Serious privacy/security concerns raised about Portpass vaccine verification app
cbc.ca
cbc.ca
Yeah, as soon as I read this I know it's going to be complete horse manure.
Take 2 https://xkcd.com/2267/
SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others.
EU DGC - All eu countries, some others like the UK.
Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me.
In many of these instances it seems like the public health department is getting scammed by local players who say they can do something like this and then have Not Invented Here causing massive issues.
I’d love to work on a verifier which supported both the EU and SMART standards in one app.
> Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me.
In the case of Quebec's app, there are significant issues. It's not just that they permit privacy violations; it's that the other side of it is broken.[1]
[1]: https://www.cbc.ca/news/canada/montreal/vaccination-passport...
Edit: that obviously doesn’t reduce the severity of the PII breach issue though, or change the fact that it undermines the security of the covid passes. If anything it’s worse because you’d be able to see other stuff like childhood vaccinations.
What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as key to being able to trust it.
The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. I'd be more curious how it would be able to handle any other jurisdictions' codes, unless it has US keys available as well.
I appreciate that the data contained in the code is as minimal as it can be, while the official app is displaying even less. Working off-line should keep it reliable as well, since it does not make or require server calls. This too would be different from Portpass, since it apparently stopped working.
Quebec's app does the same thing, it has the public key builtin for validation. The only time the app can connect is to download an updated list of rules that determine if the enclosed information in the QR code related to vaccine status still protects the owner (and label them as adequately protected if they meet those criterias).
See https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bc... for a quick overview.
I confirm that Quebec uses SHC.
The idea that some third party app needs to show my record as “proof” to a store or venue is asinine.
Just my two cents.
That the anti-everything crowd will pout and stay home is precisely the point.
In the US, the govt. has an internal system called XKeyScore that tracks your email, web and credit history.
In Australia, they have a "private" vaccine tracking app, but from Day One the police admitted having access to the database. (The police called reporters stupid for believing the app data was ever private.)
In the social credit score future, everyone gets UBI, but only people who jump through every little tiny hoop the government can think up can actually do anything with that money.
-the idea of proof of vaccination seems like a bad idea in that the ease of creating a faked proof has much much larger Societal consequences compared to a fake id a teenager uses to get booze.
I think I’m in Favour of the idea, that if your not interested in personal vaccination, certain areas have restricted access. for the sake of human... economic... protection.
You mixed up a technology whine, with politics, in one sentence. Unpack things a bit and you might have got less downvote.
I want to travel. The sector needs a reboot.
I want a vaxx QR code tied to me, which has good fake protection which lets me travel. I am not stupid (very, maybe a bit) and I know there are all kinds of complications. but, we've had yellow fever "passports" forever and they work: they help prevent wildcat breakout of yellow fever in tropical climates.
Australia down-voted a health card 30 years ago (the "australia card") on civil liberties grounds. Right now, I think it would be bloody useful. The online mygov ID is not actually badly done, and I know people who work in medical data structures, and how complex it is to structure health information to share even amongst health professionals.
I don't. Nor do I want to be micro-chipped like the family pet.
The article is not about travel, it's about gaining entry to an ice hockey match. It's in same realm as gaining entry to a restaurant or any local business.
Not everyone wants KYC enforced on basic human activity such as satisfying your hunger for dumplings or meeting a friend for coffee.
They claim it's a temporary measure at certain venues, but they claim a lot of things. "We're announcing a 2 week snap lockdown" was said hundreds of days ago here in Melbourne. Only the tip of the Untruth iceberg.
Australians have already been tricked into a mandatory MyGov account. You can't delete that online account like you can your social media. Technically it's fine, but the concept and heading is concerning.
The voting public have less and less say in these things, and the fog of a pandemic is perfect cover to introduce a range of new mandates, otherwise shelved for being too unpopular.
Some will call this paranoia, others due diligence or an integrity test / pub test. I don't think it helps to exempt things like an Australia Card from the pub test because you think it would be "bloody useful". That's inviting the Trojan horse in with full knowledge of what's inside, and being okay with it because of the travel permissions it grants you.
I don't want to go back into indoor dining and venues with whackjob libertarians breathing all over me. If you want to avoid governments, get vaccinated and prove it somehow or stay outside. I'm voting for parliaments which impose societal controls on stupidity, the state has you from birth with a blood sample and footprint.
This doesn't require anyone to change their behavior but you.