Live data from Hacker News

Private keys used to sign EU Digital Covid Certificate might have been leaked

nitter.net

51–60 of 214 posts

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#51

What will last longer, the pandemic or a poorly implemented digital identity platform?

Given it is the same "poorly implemented digital identity platform" that has been in use for the last 40 years, and secures basically every form of non in person communication you conduct, I am expecting that to continue for a bit longer.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#53
post #18

Earlier quoted context omitted.

I am not using an app. I am not installing any third party apps on my phone, government or not, period. The certificate I am using is printed on a piece of paper I carry with me.

Can't you keep it in a jpeg file and show that?

You can do both. In addition to these two methods I also have a print of that QR code in my car.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#54
post #48

Earlier quoted context omitted.

At least in UK the app will generate a new certificate on the fly.

It's definitely a solution when you have an app (assuming you have a 3rd party source of identification of users), but since it's a French key, a sizeable portion of people, mostly elderly, are not using the "official" app but a paper printed QR code that was given to them at the time of the second injection (or a picture of said code). Since the French app is pretty terrible (it used to be the barely functional cont…

Does carrying just a QR code work fine for you? My experience from Germany is that nobody scans the code, they just scroll to details to see there's two vaccinations recorded. This far my QR code has only actually been scanned at the airport.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#55

What will last longer, the pandemic or a poorly implemented digital identity platform?

These tyrants would love to hold on to these these digital “covid passports” because it gives them complete control over who can participate in society. They’d be able to exclude people who don’t comply with increasingly invasive protocols. It’s about power. The pandemic technically should already be considered endemic. For example in the USA the vast majority of the population has antibodies, in a significantly higher number than the 60 to 70 percent threshold that Fauci and other public servants claimed as the target over the last year.

More than 80% of Americans have coronavirus antibodies acquired through infection or vaccination, according to a new study of over 1.4 million blood donations across the U.S.

https://www.miamiherald.com/news/coronavirus/article25398704...

And as reported on by Bloomberg and other media, the antibodies from past infection confer protection equal to or greater than Pfizer.

https://www.bloomberg.com/news/articles/2021-08-27/previous-...

"Previous Covid Prevents Delta Infection Better Than Pfizer Shot"

And those are slated to last for decades. Source:

https://www.nature.com/ articles/d41586-021-01442-9

"Had COVID? You’ll probably make antibodies for a lifetime"

On the exact terms given to us by Fauci and other public servants, there is no more reason for these covid mandates to exist. Should be optional across the board, including in EU countries where the threshold has been reached. Then there’s no more need to secure these keys.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#56
post #7

Certificates in Sweden are valid for 3 months. So, if it's the same for Italy then it's not good but not catastrophic either.

(Italian here) AFAIK Italy implemented the logic to be valid for 9 months, which wasn't ideal and it shows its limit in situations like this since we don't have a short expiry date.

Dunno if in the end they also put in place some kind of blacklisting for leaked certificates

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#57
post #44

Earlier quoted context omitted.

Apparently the leaked keys have already been blacklisted. So all certificates signed with the leaked keys will need to be reissued. FWIW, it wasn't the Italian key that was leaked.

They seem to be quite thorough with checking QR certificates in Italy so it doesn't surprize me if this was discovered there.

Very anecdotally I spent three weeks in Italy this summer and my (UK) covid pass wasn't checked even once (In fact I also had to spend 5 days or something in isolation and nobody ever bothered to check or followup). I understand that compliance is very location specific.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#58
post #35

Earlier quoted context omitted.

As opposed to private entities that are known to be able to keep keys secret all the time?

Don't know if this is whst the OP has in mind, but the first thing that comes to my mind is the backdoor that many states want to impose on all encrypted communications. That would create a single point of attack, so even assuming competence, it makes the system significantly weaker. And this episode if confirmed makes competence a strong assumption.

It very much points to incompetence. I just don't think governments are specifically more incompetent than private entities in this case.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#59

Does it have to be the keys that are leaked? There should be hundreds of healthcare workers who have access to the covid certificate system. I find it more likely there's an option to enter custom data for non-citizens and someone was just messing around.

Maybe some unprotected API gateway?

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#60
post #34

Earlier quoted context omitted.

well, print it again then.

I know this, but a lot of people may not know because they don't care to read HN. Then they try to board a plane and get rejected.

to be fair, yes, you are right, it is going to be a pain for a lot of people.
Post reply on HN