4 ms·

I was significantly creeped out that my state was issuing COVID passports with JWT. Especially when I signed the opt out form requesting to not be placed on th

I was significantly creeped out that my state was issuing COVID passports with JWT. Especially when I signed the opt out form requesting to not be placed on the database. Especially 2.0, when I called the database, and was told that my records could not be deleted.

misnome 4y ago
How is issuing a JWT implicitly mean that they are storing it in a database? Couldn't they have just... not stored the data... but can still validate it?
- infamousjoeg 4y ago
  Exactly this. They just need to validate the JWT signature against a JSON Web Key Set (JWKS). There's no need to store the data.
tylergetsay 4y ago
They used "JWTs" as a convience, Smart Health Cards have none of the issues here. Their issuance doesnt require a database either, thats just your healthcare provider.
- adolph 4y ago
  JWT and SMART Health Cards are similar under the hood. The T part of JWT refers to a Token, which in JWT is a standardized set of claims. Instead of T, SMART Health Cards use S, or Serialization. Instead of a token, the JWS serializes FHIR demographic and necessary medical information about the card bearer. SHC has all the same invalidation and key issue/revoke challenges as JWT. When the issuer is ready to generate a Health Card, the issuer creates a FHIR payload and packs it into a corresponding Health Card VC (or Health Card Set). The VC structure (scaffold) is shown in the following example. The Health Cards framework serializes VCs using the compact JWS serialization, where the payload is a compressed set of JWT claims (see Appendix 3 of RFC7515 for an example using ECDSA P-256 SHA-256, as required by this specification). Specific encoding choices ensure compatibility with standard JWT claims, as described at https://www.w3.org/TR/vc-data-model/#jwt-encoding https://www.w3.org/TR/vc-data-model/#jwt-encoding. https://spec.smarthealth.cards/ https://spec.smarthealth.cards/
stunk 4y ago
I was significantly creeped out that my state was issuing COVID passports.
- bhandziuk 4y ago
  Are you aware governments have been tracking vaccines and issuing vaccine cards for long long before COVID happened?
jpalawaga 4y ago
your vaccination record does not need to be invalidated, so there is no issue. it's a standard format for transmitting data signed by an entity.
eagsalazar2 4y ago
This is actually a decent use of JWTs (and generally I'm in the JWT=='bad' camp). These things don't ever need to be revoked and issuing a JWT means they don't have to store it in their own database. Also 3rd parties checking that passport don't have to implement any kind of database lookup/integration with state APIs. Pretty solid architectural choice IMO.
- quesera 4y ago
  Exactly. JWTs assert claims. If your claim is not durable enough for the protocol's expiration setting (e.g. authorization, in some cases), then don't abuse JWTs. Simple!
  - eagsalazar2 4y ago
    This is really nice way of putting this. Logging in/out is authorization (and authn) so generally if you want to revoke access (log people out), JWTs are possibly the wrong choice (the thing people use JWTs for 99% of the time)
- xorcist 4y ago
  > These things don't ever need to be revoked What would the procedure that can guarantee no mistaken passport will ever get signed look like? Of course you need some form of revocation, otherwise the first bad apple will spoil the system.
- bjt2n3904 4y ago
  Oh yeah, exactly! Perfect application. I hate it. Makes it really easy to scatter low budget devices across the state that require no Internet connection, and gives a red light/green light on whether you're allowed to go shopping or be out in public that day. All the infrastructure is right there in place. Didn't get that far. This time.
  - marcosdumay 4y ago
    Most of the "infrastructure" is the store owners and etc complying with the passport system. The technical part is irrelevant. Anyway, all of that "infrastructure" is people making judgments. It will enable a police state if the people think they should enable it.

misnome 4y ago

How is issuing a JWT implicitly mean that they are storing it in a database? Couldn't they have just... not stored the data... but can still validate it?

infamousjoeg 4y ago
Exactly this. They just need to validate the JWT signature against a JSON Web Key Set (JWKS). There's no need to store the data.

tylergetsay 4y ago

They used "JWTs" as a convience, Smart Health Cards have none of the issues here. Their issuance doesnt require a database either, thats just your healthcare provider.

adolph 4y ago
JWT and SMART Health Cards are similar under the hood. The T part of JWT refers to a Token, which in JWT is a standardized set of claims. Instead of T, SMART Health Cards use S, or Serialization. Instead of a token, the JWS serializes FHIR demographic and necessary medical information about the card bearer. SHC has all the same invalidation and key issue/revoke challenges as JWT. When the issuer is ready to generate a Health Card, the issuer creates a FHIR payload and packs it into a corresponding Health Card VC (or Health Card Set). The VC structure (scaffold) is shown in the following example. The Health Cards framework serializes VCs using the compact JWS serialization, where the payload is a compressed set of JWT claims (see Appendix 3 of RFC7515 for an example using ECDSA P-256 SHA-256, as required by this specification). Specific encoding choices ensure compatibility with standard JWT claims, as described at https://www.w3.org/TR/vc-data-model/#jwt-encoding https://www.w3.org/TR/vc-data-model/#jwt-encoding. https://spec.smarthealth.cards/ https://spec.smarthealth.cards/

stunk 4y ago

I was significantly creeped out that my state was issuing COVID passports.

bhandziuk 4y ago
Are you aware governments have been tracking vaccines and issuing vaccine cards for long long before COVID happened?

jpalawaga 4y ago

your vaccination record does not need to be invalidated, so there is no issue. it's a standard format for transmitting data signed by an entity.

eagsalazar2 4y ago

This is actually a decent use of JWTs (and generally I'm in the JWT=='bad' camp). These things don't ever need to be revoked and issuing a JWT means they don't have to store it in their own database. Also 3rd parties checking that passport don't have to implement any kind of database lookup/integration with state APIs. Pretty solid architectural choice IMO.

quesera 4y ago
Exactly. JWTs assert claims. If your claim is not durable enough for the protocol's expiration setting (e.g. authorization, in some cases), then don't abuse JWTs. Simple!
- eagsalazar2 4y ago
  This is really nice way of putting this. Logging in/out is authorization (and authn) so generally if you want to revoke access (log people out), JWTs are possibly the wrong choice (the thing people use JWTs for 99% of the time)
xorcist 4y ago
> These things don't ever need to be revoked What would the procedure that can guarantee no mistaken passport will ever get signed look like? Of course you need some form of revocation, otherwise the first bad apple will spoil the system.
bjt2n3904 4y ago
Oh yeah, exactly! Perfect application. I hate it. Makes it really easy to scatter low budget devices across the state that require no Internet connection, and gives a red light/green light on whether you're allowed to go shopping or be out in public that day. All the infrastructure is right there in place. Didn't get that far. This time.
- marcosdumay 4y ago
  Most of the "infrastructure" is the store owners and etc complying with the passport system. The technical part is irrelevant. Anyway, all of that "infrastructure" is people making judgments. It will enable a police state if the people think they should enable it.