Private keys used to sign EU Digital Covid Certificate might have been leaked
1–10 of 214 posts
Re: Private keys used to sign EU Digital Covid Certificate might have been leaked
#2Very worrying if true
Re: Private keys used to sign EU Digital Covid Certificate might have been leaked
#3Did literally anyone not see this coming? We all know the government can’t hold on to keys.
I fear this will be used as an excuse to make the passport system even more centralized.
Re: Private keys used to sign EU Digital Covid Certificate might have been leaked
#4Nobody verified my code so far, they just eyeball the app. So the practical impact of such a leak is probably small, since people will fall for dumb forgeries already.
Re: Private keys used to sign EU Digital Covid Certificate might have been leaked
#5There is a second link that's also popular right now: https://github.com/ehn-dcc-development/hcert-spec/issues/103
Discussion: https://news.ycombinator.com/item?id=29011537 (1 comment)
The alternate seems to be actually more popular (22 pts vs 6 pts), but I suppose that the HN algorithm seems to rate it down due to pointing to GitHub?
Re: Private keys used to sign EU Digital Covid Certificate might have been leaked
#6Nobody verified my code so far, they just eyeball the app. So the practical impact of such a leak is probably small, since people will fall for dumb forgeries already.
I had it verified constantly, both in airports and (on a trip to Italy) on pretty much every restaurant or bar I went to. I think it was only once that they were fine with showing it, all the others had scanners.
Re: Private keys used to sign EU Digital Covid Certificate might have been leaked
#7Certificates in Sweden are valid for 3 months. So, if it's the same for Italy then it's not good but not catastrophic either.
Re: Private keys used to sign EU Digital Covid Certificate might have been leaked
#8Did literally anyone not see this coming? We all know the government can’t hold on to keys. I fear this will be used as an excuse to make the passport system even more centralized.
Why the downvotes? For sure, this will just have us install (or have preinstalled) DRM-locked proprietary apps on our phones. Ugh.
Re: Private keys used to sign EU Digital Covid Certificate might have been leaked
#9Nobody verified my code so far, they just eyeball the app. So the practical impact of such a leak is probably small, since people will fall for dumb forgeries already.
I had it verified constantly, both in airports and (on a trip to Italy) on pretty much every restaurant or bar I went to. I think it was only once that they were fine with showing it, all the others had scanners.
But did you have to show an ID or could you just show a John Doe certificate?
Re: Private keys used to sign EU Digital Covid Certificate might have been leaked
#10Seems the keys have already been revoked. Doesn't mean it can't leak again, but doesn't seem to be a problem with a leaked key at the moment.
Actual source seems to be here: https://rfmirror.com/Thread-TRADING-make-EU-green-pass?page=...