I don't see any personal information besides the name and date of birth here. That's pretty good, don't you think so?
Does it have access to a passport ID? Image database?
How is the one verifying the validity of the certificate supposed to check if it's actually the holder of the certificate standing in front to clear admission?
Your granny doesn’t need to verify this, these are used by employees of venues that want to limit access to their facilities to people who are either vaccinated or tested negatively.
I'm pretty sure the guard doesn't give a flying fuck about my personal information, just like the programmers - so how do I verify myself? Or am I to stay at home forever if I care about my privacy? The EU said very different things about these issues, is that forgotten now? The same goes for the other identity-related EU initiatives, where did all the talk about privacy go? Was it just propaganda, because it certainly seems so now, as there are so many so obvious loopholes it can't be an accident?
If you or your granny aren't good at reading code, you just have to trust that other members of the public who are would have made some noise in the media if something fishy was going on.
Yes -- just like you've always been, long before this pandemic. Every time you're out in public, you're out in public.
You'd still end up comparing a picture to someone's face, though, so you can't really remove the middle man without going into some dangerous facial recognition tech.
Having someone at the door look at a paper ICVP and a photo ID with their analog eyes has much better privacy properties. (Still bad though.)
https://en.wikipedia.org/wiki/International_Certificate_of_V...
The verifier app is a dumb app that simply verifies the signature of the QR code payload and displays the relevant info on screen, which they look at with their analog eyes and compare to the photo id. The only network activity and/or storage is related to downloading the public keys of the issuing authorities.
Source code is available on github.
The QR code scanners will probably just be the official app installed on smartphones the venue will need to supply to the security personnel. Who's going to hack this? Banks can already track your credit card payments to figure out your profile, Google can track your location through your phone. Russian, Chinese or North Korean hackers probably don't care about where you spend your evenings.
"The imaginary is that which tends to become real" -André Breton
> Banks can already track your credit card payments to figure out your profile, Google can track your location through your phone.
For people who don't even avoid these easily defeated tracking vectors (with cash and de-googling), sure, vaccine passport tracking won't make a big difference.
Just because you can find a quote you think is profound and attach a name to it, doesn't justify super-paranoia. Do you get out of the house, or are you avoiding the virus? Life's about judging risks and benefits, and IMO you're way overblowing the risk of these hackers. What Andre Breton thinks is irrelevant.
Here we hide personal health information in a QR code and are expected to give random strangers 'consent' to this personal data to gain 'access' to a venue or 'service'.
Sounds awfully lot like a cookie consent-popup.
Without any kind of ID the QR code is useless.
Do you really need to know the last four if you all you really want to know if the identified person should be granted access?
I’m not sure how else to give someone the information that person X has had vaccine Y, other than actually transmitting that exact information?
Yes, it’s (slightly) sensitive information. But if one decides that we want to have a system based on this exact information, and it had to be “offline capable”, what are the options?
> Do you really need to know the last four if you all you really want to know if the identified person should be granted access?
If the requirements are that verifiers must themselves be able to decide which vaccines are acceptable, number of doses or time since last dose, and which issuers are allowed, then yes.