered with Preview.app. Most that we've done so far have a QR code that goes to a hosted version of the certificate, but nobody has ever scanned it. I wonder what would happen if you change it to a URL that returns a 404 - or even just remove it, one I took recently didn't even have that. Security theatre for sure. Whenever I've travelled, I've been more worried that I might not have the right paperwork than catching COVID.
- underwater 5y ago
  > Whenever I've travelled, I've been more worried that I might not have the right paperwork than catching COVID. That's the enforcement mechanism that ensures the test is legitimate, not the QR code. If you fake a test result then you've committed fraud in a foreign country. If you take a real test, are positive, and travel anyway then you're knowingly violating the law and there is a non zero chance you'll be caught. I don't see how it is theatre when you admit that it achieved its aim of having you and your wife take a test pre- travel.
ceejayoz 5y ago
I had a similar experience; no one scanned my BinaxNow proctored test's QR code. Just having one was enough; I could've easily presented a doctored screenshot. There are probably spot checks, and I don't doubt the country I was in would have happily detained and fined me had I failed one, but it was a bit disconcerting right before hopping on an eight hour flight with a bunch of other people subject to similarly lax enforcement.
- ApolloFortyNine 5y ago
  My proctored test didn't even have a qr code, it had some 20 character unique id but I highly doubt anyone would take the time to call the phone number and verify, having gone out of the country a couple times and back in. For the US side these are the flight check in clerks checking, not even government agents. It's honestly insulting how easy it would be to fake. As a law abiding citizen, we jump through all these hoops, but as a criminal, you spend 5 minutes at home in photoshop and your test is 99.99% guaranteed to work. Hell you edit the unique ID I was talking about to just be invalid, I bet even if they check they'll just force you to get tested again thinking it was a system error.
  - underwater 5y ago
    > As a law abiding citizen, we jump through all these hoops This is not like a regular law where evading the law and the negative outcome are 1:1 correlated E.g. smuggling a bomb onto a plane. In this case the people who lead to a negative outcome are not aware that they have the virus. If you think you don't have COVID then the upside to faking a test is low enough that very few people take that path.
    - ApolloFortyNine 5y ago
      I'm not sure if that's true, if you have to travel for some reason and you take the test and are found to not have covid, you obviously don't have any reason to fake it. However if you're going to a wedding/see family member/some other trip you value, and you do test positive, you now have quite a good reason to fake it, and if at any point in the past you have a valid test with no QR code on it, could easily modify the date.
bryanlarsen 5y ago
It's pretty easy to lie to a border control agent. That's also pretty high on a list of bad ideas.
- SilasX 5y ago
  Yeah that’s the kind of thing I’d use a throwaway account to talk about …
- denysvitali 5y ago
  Also knowing Italy, nobody checks. Really. I took a plane from Italy to Greece a couple of months ago: completely vaccinated and with the Passenger Locator Form ready. Nobody, literally nobody, checked in a reliable way wheter: - we had a valid COVID Certificate - our PLF was filled correctly The only moment during my trip where anyone checked was at Starbucks. This doesn't mean that you are entitled to lie to the border control agents though.
  - corin_ 5y ago
    I've travelled internationally maybe a couple of hundred times and never had my bags searched (that I know of, who knows for ones checked in at airports) until one trip a few years ago when I arrived back in UK and customs officers pulled me over to spend 15 minutes making me get every item out of both of my bags. It's a bad idea to travel with false paperwork, as it's a bad idea to travel with anything illegal in your luggage, not because there's a high chance they'll definitely look into your situation, but because if they happen to choose you randomly then the punishment can be severe.
- yosito 5y ago
  Agreed, but I don't think the commenter you're replying to is claiming to have lied to border control agents. They're just pointing out that no one was actually checking their documents for validity, and the one automated check that happened wasn't even accurate.
  - MrDunham 5y ago
kaesar14 5y ago
Your story doesn’t make any sense. Rapid tests have been available in America since at least the spring. Also you said you were going in September and Memorial Day is in May.
- MrDunham 5y ago
  Crap. Yes I meant Labor day. You'd think since my mother went into labor with me on labor day, I'd actually remember it. That's what I get for posting in the morning. Good catch.
- electroly 5y ago
  He's obviously thinking of Labor Day. I mix them up myself. I believe HN guidelines suggest steel manning here, not accusing him of being nonsensical because of a simple mistake.
  - DonHopkins 5y ago
    Also, programmers often confuse Halloween and Christmas, because OCT 31 = DEC 25.
  - MrDunham 5y ago
    Not only are you correct (I mixed them up), but now I know about steel manning and am a fan. Thanks for the support and understanding - have a wonderful day!
- 0x0000000 5y ago
  "Available" and available are two different things, and I'd guess OP probably meant Labor Day instead of Memoridal Day. I can say that in my area of the US, the only tests that could be found were PCR, 2-3 days for results.
  - MrDunham 5y ago
    Thanks, you're correct on all counts. Labor day. The tests are "available" but not available anywhere nearby for us. PCR only (maybe they're actually available now, but they weren't then.) Anyways I really need to stop posting to HN in the AM before I've had enough coffee... I make too many half-brained stupid mistakes.

0xdeadb00f 5y ago

This is literally what people are doing in my area to fake COVID vaccine verification PDFs.

andrew_ 5y ago

I recently gained entry to an NBA game out of state (away from home and without access to any valid paperwork) by using devtools to edit the results page of a test I had last year, to make it valid for that day, and then printing the page. The clinic in question is all over the state and partnered with a major regional hospital, and they use a very basic means to print the page; just some media css. For every burden of proof, enterprising people are going to find a way around it. There's now a vast market of spoofed, lookalike QR code destinations on the web that your average Joe isn't going to be able to spot the difference for in a quick glance. WRT gaining entry to the NBA game, the person inspecting paperwork didn't spend more than a half second looking at what I presented. I could have simple printed "negative" on a piece of paper with a bunch of Lorem Ipsum. It was complete theater.

throw8932894 5y ago

You can do rapid test remotely, by doing self test via skype with doctor. It gives you EU valid cert, all legal.

yosito 5y ago

I flew to Cyprus in October from within the EU. Had an EU vaccine certificate which was supposed to mean that no test was required for me. Also had some Cyprus health form I filled out with a QR code. But they made our whole flight stand in a crowded line, inside a building, and instead of scanning the QR codes from our documents, they manually wrote down our names and phone number on a piece of paper, and then made each of us take a COVID test on the spot, and then sent us through immigration before our results came in. Our vaccine certificates and other documents were never checked. Apparently, their plan was to call us a few days later if a test came back positive.

SilasX 5y ago

Related: I got a big snicker out of DefCon this year requiring proof of vaccination. "Uhhh don't y'all host presentations on how to fabricate credentials?"

MrDunham 5y ago
Hah! This got a nice laugh out of me. Can't imagine the number of unique challenges that arise due to DefCon's audience and content. (Not implying bad, just... different. For example fabricating credentials.) I used to host some small-mid sized events (100-200 person hackathons) and that was difficult enough without having anyone poking around at my security/processes.

fy20 5y ago

I flew to Spain (from elsewhere in the EU) in September, my wife was not vaccinated so had to do all the extra paperwork and antigen tests both ways. We registered online with the Spanish health ministry before flying and were provided with a QR code, you have to say whether you are vaccinated, and if not are told you need to show a private negative test result on arrival. On the way we were asked if we had a negative test at the airport, we showed it but they didn't look at it. On arrival they just asked to see the QR codes, not the test result. The actual private antigen test results could very easily be altered with Preview.app. Most that we've done so far have a QR code that goes to a hosted version of the certificate, but nobody has ever scanned it. I wonder what would happen if you change it to a URL that returns a 404 - or even just remove it, one I took recently didn't even have that. Security theatre for sure. Whenever I've travelled, I've been more worried that I might not have the right paperwork than catching COVID.

underwater 5y ago
> Whenever I've travelled, I've been more worried that I might not have the right paperwork than catching COVID. That's the enforcement mechanism that ensures the test is legitimate, not the QR code. If you fake a test result then you've committed fraud in a foreign country. If you take a real test, are positive, and travel anyway then you're knowingly violating the law and there is a non zero chance you'll be caught. I don't see how it is theatre when you admit that it achieved its aim of having you and your wife take a test pre- travel.

ceejayoz 5y ago

I had a similar experience; no one scanned my BinaxNow proctored test's QR code. Just having one was enough; I could've easily presented a doctored screenshot. There are probably spot checks, and I don't doubt the country I was in would have happily detained and fined me had I failed one, but it was a bit disconcerting right before hopping on an eight hour flight with a bunch of other people subject to similarly lax enforcement.

ApolloFortyNine 5y ago
My proctored test didn't even have a qr code, it had some 20 character unique id but I highly doubt anyone would take the time to call the phone number and verify, having gone out of the country a couple times and back in. For the US side these are the flight check in clerks checking, not even government agents. It's honestly insulting how easy it would be to fake. As a law abiding citizen, we jump through all these hoops, but as a criminal, you spend 5 minutes at home in photoshop and your test is 99.99% guaranteed to work. Hell you edit the unique ID I was talking about to just be invalid, I bet even if they check they'll just force you to get tested again thinking it was a system error.
- underwater 5y ago
  > As a law abiding citizen, we jump through all these hoops This is not like a regular law where evading the law and the negative outcome are 1:1 correlated E.g. smuggling a bomb onto a plane. In this case the people who lead to a negative outcome are not aware that they have the virus. If you think you don't have COVID then the upside to faking a test is low enough that very few people take that path.
  - ApolloFortyNine 5y ago
    I'm not sure if that's true, if you have to travel for some reason and you take the test and are found to not have covid, you obviously don't have any reason to fake it. However if you're going to a wedding/see family member/some other trip you value, and you do test positive, you now have quite a good reason to fake it, and if at any point in the past you have a valid test with no QR code on it, could easily modify the date.

bryanlarsen 5y ago

It's pretty easy to lie to a border control agent. That's also pretty high on a list of bad ideas.

SilasX 5y ago
Yeah that’s the kind of thing I’d use a throwaway account to talk about …
denysvitali 5y ago
Also knowing Italy, nobody checks. Really. I took a plane from Italy to Greece a couple of months ago: completely vaccinated and with the Passenger Locator Form ready. Nobody, literally nobody, checked in a reliable way wheter: - we had a valid COVID Certificate - our PLF was filled correctly The only moment during my trip where anyone checked was at Starbucks. This doesn't mean that you are entitled to lie to the border control agents though.
- corin_ 5y ago
  I've travelled internationally maybe a couple of hundred times and never had my bags searched (that I know of, who knows for ones checked in at airports) until one trip a few years ago when I arrived back in UK and customs officers pulled me over to spend 15 minutes making me get every item out of both of my bags. It's a bad idea to travel with false paperwork, as it's a bad idea to travel with anything illegal in your luggage, not because there's a high chance they'll definitely look into your situation, but because if they happen to choose you randomly then the punishment can be severe.
yosito 5y ago
Agreed, but I don't think the commenter you're replying to is claiming to have lied to border control agents. They're just pointing out that no one was actually checking their documents for validity, and the one automated check that happened wasn't even accurate.
- MrDunham 5y ago

kaesar14 5y ago

Your story doesn’t make any sense. Rapid tests have been available in America since at least the spring. Also you said you were going in September and Memorial Day is in May.

MrDunham 5y ago
Crap. Yes I meant Labor day. You'd think since my mother went into labor with me on labor day, I'd actually remember it. That's what I get for posting in the morning. Good catch.
electroly 5y ago
He's obviously thinking of Labor Day. I mix them up myself. I believe HN guidelines suggest steel manning here, not accusing him of being nonsensical because of a simple mistake.
- DonHopkins 5y ago
  Also, programmers often confuse Halloween and Christmas, because OCT 31 = DEC 25.
- MrDunham 5y ago
  Not only are you correct (I mixed them up), but now I know about steel manning and am a fan. Thanks for the support and understanding - have a wonderful day!
0x0000000 5y ago
"Available" and available are two different things, and I'd guess OP probably meant Labor Day instead of Memoridal Day. I can say that in my area of the US, the only tests that could be found were PCR, 2-3 days for results.
- MrDunham 5y ago
  Thanks, you're correct on all counts. Labor day. The tests are "available" but not available anywhere nearby for us. PCR only (maybe they're actually available now, but they weren't then.) Anyways I really need to stop posting to HN in the AM before I've had enough coffee... I make too many half-brained stupid mistakes.