Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I faked tons of Covid passes – “Weak Key Cryptography in real world”

ctrsec.io

Post reply on HN
Print view View original

91–100 of 222 posts

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#91

Post by heinrich5991 »

airesearcher wrote: post #85

Physical Covid certificates are also not secure at all. They are easy to copy or fake. Any scheme which simply puts a cryptographic number on a some Physical card - or behind a regular QR is not secure. A simple photocopy will work just as well as the original. Not to mention Photoshop. But there is actually a new way to make physical things - like printed Covid vaccination cards - provably unique and authentic. Much…

The QR codes in Germany include your name and a digital signature. You can photocopy them, but the photocopy doesn't work for another person (if the venues would actually ask for your ID).

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#92

Post by jgeralnik »

The author went out of their way to hide the factors of N, presumably so that nobody else would actually be able to generate signed certificates. However, they did this by hiding half the digits of the factors.

Revealing so many digits of the factors actually allows easily factoring the original number using a version of coppersmith's method (easy as in under a second on my laptop instead of the 9 hours on a distributed cluster the authors used). This is actually a pretty classic CTF exercise.

If I'm still nerdsniped by this tomorrow I'll try my hand at implementing this and factoring the number myself

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#93

Post by _dain_ »

wott wrote: post #87
_dain_ wrote: post #60

Earlier quoted context omitted.

> "immunisation with either the Pfizer or AstraZeneca vaccine reduced the chance of onward virus transmission by 40–60%" [1] so why are there still soaring case rates in the countries with the most vaccines? I'll trust my lying eyes, thank you. it's honestly insulting that you can post some pissant "study" like this and expect to be taken seriously when anyone can just look at the case rates and vax rates by country…

> so why are there still soaring case rates in the countries with the most vaccines? Vaccinated people are not submitted to the same constraints (such as mandatory tests for accessing this and that) so carry the virus in more places favourable for transmission. They also don't worry as much about getting the virus (at the same time rightfully so and not rightfully so), so they give up on taking the precautions they t…

>Vaccinated people are not submitted to the same constraints (such as mandatory tests for accessing this and that) so carry the virus in more places favourable for transmission. They also don't worry as much about getting the virus (at the same time rightfully so and not rightfully so), so they give up on taking the precautions they took the previous year, and they also do not take a test when symptoms arise but remain light. All this unfortunately compensate for the fact that, individually, they are less subjected to spreading the virus.

this is complete conjecture and moreover the conditions vary by place. for my part (in england) there are no meaningful restrictions on anyone whatsoever, so this can't be the explanation. I've also heard completely opposing theories, that the _un_vaccinated aren't worried about getting the virus so they don't get tested. you can spin any theory you want. nobody knows shit.

(by the way, england currently has the lowest case rates out of the four UK countries + ROI, despite those other jurisdictions having coronapass regimes of varying strictness)

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#94

Post by dvt »

threeseed wrote: post #79
coolso wrote: post #36

Earlier quoted context omitted.

Furthermore, even outside of an immediate family, the more overweight people are, the more socially acceptable it becomes, resulting in more obesity. There’s also the massive costs to our healthcare system and insurance premiums.

And yet obesity whilst being a problem for decades has not caused an epidemic of obese people. Why is that ? Because obesity is not contagious and most people don't make decisions about what they eat and their activity levels based on choices other people make.

> And yet obesity whilst being a problem for decades has not caused an epidemic of obese people.

Really? Over 40% of US adults being obese[1] is not an epidemic?

[1] https://www.cdc.gov/obesity/data/adult.html

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#95

Post by ipython »

gnabgib wrote: post #40
gaius_baltar wrote: post #18

Random question, but related: Like this example, I see lots of other applications that require a QR code storing binary data and chose to encoded this data as Base64 (or others) and then add it to a ASCII-only QR code format. Why don't they use a binary-mode QR code? Compatibility?

It's a weird situation, but it's very obvious with HC1 and SHC cards. It starts with JWT. JSON is a human readable format (in utf-8), if humans don't need to read, the data could be binary, and the format could be exact. JSON isn't an exact spec, which is mostly inherited from JavaScript (there's no such thing as an integer only floating point, so 1e3==1000==1000.0==1.00e3 in human-readable form, as a stored number t…

It doesn’t make any sense to me why they gzipped the data. I’ve looked at a few real world DGCs and the “compressed” output was actually larger than the original data! Just adds more complexity for no purpose…

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#96

Post by dvt »

Scharkenberg wrote: post #66
dvt wrote: post #34

Earlier quoted context omitted.

Actually, it is , as it tends to be intergenerational[1]. Parents that don't care about their health will raise kids that don't care about their health. [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5305001/

That's not what contagious means.

Wrong: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5124998/ (also see footnote 1).

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#97

Post by dvt »

threeseed wrote: post #59
dvt wrote: post #23

Earlier quoted context omitted.

> Good! Keep it up. Let things be, enough of this vaccine pass comrade BS. You're going to get heavily downvoted, but I totally agree. The vaccine pass is a complete farce. I even have non-technical friends that have faked vaccine passes. For someone even remotely technical, it's trivial to Photoshop. If only we had the same fervor when it comes to demonizing weight gain, we could save 10x more lives.

5+ million people have died from COVID. Despite having most of the world being under lockdown as well as increasing vaccination. Without those measures it could easily have been hundreds of millions. It is ridiculous and baseless to compare it to obesity which is not causing any significant strain on the hospital system like COVID is.

> It is ridiculous and baseless to compare it to obesity which is not causing any significant strain on the hospital system like COVID is.

Wrong[1][2][3][4]. I get that it may not be politically convenient for you, but let's not mince words: obesity is killing many more people than COVID ever did or ever will.

[1] https://www.cardinalhealth.com/en/essential-insights/obesity....

[2] https://www.npr.org/templates/story/story.php?storyId=111302...

[3] https://www.the-hospitalist.org/hospitalist/article/123191/o...

[4] https://www.theguardian.com/society/2018/apr/04/obesity-putt...

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#98

Post by twofornone »

jschwartzi wrote: post #74
twofornone wrote: post #35

Earlier quoted context omitted.

That paper is purely based on a model with [optimistic] assumed effectiveness and transmission parameters. It does not consider any actual infection statistics to come to its conclusion. I'd love to see a paper explaining why some two months ago cases were already at or approaching record highs in countries with 70-90% vaccination rates, like UK, Israel, multiple EU nations...Gibraltar is particularly interesting bec…

In my state the vaccination rate is above 70% and the hospitalization rate has decoupled from the positive rate. The spike this winter ended in October whereas last winter it didn’t end until January. We’ve been on a downward trend even with shows and restaurants open and people having parties. So I would cite that as evidence the vaccine is protecting our population.

Or perhaps people are acquiring immunity through contact since the majority of cases have been known to be mild or asymptomatic since the pandemic started? And/or the virus is mutating into less infectious substrains?

Cold/flu viruses come and go. This virus will do the same. People will see it as evidence that the vaccines worked when in reality the pandemic very likely would have ended without them, yet here we are facing mandates...

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#100

Post by bonzini »

sgtnoodle wrote: post #41
sgtnoodle wrote: post #29

Earlier quoted context omitted.

The link you provided describes a simulation based on assumed vaccine effectiveness. It's also from 1 year ago. It doesn't seem to reflect any statistically backed insights into what's actually happened over the past year. Or am I missing something?

Trying to find some actual data, I googled "covid deaths by month" and I stumbled upon this: https://www.worldometers.info/coronavirus/coronavirus-death-... Notably, the "Growth Factor" plot looks qualitatively very similar from April 2020 until now. Before then, the data looks more noisy to me but not necessarily different on average. I believe folk started getting vaccinated in December 2020? Based on that plot, it…

The current virus has a natural growth factor that is about 3x larger than the OG. So vaccines are at least 66% effective if they are keeping it at bay. Probably more since lots of countries have very low restrictions compared to last year.
Post reply on HN