Hacker News Reader

Comment by gillesjacobs | Hacker News Reader

> there is no superfluous data inside, so the QR code is not a privacy nightmare, as some have feared.

I strongly disagree. If the goal is to determine the COVID19 immunity status of a person on-site the only thing that should be contained is vaccination information. There is no need for full names, place of birth, issuer, targeted disease to be encoded in a QR-code that will be read by businesses. Especially since the information is presumably signed and verified by the official issuers anyway.

Any other personal details such as age can be checked via already existing IDs. The "targeted disease" field betrays function scope creep. So much for the EU's moral high ground regarding privacy: needlessly sharing personal details for entering a cafe is not good privacy practice!

View on HN

How can I verify that the QR code is of the person in front of me, if there's no name or anything included? Screenshots are old you know.

There are zero-knowledge and differential privacy solutions to this issue. For more critical applications there probably is an ID cross-check and online verification being performed. The nightclub does not need to know my full name, residence and birthdate.

On most ID cards, there is the full name and the birthdate of the person. So it does not matter if it's on the QR code too. The place of residence is neither on the ID card nor on the QR code.

Name seems like a good field to include, but you will want to remove the 'vaccination details'.

Does a bouncer at a nightclub really need to know I received one dose of a Pfizer vaccine against COVID-19 in Austria on February 18, 2021? Or does he need to know that 'I am fully vaccinated to enter this venue according to local laws'?

How would you encode the local laws into a code that is generated by an app, published by another government?

The type of shot, and the amount of shots, even the date of the shot, are all perfectly valid requirements that can end up in local law. Astrazenica doesn't work well against the British covid variant, so in an outbreak you might end up with laws restricting the type of vaccination, easily.

To determine what is and what isn't allowed, the logic should be built into the verification code, which each government can make their own for.

If all of Europe were to use the same laws and regulations then I'd agree that this information does not need to be stored in the QR code. This is impossible to manage in practice, though.

I'm not sure.

What or who generates these QR-codes? Can't that system also provide the verification check? It is a European-wide 'system' after all.

Who do you trust more with your data: your (european) government or a (non-european) government/private entity?

The official validation apps will not show this detail to the user. Unofficial apps may come up but app stores will probably quickly ban those (they are very careful about the whole COVID topic in the playstores). There is still the chance of sideloading the app, but one does also need to consider if the vaccination information must really be protected that hard. In most countries, it's more or less randomly when and with what kind of vaccine you got vaccinated. And the really important information in my opinion is: is someone vaccinated or not? And this information is what the bouncer needs to know to let you in...

Imagine Facebook sending any app that would have 'Login with Facebook' functionality, your full profile, including your plaintext password.

Would you trust every and all third-party applications with this 'Login with Facebook' functionality, to not look at your plaintext password? Or would you rather have Facebook not send your password in the first place?

You could include a photo of the person in the QR code, but I'm pretty sure most people would prefer just the name to be included.

Reply on news.ycombinator.com