Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private keys used to sign EU Digital Covid Certificate might have been leaked

nitter.net

Post reply on HN
Print view View original

71–80 of 214 posts

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#71

Post by mgraupner »

distances wrote: post #54
cwizou wrote: post #48

Earlier quoted context omitted.

It's definitely a solution when you have an app (assuming you have a 3rd party source of identification of users), but since it's a French key, a sizeable portion of people, mostly elderly, are not using the "official" app but a paper printed QR code that was given to them at the time of the second injection (or a picture of said code). Since the French app is pretty terrible (it used to be the barely functional cont…

Does carrying just a QR code work fine for you? My experience from Germany is that nobody scans the code, they just scroll to details to see there's two vaccinations recorded. This far my QR code has only actually been scanned at the airport.

Same for me, everybody touches my phone to scroll down the screen, nobody scans it. Way to handle a pandemic...

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#72

Post by tiagod »

capableweb wrote: post #10

Seems the keys have already been revoked. Doesn't mean it can't leak again, but doesn't seem to be a problem with a leaked key at the moment. Actual source seems to be here: https://rfmirror.com/Thread-TRADING-make-EU-green-pass?page=...

Certificate still works on the Portuguese cert checking app as of 13:35 GMT

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#73

Post by gpderetta »

Aachen wrote: post #21
gpderetta wrote: post #13

Earlier quoted context omitted.

At least in UK the app will generate a new certificate on the fly.

So it also automatically resigns the forged certs, or how does it tell the difference?

As far as I understand, it connect to some NHS server and after authentication it fetches a certificate that has been signed by the server.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#74

Post by tialaramex »

roblabla wrote: post #33
cm2187 wrote: post #25

Earlier quoted context omitted.

What prevents you from backdating a forged certificate then?

I'm not aware of how the COVID certs work, but the way that's solved in TLS certificates (used for https) is that when signing, you have to use an approved timestamping authority. A timestamping authority will basically say "Yes, this action was taken at exactly this time". See [0]. [0]: https://en.wikipedia.org/wiki/Trusted_timestamping

Timestamping does exist but it isn't used in the Web PKI (what you're calling "TLS certificates")

Both backdating and forward dating have been done in the Web PKI for various reasons, both legitimate (e.g. historically if you couldn't randomise serial numbers enough it was acceptable to randomise the notBefore time parameters slightly, this is no longer allowed) and illegitimate (we have pretty good circumstantial evidence that StartCom issued SHA-1 certificates long after such issuance was forbidden, probably for $$$ from companies that realised they should have bought one before the cut-off) but there is no inclination to insist upon timestamping to try to prevent that.

The most likely place you'll see timestamping in arguably publicly trusted certificates is code signing.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#75

Post by vladharbuz »

wasmitnetzen wrote: post #68
CodesInChaos wrote: post #4

Nobody verified my code so far, they just eyeball the app. So the practical impact of such a leak is probably small, since people will fall for dumb forgeries already.

It varies widely by country. From personal experience and what I've heard from relatives, at private venues: * Germany: usually quick glance at the QR code * France: usually properly scanned * Sweden: not even planned to be used * Italy: usually properly scanned

* Denmark: Usually only a quick glance at the QR code

* Switzerland: Usually, but not always, scanned

(Obviously anecdotal.)

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#76

Post by aqme28 »

wasmitnetzen wrote: post #68
CodesInChaos wrote: post #4

Nobody verified my code so far, they just eyeball the app. So the practical impact of such a leak is probably small, since people will fall for dumb forgeries already.

It varies widely by country. From personal experience and what I've heard from relatives, at private venues: * Germany: usually quick glance at the QR code * France: usually properly scanned * Sweden: not even planned to be used * Italy: usually properly scanned

Berlin: Seems like most places will actually scan it.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#77

Post by andrewaylett »

capableweb wrote: post #10

Seems the keys have already been revoked. Doesn't mean it can't leak again, but doesn't seem to be a problem with a leaked key at the moment. Actual source seems to be here: https://rfmirror.com/Thread-TRADING-make-EU-green-pass?page=...

Maybe, but I installed the Scottish validation app a couple of minutes ago and it's still coming up green.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#78

Post by pmontra »

distances wrote: post #54
cwizou wrote: post #48

Earlier quoted context omitted.

It's definitely a solution when you have an app (assuming you have a 3rd party source of identification of users), but since it's a French key, a sizeable portion of people, mostly elderly, are not using the "official" app but a paper printed QR code that was given to them at the time of the second injection (or a picture of said code). Since the French app is pretty terrible (it used to be the barely functional cont…

Does carrying just a QR code work fine for you? My experience from Germany is that nobody scans the code, they just scroll to details to see there's two vaccinations recorded. This far my QR code has only actually been scanned at the airport.

My experience in Italy is evenly split between these two cases:

1. Scan the code with the app every time.

2. Ask if I have the pass, maybe look at it once, hopefully remember me the next times.

There is also a small percentage of cases of no questions asked, ever.

By the way, I'm using a printed copy of the pass. It never runs out of battery, I don't mind if it falls on the floor when I'm using it, it works even if I'm using the phone for something else. Cons: it needs to be replaced if its key gets revoked.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#79

Post by m-p-3 »

cwizou wrote: post #48
gpderetta wrote: post #13

Earlier quoted context omitted.

At least in UK the app will generate a new certificate on the fly.

It's definitely a solution when you have an app (assuming you have a 3rd party source of identification of users), but since it's a French key, a sizeable portion of people, mostly elderly, are not using the "official" app but a paper printed QR code that was given to them at the time of the second injection (or a picture of said code). Since the French app is pretty terrible (it used to be the barely functional cont…

There is no pretty way to fix that, anything signed by a revoked key automatically becomes invalid.

Re: Private keys used to sign EU Digital Covid Certificate might have been leaked

#80

Post by nicoburns »

cwizou wrote: post #48
gpderetta wrote: post #13

Earlier quoted context omitted.

At least in UK the app will generate a new certificate on the fly.

It's definitely a solution when you have an app (assuming you have a 3rd party source of identification of users), but since it's a French key, a sizeable portion of people, mostly elderly, are not using the "official" app but a paper printed QR code that was given to them at the time of the second injection (or a picture of said code). Since the French app is pretty terrible (it used to be the barely functional cont…

> Since the French app is pretty terrible (it used to be the barely functional contact tracing app that didn't want to use Google/Apple's API, so there's a pretty strong popular stigma against it)

Yeah the UK very wisely put the passports and the contract tracing in separate apps (helps that the NHS already had an app pre-pandemic). Not sure if it was intentional, but it certainly sidesteps this issue!

Post reply on HN