Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private keys used to sign EU Digital Covid Certificate might have been leaked

nitter.net

Post reply on HN
Print view View original

61–70 of 214 posts

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#61

Post by cwizou »

distances wrote: post #54
cwizou wrote: post #48

Earlier quoted context omitted.

It's definitely a solution when you have an app (assuming you have a 3rd party source of identification of users), but since it's a French key, a sizeable portion of people, mostly elderly, are not using the "official" app but a paper printed QR code that was given to them at the time of the second injection (or a picture of said code). Since the French app is pretty terrible (it used to be the barely functional cont…

Does carrying just a QR code work fine for you? My experience from Germany is that nobody scans the code, they just scroll to details to see there's two vaccinations recorded. This far my QR code has only actually been scanned at the airport.

So I haven't had an issue yet and having the QR code is definitely sufficient in France (and always attempted to check when appropriate in my personal experience, no ID check though as that was deemed illegal).

There is however a prevalent issue with QR code scanning that I noticed twice personally (and friends reported the same experiences at other places), which is that most restaurants use a super cheap phone/tablet with a terrible camera that usually is unable to focus on a smartphone screen correctly.

Once, the person was honest about it and explained they kept having issues with it, and I tried to help him focus correctly his device (QR code size + luminosity seems to be the issue from what I saw).

The second one tried a couple of time, didn't manage to focus and told me "all ok" despite it's device not having scanned me (I could see the screen).

If I had to travel though, I'd definitely take the paper certificate on top of it, as, at least here in France, that's considered for better of for worse the source of truth.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#62

Post by VortexDream »

distances wrote: post #54
cwizou wrote: post #48

Earlier quoted context omitted.

It's definitely a solution when you have an app (assuming you have a 3rd party source of identification of users), but since it's a French key, a sizeable portion of people, mostly elderly, are not using the "official" app but a paper printed QR code that was given to them at the time of the second injection (or a picture of said code). Since the French app is pretty terrible (it used to be the barely functional cont…

Does carrying just a QR code work fine for you? My experience from Germany is that nobody scans the code, they just scroll to details to see there's two vaccinations recorded. This far my QR code has only actually been scanned at the airport.

I've had my QR code scanned going to bars and restaurants in Germany. Works fine.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#64

Post by darkwater »

distances wrote: post #54
cwizou wrote: post #48

Earlier quoted context omitted.

It's definitely a solution when you have an app (assuming you have a 3rd party source of identification of users), but since it's a French key, a sizeable portion of people, mostly elderly, are not using the "official" app but a paper printed QR code that was given to them at the time of the second injection (or a picture of said code). Since the French app is pretty terrible (it used to be the barely functional cont…

Does carrying just a QR code work fine for you? My experience from Germany is that nobody scans the code, they just scroll to details to see there's two vaccinations recorded. This far my QR code has only actually been scanned at the airport.

In Italy they scan it regularly at restaurants, at least where I'm from. And I have a UE certificate, not an italian one, and never had any complain.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#65

Post by darkwater »

gpderetta wrote: post #57
ginko wrote: post #44

Earlier quoted context omitted.

They seem to be quite thorough with checking QR certificates in Italy so it doesn't surprize me if this was discovered there.

Very anecdotally I spent three weeks in Italy this summer and my (UK) covid pass wasn't checked even once (In fact I also had to spend 5 days or something in isolation and nobody ever bothered to check or followup). I understand that compliance is very location specific.

In summer it wasn't yet mandatory AFAIK (and in fact Italy was using a slightly different certificate back then)

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#66

Post by secondcoming »

cm2187 wrote: post #28
gpderetta wrote: post #13

Earlier quoted context omitted.

At least in UK the app will generate a new certificate on the fly.

Don't know for covid passport (since it is not enforced in the UK), but for travel certificates I believe the QR code has a validity of 3 months.

The covid passport is enforced in Scotland.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#67

Post by jonathanstrange »

Aachen wrote: post #21
gpderetta wrote: post #13

Earlier quoted context omitted.

At least in UK the app will generate a new certificate on the fly.

So it also automatically resigns the forged certs, or how does it tell the difference?

It tells the difference by looking up the test results in a database. At least that's how it works in Portugal. You can also use the app to look up other health related information.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#68

Post by wasmitnetzen »

CodesInChaos wrote: post #4

Nobody verified my code so far, they just eyeball the app. So the practical impact of such a leak is probably small, since people will fall for dumb forgeries already.

It varies widely by country. From personal experience and what I've heard from relatives, at private venues:

* Germany: usually quick glance at the QR code

* France: usually properly scanned

* Sweden: not even planned to be used

* Italy: usually properly scanned

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#69

Post by toyg »

wasmitnetzen wrote: post #68
CodesInChaos wrote: post #4

Nobody verified my code so far, they just eyeball the app. So the practical impact of such a leak is probably small, since people will fall for dumb forgeries already.

It varies widely by country. From personal experience and what I've heard from relatives, at private venues: * Germany: usually quick glance at the QR code * France: usually properly scanned * Sweden: not even planned to be used * Italy: usually properly scanned

* England: what is even covid

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#70

Post by toyg »

gpderetta wrote: post #57
ginko wrote: post #44

Earlier quoted context omitted.

They seem to be quite thorough with checking QR certificates in Italy so it doesn't surprize me if this was discovered there.

Very anecdotally I spent three weeks in Italy this summer and my (UK) covid pass wasn't checked even once (In fact I also had to spend 5 days or something in isolation and nobody ever bothered to check or followup). I understand that compliance is very location specific.

They got strict in the last month; now if you can't present a pass you might even be refused your salary. There have been demonstrations about this, as you might expect.

I agree that the tracing this summer was less than perfunctory, my brother had your same experience (his girlfriend wasn't even "declared", and nobody checked), and there was no Green Pass at all. Everyone wanted the tourists back so badly that the overall approach was to basically tick checkboxes and leave it at that. They got serious when it became clear the virus would be around all winter because of the Delta variant.

Post reply on HN