Hacker News Reader

Comment by justinmchase | Hacker News Reader

It sure seems like a privacy disaster. How could you say its not?

It does contain a bit more information than required, such as the specifics of the vaccine. But I think the personal information such as name is required. The code needs to be tied to some form of ID otherwise a single code could be copied and used by everyone. So the name and date of birth are likely used so that it can be compared to your drivers license or passport to ensure that the QR code actually belongs to you.

>It does contain a bit more information than required, such as the specifics of the vaccine.

between eu member states, the acceptance of e.g. sputnik-v (the russian corona vaccine) varies. having the name (or id) of the vaccine in the code allows countries who don't recognize a given vaccine to validate codes issued by other eu nations, who are more open to such a vaccine. (what a horriblly worded sentence, i hope you get what i'm trying to say)

Yes what is "required" is controversial. What I meant to say is that they could have chosen to go for a yes/no type of verdict but instead they chose to let the reader decide if they consider the protection acceptable. Both decisions have pros and cons.

What's "acceptable" can vary by country. They couldn't have done this with the acceptance bit only.

Additionally, the situation is constantly changing. A vaccine effective today might be considered insufficient tomorrow, e.g. due to mutations, new studies etc.

Couldn't someone just generate a fake QR code with their name and DOB on it?

IIUC the data in the QR code is signed, the article mentions it but doesn't show the signature.

They could also produce a fake vaccination booklet, or fake Covid test result. I'd guess both of these would be easier. All will result in forgery charges if caught. I think the chosen approach is pretty solid for the purpose.

At the very least it should be signed. Also, the issuing authority is on there so it should be possible to verify the information if necessary too.

DCC (Digital Covid Certificate it's called, not Digital Green Pass) is essentially a spec for a QR code (as demonstrated nicely in this post) + an EU signing gateway which is used for signing the certificates. The EU acts similar to a CA in case of SSL certificates.

> It does contain a bit more information than required, such as the specifics of the vaccine

That seems reasonable; it's totally plausible that a future variant defeats a vaccine, and at that point you would want to be able to detect people who'd been given that one.

No server is involved in scanning/verifying the QR codes, the only privacy violation would possibly be the people scanning the code taking the name/DoB for themselves but that would be a GDPR violation and I'd guess no legitimate business would try that.

I'd be showing my ID/vax record to those restaurants either way so it just seems like a technicality in the end. If you don't like it, don't use it, like all covid apps in the EU.

This includes more information than necessary to verify whether a person has been vaccinated.

Which information do you think is unnecessary?

Almost all of it. The only thing it needs to contain is name, whether you are "immune" (vaccinated or natural antibodies), and a signature to verify it hasn't been tampered. When you were born, which vaccine you received, and when you received it are not necessary to show that you won't be spreading the disease.

Some EU countries have restrictions that get lifted after the first shot (e.g. entry to Austria), some after the 2nd shot, some 14 days after the 2nd. So the number of doses, the date of the most recent one and which vaccine (not all countries accept Sputnik).

How does "Name: John Doe. Vaccinated (or 'Immune'): Yes" tell anyone that you, who are flaunting this pass, are the John Doe who is vaccinated? Names suck as identifiers.

And downvotes suck as counterarguments.

And they don't improve with repetition.

In Austria you could use https://qr.gv.at to check the qr codes without installing an app. I don't think that it does any further verification than parsing the data.

Reply on news.ycombinator.com