Serious privacy/security concerns raised about Portpass vaccine verification app
1–10 of 29 posts
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#2This is getting more hilarious by the minute.
-the modern tech sector is a big scam at this point.
-the personal data silos is archaic, and most of the time kyc isn’t necessary.
-the idea of proof of vaccination seems like a bad idea in that the ease of creating a faked proof has much much larger Societal consequences compared to a fake id a teenager uses to get booze.
I think I’m in Favour of the idea, that if your not interested in personal vaccination, certain areas have restricted access. for the sake of human... economic... protection.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#3This is getting more hilarious by the minute. -the modern tech sector is a big scam at this point. -the personal data silos is archaic, and most of the time kyc isn’t necessary. -the idea of proof of vaccination seems like a bad idea in that the ease of creating a faked proof has much much larger Societal consequences compared to a fake id a teenager uses to get booze. I think I’m in Favour of the idea, that if your…
Down voted,really? explain
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#4There are two fairly decent existing standards for covid vaccination proof that I am aware of.
SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others.
EU DGC - All eu countries, some others like the UK.
Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me.
In many of these instances it seems like the public health department is getting scammed by local players who say they can do something like this and then have Not Invented Here causing massive issues.
I’d love to work on a verifier which supported both the EU and SMART standards in one app.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#5It's a distraction to talk about specific vulnerabilities in specific implementations of 'vaccine passports'. The entire idea is incredibly dangerous to free society. If you wouldn't want to live in China because of its freedom situation, do not allow vaccine passports to be implemented in your area.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#6This is getting more hilarious by the minute. -the modern tech sector is a big scam at this point. -the personal data silos is archaic, and most of the time kyc isn’t necessary. -the idea of proof of vaccination seems like a bad idea in that the ease of creating a faked proof has much much larger Societal consequences compared to a fake id a teenager uses to get booze. I think I’m in Favour of the idea, that if your…
Down voted,really? explain
you upped the jargon for expressing an opinion.The KYC is indeed necessary because people will fake these.
You mixed up a technology whine, with politics, in one sentence. Unpack things a bit and you might have got less downvote.
I want to travel. The sector needs a reboot.
I want a vaxx QR code tied to me, which has good fake protection which lets me travel. I am not stupid (very, maybe a bit) and I know there are all kinds of complications. but, we've had yellow fever "passports" forever and they work: they help prevent wildcat breakout of yellow fever in tropical climates.
Australia down-voted a health card 30 years ago (the "australia card") on civil liberties grounds. Right now, I think it would be bloody useful. The online mygov ID is not actually badly done, and I know people who work in medical data structures, and how complex it is to structure health information to share even amongst health professionals.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#7There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others. EU DGC - All eu countries, some others like the UK. Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT…
> Quebec (I believe, they don’t have a public spec)
> Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me.
In the case of Quebec's app, there are significant issues. It's not just that they permit privacy violations; it's that the other side of it is broken.[1]
[1]: https://www.cbc.ca/news/canada/montreal/vaccination-passport...
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#8There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others. EU DGC - All eu countries, some others like the UK. Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT…
If anyone sees this later, I just looked and found a more “universal” verifier by a group called Path Check. I don’t know much about it but it seems to support both standards.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#9There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others. EU DGC - All eu countries, some others like the UK. Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT…
> Quebec (I believe, they don’t have a public spec) > Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me. In the case of Quebec's app, there are significant issues. It's not just that t…
It sounds like what’s happening there is that whatever backend is feeding the data into the system that generates the vaccine passes is vulnerable. Obviously I don’t know for sure, but lots of US states have really old Immunisation Information Systems, and I wouldn’t be at all surprised if they had some gaping holes in them. I imagine Quebec has a similar system of approx the same age with gaping holes.
Edit: that obviously doesn’t reduce the severity of the PII breach issue though, or change the fact that it undermines the security of the covid passes. If anything it’s worse because you’d be able to see other stuff like childhood vaccinations.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#10> The app claims to use AI and blockchain to verify records and keep data secure
Yeah, as soon as I read this I know it's going to be complete horse manure.