Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I faked tons of Covid passes – “Weak Key Cryptography in real world”

ctrsec.io

Post reply on HN
Print view View original

181–190 of 222 posts

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#181

Post by Dylan16807 »

zirror wrote: post #33
gaius_baltar wrote: post #18

Random question, but related: Like this example, I see lots of other applications that require a QR code storing binary data and chose to encoded this data as Base64 (or others) and then add it to a ASCII-only QR code format. Why don't they use a binary-mode QR code? Compatibility?

The EU's Digital Green Certificate [1] uses Base45, which I think they basically invented. They do this because "even in Byte mode a typical QR-code reader tries to interpret a byte sequence as a UTF-8 or ISO/IEC 8859-1 encoded text."[2] They use the 45 chars allowed by the alphanumeric-mode IIRC. [1]: https://github.com/eu-digital-green-certificates/dgc-overvie... [2]: https://datatracker.ietf.org/doc/draft-faltstro…

Wait, why are they using 45 characters to encode 16 bits when you only need 41?

Especially when they could have avoided % and space.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#182

Post by josefx »

fouc wrote: post #8
johnchristopher wrote: post #5

> Although the code was provided, we took around 2 days to get this running since the code was written back in 2015. Some libraries are not currently supported forced us to make several changes on the code. The project was then running smoothly. Why not use a VM with older libraries and tools ?

Looks like the source code is meant for Amazon's EC2, so it was depending on the python/libraries on the EC2 back then, 5-6 years ago.

> 5-6 years ago.

Why does it still surprise me that that most software companies treat backwards compatibility as a joke?

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#183

Post by damethos »

0xTJ wrote: post #42
coolso wrote: post #21

Good! Keep it up. Let things be, enough of this vaccine pass comrade BS. We who are vaccinated should be at peace and trust this vaccine will reduce the likelihood of severe illness. Those who aren’t, I wish them the best, but that’s their choice. Hopefully this will finally encourage smokers to quit and the obese to cut out a few sodas per day.

Choosing not to be vaccinated is a harm to society. Being vaccinated isn't just about protecting yourself. It is people's choice not to be vaccinated, and they're responsible for the consequences of that choice, including not being allowed in spaces where they're a hazard to others.

You do realize that vaccinated people catch and spread it so what you are saying is simply ignorant. Turn off the TV and do some research on your own.

* https://www.medrxiv.org/content/10.1101/2021.09.28.21264262v...

* https://lc.org/newsroom/details/110121-lancet-study-finds-co...

* https://www.cdc.gov/coronavirus/2019-ncov/vaccines/fully-vac... ("Fully vaccinated people who do become infected can transmit it to others.")

* https://www.bbc.com/news/health-59077036

* https://www.theguardian.com/world/2021/oct/28/covid-vaccinat...

* https://www.nature.com/articles/d41586-021-02187-1

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#184

Post by dot1x »

threeseed wrote: post #61
muterad_murilax wrote: post #4

Anyone knows if this is applicable to Covid passes used in the European Union as well?

EU is in discussions right now to expire COVID passes unless you have had recent vaccines i.e. booster shots. Which means any security mechanism that is defeated will just be fixed every 9 months. Seems like a lot of hassle for a vaccine that is safe and will save your life.

source....?

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#185

Post by eqth »

roca wrote: post #115
dvt wrote: post #23

Earlier quoted context omitted.

> Good! Keep it up. Let things be, enough of this vaccine pass comrade BS. You're going to get heavily downvoted, but I totally agree. The vaccine pass is a complete farce. I even have non-technical friends that have faked vaccine passes. For someone even remotely technical, it's trivial to Photoshop. If only we had the same fervor when it comes to demonizing weight gain, we could save 10x more lives.

If only there was a super cheap, safe, effective and instant medical treatment that could prevent obesity or at least its negative health effects. Because if there was, and yet obese people refused to take it and consequently soaked up a lot of health-care resources, you can be sure they would be demonized just as much as people who refuse to take COVID vaccines.

>If only there was a super cheap, safe, effective and instant medical treatment that could prevent obesity or at least its negative health effects

>he hasn't tried not eating

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#186

Post by pawelmurias »

coolso wrote: post #119
pawelmurias wrote: post #84

Earlier quoted context omitted.

How is locking down only the anti-vax retards any worse then locking down everyone?

Because first we were told "two weeks to flatten the curve and slow the spread". We were also told we didn't really need masks. Then we were told, as late as last October by CNN, and even later by the new guy himself, we should be scared of the new vaccine, because it was released super fast, and endorsed by the last guy. Then the new guy came in and even though he had nothing to do with it, suddenly, in the blink of…

> by CNN

Why are you taking your info from fake news?

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#187

Post by _dain_ »

closeparen wrote: post #165
_dain_ wrote: post #67

Earlier quoted context omitted.

No, stripping unvaccinated people of their fundamental freedoms (as happened in countries like Lithuania and Austria) is a harm to society. More than harm, it's a complete disintegration.

High on that list of fundamental freedoms is the right of free association.

ridiculous dodge. if you want to bar your unvaxxed family from coming to thanksgiving or christmas, go right ahead. the point of a mandate is that it's MANDATED, top down, where businesses don't have any choice in the matter.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#188

Post by sofixa »

dlsa wrote: post #167
hiisukun wrote: post #164

Earlier quoted context omitted.

Not sure if you're aware, but the Aussie covid vaccination "certificate" from the government App uses a "digital hologram" to prevent forgery. It's essentially an animated gif.

Unfortunately the governments implementing these measures seem absolutely determined to treat Orwell's 1984 as a training or howto manual. As we descend further into authoritarianism, tracking and other privacy busting measures will become even more normalised and entrenched. You'll soon need to show identity and other papers to get into a shop to buy a hammer.

How did you get there? Vaccination requirements have been a thing for decades in many countries. Showing proof of vaccination to go to the mall or cinema isn't tracking anyone ( with the EU implementation at least, can't talk about all of them) about anything - it's just an app reading a QR code and deciding if it's valid locally, no internet required. Heck, in France the government explicitly stated nobody has the right to ask for an ID to verify you're the actual owner of the vaccine certificate ( bar age-restricted places like bars that have had that right anyways).

Why do people always have to jump to the slippery slope fallacy when anything happens? It's good to be cautious, but you're taking it to paranoia level.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#189

Post by sofixa »

dot1x wrote: post #184
threeseed wrote: post #61

Earlier quoted context omitted.

EU is in discussions right now to expire COVID passes unless you have had recent vaccines i.e. booster shots. Which means any security mechanism that is defeated will just be fixed every 9 months. Seems like a lot of hassle for a vaccine that is safe and will save your life.

source....?

France announced it two days ago, starting in mid January the health pass will only be valid if less than 7 months have passed since your second dose, if it's more than that you need a booster. I don't know how they'll implement this technically.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#190

Post by sofixa »

t0bia_s wrote: post #174
bellyfullofbac wrote: post #128

Earlier quoted context omitted.

https://www.nytimes.com/2021/05/07/opinion/coronavirus-airbo... In hindsight, the washing was overreaction, but you do have to realize there wasn't enough knowledge in the beginning, and people were assuming the virus was like the influenza virus, and we usually (at least the common wisdom was) catch influenza through touching snot-laden surfaces. It didn't help when China was saying things like they found some virus…

I remember early articles about how long virus stay on different surfaces. 30 days on metal, 20 days on plastic, 10 days on wood, etc. Also governments tried to convince as that we should wear masks alone in woods or cannot go out in night. Same governments told us that vaccination end spreading virus. It was all lies but still most people believe those lies because propaganda of fear is strong. Today... We still don…

> It was all lies but still most people believe those lies because propaganda of fear is strong.

No, it was all evolving knowledge of an ongoing situation involving an unknown virus, with the initial outbreak happening in a not very transparent country. Many people haven't bothered to keep up with the latest information, even with the efforts of local health authorities to bring that information to them.

> We still don't know origin of virus

Yes, and? Would that change anything in our understanding of it and how to combat it? Or do you just need someone to point s finger at and say it's all been their fault? Even in that case we'd still have to combat spread and hospitalisations ( which vaccines help with). In any case, i personally doubt we'll have a conclusive origin story of the virus. It has been more or less ( as much as possible) conclusively confirmed that it came from around a Wuhan wet market, but it'd be pretty much impossible to retrace the steps of random animals there and the event(s) that passed it to the initial humans after so much time has passed and so many have died.

Post reply on HN