Random question, but related: Like this example, I see lots of other applications that require a QR code storing binary data and chose to encoded this data as Base64 (or others) and then add it to a ASCII-only QR code format. Why don't they use a binary-mode QR code? Compatibility?
I faked tons of Covid passes – “Weak Key Cryptography in real world”
31–40 of 222 posts
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#32Good! Keep it up. Let things be, enough of this vaccine pass comrade BS. We who are vaccinated should be at peace and trust this vaccine will reduce the likelihood of severe illness. Those who aren’t, I wish them the best, but that’s their choice. Hopefully this will finally encourage smokers to quit and the obese to cut out a few sodas per day.
> Good! Keep it up. Let things be, enough of this vaccine pass comrade BS. You're going to get heavily downvoted, but I totally agree. The vaccine pass is a complete farce. I even have non-technical friends that have faked vaccine passes. For someone even remotely technical, it's trivial to Photoshop. If only we had the same fervor when it comes to demonizing weight gain, we could save 10x more lives.
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#33Random question, but related: Like this example, I see lots of other applications that require a QR code storing binary data and chose to encoded this data as Base64 (or others) and then add it to a ASCII-only QR code format. Why don't they use a binary-mode QR code? Compatibility?
[1]: https://github.com/eu-digital-green-certificates/dgc-overvie...
[2]: https://datatracker.ietf.org/doc/draft-faltstrom-base45/
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#34Earlier quoted context omitted.
> Good! Keep it up. Let things be, enough of this vaccine pass comrade BS. You're going to get heavily downvoted, but I totally agree. The vaccine pass is a complete farce. I even have non-technical friends that have faked vaccine passes. For someone even remotely technical, it's trivial to Photoshop. If only we had the same fervor when it comes to demonizing weight gain, we could save 10x more lives.
weight gain isn't contagious
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#35Earlier quoted context omitted.
It seems that actually nothing has had a meaningful impact on coronavirus spread.
> seems…nothing has had a meaningful impact on coronavirus spread Not sure if trolling, but in case not, vaccination has had “a substantial impact on mitigating COVID-19 outbreaks” in America [1]. [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7709178/
I'd love to see a paper explaining why some two months ago cases were already at or approaching record highs in countries with 70-90% vaccination rates, like UK, Israel, multiple EU nations...Gibraltar is particularly interesting because it has a nearly 100% vaccination rate, yet the case rate continues to climb unabated. [0]
People are treating these vaccines as though they were sacrosanct and unquestionable. Meanwhile the pandemic continues nearly unabated and no, this is not a "pandemic among the vaccinated", despite the fervor with which certain interests have attempted to paint such a picture. Public UK data suggests that vaccinated individuals may actually be more likely to be infected some months after their second doses. But no one is talking about that...
0. https://www.worldometers.info/coronavirus/country/gibraltar/
1. https://vladtepesblog.com/2021/10/10/is-this-ade-uk-data-sho... - yes, it's a blog, but it links to the data for you to review yourself. Check the last two columns of the chart on page 13.
This wouldn't be the first time that humans failed to solve a complex problem, I don't see why its so difficult for people to accept this possibility.
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#36Earlier quoted context omitted.
weight gain isn't contagious
Actually, it is , as it tends to be intergenerational[1]. Parents that don't care about their health will raise kids that don't care about their health. [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5305001/
There’s also the massive costs to our healthcare system and insurance premiums.
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#37Earlier quoted context omitted.
It seems that actually nothing has had a meaningful impact on coronavirus spread.
> seems…nothing has had a meaningful impact on coronavirus spread Not sure if trolling, but in case not, vaccination has had “a substantial impact on mitigating COVID-19 outbreaks” in America [1]. [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7709178/
At a glance, infection rates and vaccination rates seem to be uncorrelated at best.
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#38Anyone knows if this is applicable to Covid passes used in the European Union as well?
The private keys for the European Green Pass have been leaked and fake passes signed with the keys are being sold on the dark web. https://threatpost.com/eus-green-pass-vaccination-id-private...
There have been fraudulently obtained passes sold on the dark web. There have also been numerous arrests throughout the whole of Europe for this.
The vast majority of the dark-web suppliers are scammers - many of the adverts include a mix of QRs people have posted to social media and a large number of example QR. Including examples that I have generated in the past and used in presentations / on github.
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#39Good! Keep it up. Let things be, enough of this vaccine pass comrade BS. We who are vaccinated should be at peace and trust this vaccine will reduce the likelihood of severe illness. Those who aren’t, I wish them the best, but that’s their choice. Hopefully this will finally encourage smokers to quit and the obese to cut out a few sodas per day.
While I agree with you in principle, in this specific case smokers have an advantage; it is harder for them to get covid. So here it is not exactly motivating to stop smoking.
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#40Random question, but related: Like this example, I see lots of other applications that require a QR code storing binary data and chose to encoded this data as Base64 (or others) and then add it to a ASCII-only QR code format. Why don't they use a binary-mode QR code? Compatibility?
It starts with JWT. JSON is a human readable format (in utf-8), if humans don't need to read, the data could be binary, and the format could be exact. JSON isn't an exact spec, which is mostly inherited from JavaScript (there's no such thing as an integer only floating point, so 1e3==1000==1000.0==1.00e3 in human-readable form, as a stored number they are identical). Then there's differences in white-space (new lines, indentation) - although this could likely be overcome with convention. Because of this the JWT creators said instead of signing the data, we'll sign the exact representation in the payload - but of course with white-space and formatting variance (including a deserialize/serialize loops changing representations, or - in the case of bearer tokens, the HTTP spec allowing newlines/white space to be inserted at the protocol level) they had to encode it as non-human readable (base64). Now everyone agrees you're signing that exact Base64 representation of the JSON object. But! We've build a(n arguably verbose) human readable format that isn't readable by humans.
The SHC spec (common in North America) actually holds a JWT that's signed by an elliptic curve private key. You can validate the signature with a public key. The public/private choice here is great, the JWT is terrible.. they've doubled down on the mistakes. Further to keep the QR smallish, they zipped the payload portion (which is supported by JWT - this is done before the base64 stage), and use only the minimum QR resilience setting (which is fine if it's on a screen, if it's printed this may lead to reading problems). Now we have human readable (JSON) compressed in machine readable (deflate) in machine readable (base 64) in machine readable (QR) - for machine reading purposes. They didn't even trim the fluff (every SHC begins with 56 because.. you guessed it, the `{` character), or use sensible choices (they don't use IssuedAt/iat, but NotBefore/nbf to indicate the generation date). Anyway, SHC (reasonably) noticed because of the (mostly) base64 encoding the character set is only 64 characters (6 bits) which doesn't use the ASCII space (7 bits) very well, so they store the first 'shc://' in ASCII and the rest is a number (there are three modes in QR: ASCII, binary, numeric - the density loosely matches binary representations - a numeric digit (0-9) takes 4 bits, ascii char takes 7 and binary takes 8).
ASCII doesn't support the world very well, UTF8 isn't supported by QR (except as binary).
In the SHC case, because it's signing a specific format/output of the JSON data, it doesn't have the white-space formatting concerns that JWTs have to overcome. If they wanted to stick with a JWT like format (JSON object), they could have skipped the base64 before sign step, at which point they might as well get rid of the header (we're no longer to JWT spec), deflate the message to be signed, and put the signature after the deflated message. All the same data, less of the overhead, and better use of the binary space.