Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I faked tons of Covid passes – “Weak Key Cryptography in real world”

ctrsec.io

Post reply on HN
Print view View original

201–210 of 222 posts

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#201

Post by zirror »

Dylan16807 wrote: post #181
zirror wrote: post #33

Earlier quoted context omitted.

The EU's Digital Green Certificate [1] uses Base45, which I think they basically invented. They do this because "even in Byte mode a typical QR-code reader tries to interpret a byte sequence as a UTF-8 or ISO/IEC 8859-1 encoded text."[2] They use the 45 chars allowed by the alphanumeric-mode IIRC. [1]: https://github.com/eu-digital-green-certificates/dgc-overvie... [2]: https://datatracker.ietf.org/doc/draft-faltstro…

Wait, why are they using 45 characters to encode 16 bits when you only need 41? Especially when they could have avoided % and space.

Well, tbh, I don't know the reason, I can only speculate. It is meant to encode pure binary data (cbor) and not to be human readable or URI or anything like that. It is specifically designed for QR Codes. I read through some Github issue [1] just now and as far as I can tell, it is more or less a design oversight, which might be remedied by a later version.

[1]: https://github.com/ehn-dcc-development/hcert-spec/issues/64

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#202

Post by dzhiurgis »

crocodiletears wrote: post #199
dzhiurgis wrote: post #99

Offline first seems such an oversight from contact tracing perspective. Also NFC tags could’ve been better solution, but probably would’ve sent too much Bill Gates vibes.

From what I've been able to gather, these QR code systems are mostly based off of the WEF's Commonpass digitial identity standard (either directly, or inspired by), which seems to be a graduated version of the ID2020 project (many of the same ideas and sponsors). The projects are meant to present a standardized format for the provision of easily validated information about an individual in environments where low-end…

Credit cards are widespread (esp in places that bother with covid passes) and where I live something like 90% of payments are contactless. Takes about 5 seconds.

Cynic in me says - just disable cards for the unvacced at specific venues…

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#203

Post by DenisM »

galaxyLogic wrote: post #173
DenisM wrote: post #86

Earlier quoted context omitted.

Reduce deaths? yes. But it tells us nothing about reducing spread.

Good point. Theoretically it could be possible that non-vaccinated infect fewer others than those who are vaccinated -- because unvaccinated more readily die after which they can not keep on infecting others. Nevertheless the goal is not to reduce infections but to reduce deaths and serious illness. Here's an article which says that vaccination does reduce the risk of you infecting others. But this effect diminishes…

> Nevertheless the goal is not to reduce infections but to reduce deaths and serious illness.

Whose goal? There is no shortage of people and organizations that are trying to force others to vaccinate “to prevent spread”. As your link shows the effectives of this is dubious.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#204

Post by freeflight »

pier25 wrote: post #200
freeflight wrote: post #142

Earlier quoted context omitted.

I know dozens of people working in the healthcare sector skeptical of covid vaccines, among them virologists specialized in RNA viruses. Their skepticism is far more nuanced, and evidence based, than the "All vaccines are poison/bill gates gonna 5G us!" covid vaccine skepticism is usually framed as. They do not oppose any other common sense measures, like mask wearing, they simply want to be careful about vaccines th…

I'm fully vaccinated, but I've read a couple of times how vaccines are making this worse since they provide a vector for the virus to evolve against. These claims make sense to my layman understanding, but I really have no idea.

> In human infections of highly pathogenic coronaviruses SARS-CoV and MERS-CoV, the most vulnerable populations are patients over the age of 65 and patients with comorbidities, and design of efficacious vaccines for patients in these groups is difficult. Vaccine formulations that have been developed against SARS-CoV not only fail to protect animal models of aged populations, but also result in immunopathology in younger populations, where SARS disease is enhanced in vaccinated groups that are subsequently challenged with SARSCoV

That's from USAMRIID research into broad-spectrum coronavirus antiviral drugs released in March 2019 [0], relevant citations in the paper.

They also mention the possibility of using a "modular vaccine platform", which would be RNA vaccines, but they only considered their use for emergency coverage and also point out how vaccines alone are unlikely to eradicate it, as long as the virus continues to circulate in potential animal reservoirs.

While earlier in the paper it's pointed out;

> Gammacoronaviruses and deltacoronaviruses have no known viruses that infect humans, but contain important agricultural pathogens of livestock.

Which is also an angle that seems weirdly lacking from the public debate [1]

[0] https://sci-hub.ru/10.1080/17460441.2019.1581171

[1] https://onlinelibrary.wiley.com/doi/full/10.1111/xen.12591

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#205

Post by freeflight »

galaxyLogic wrote: post #177
freeflight wrote: post #142

Earlier quoted context omitted.

I know dozens of people working in the healthcare sector skeptical of covid vaccines, among them virologists specialized in RNA viruses. Their skepticism is far more nuanced, and evidence based, than the "All vaccines are poison/bill gates gonna 5G us!" covid vaccine skepticism is usually framed as. They do not oppose any other common sense measures, like mask wearing, they simply want to be careful about vaccines th…

From the link below we see evidence that the chance of dying from Covid-19 is multiple times bigger for the unvaccinated than for the vaccinated. I wonder what kind of "smart" person ignores this evidence and puts their life at risk at will? Hey my chance of dying from Covid is 10 times bigger because I don't get vaccinated, but I won't because I believe an even worse fate awaits me if I do. What do they think that w…

> From the link below we see evidence that the chance of dying from Covid-19 is multiple times bigger for the unvaccinated than for the vaccinated.

That depends on a lot of factors, among them the virus strain, the age group or how long ago the vaccinations happened.

Germany is already having death streaks in pension homes again, were vaccination rates of the elderly are 100% [0]. But those 100% happened earlier this year, since then the vaccine protection has heavily diminished.

[0] https://www.swr.de/swraktuell/rheinland-pfalz/mainz/corona-a...

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#206

Post by Jenda_ »

throwaway55421 wrote: post #194
roca wrote: post #137

Earlier quoted context omitted.

Dunno about other countries but in NZ you can apply for medical exemption from vaccine mandates. A panel of medical professionals evaluates your situation and if they agree, you get a vaccine pass that works the same as for a vaccinated person.

So you can _apply_ for permission to take part in everyday life. Great. It's a no from me.

Some countries have chosen the other way: they left the vaccination up to people, and now nobody can take part in everyday life because of lockdowns.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#207

Post by Markoff »

galaxyLogic wrote: post #177
freeflight wrote: post #142

Earlier quoted context omitted.

I know dozens of people working in the healthcare sector skeptical of covid vaccines, among them virologists specialized in RNA viruses. Their skepticism is far more nuanced, and evidence based, than the "All vaccines are poison/bill gates gonna 5G us!" covid vaccine skepticism is usually framed as. They do not oppose any other common sense measures, like mask wearing, they simply want to be careful about vaccines th…

From the link below we see evidence that the chance of dying from Covid-19 is multiple times bigger for the unvaccinated than for the vaccinated. I wonder what kind of "smart" person ignores this evidence and puts their life at risk at will? Hey my chance of dying from Covid is 10 times bigger because I don't get vaccinated, but I won't because I believe an even worse fate awaits me if I do. What do they think that w…

these calculations always include risk groups, without them it would make look vaccine much less appealing

odds of dying from COVID for vaxxed non risk groups are pretty much same as for vaxxed non risk group, 10 times zero is still a zero

nobody is denying vaccine is helping the risk groups, but there is hardly any benefit for people not at risk (healthy weight, no chronic disease)

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#208

Post by galaxyLogic »

DenisM wrote: post #203
galaxyLogic wrote: post #173

Earlier quoted context omitted.

Good point. Theoretically it could be possible that non-vaccinated infect fewer others than those who are vaccinated -- because unvaccinated more readily die after which they can not keep on infecting others. Nevertheless the goal is not to reduce infections but to reduce deaths and serious illness. Here's an article which says that vaccination does reduce the risk of you infecting others. But this effect diminishes…

> Nevertheless the goal is not to reduce infections but to reduce deaths and serious illness. Whose goal? There is no shortage of people and organizations that are trying to force others to vaccinate “to prevent spread”. As your link shows the effectives of this is dubious.

> Whose goal?

My goal. I assume also your goal. And I assume people who try to "prevent spread" do so because spread of Covid-19 causes death and serious illness.

There have been 799,276 Covid-deaths in the US during the short period it's been around. Almost 800k people dead. Dead. If there was no "Covid spread" those people would not have caught Covid and thus would not have died because of it.

To reduce Covid deaths and serious Covid illness you must try to reduce its spread. If you stop it from spreading you stop it from killing people.

https://www.worldometers.info/coronavirus/country/us/

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#209

Post by Dylan16807 »

zirror wrote: post #201
Dylan16807 wrote: post #181

Earlier quoted context omitted.

Wait, why are they using 45 characters to encode 16 bits when you only need 41? Especially when they could have avoided % and space.

Well, tbh, I don't know the reason, I can only speculate. It is meant to encode pure binary data (cbor) and not to be human readable or URI or anything like that. It is specifically designed for QR Codes. I read through some Github issue [1] just now and as far as I can tell, it is more or less a design oversight, which might be remedied by a later version. [1]: https://github.com/ehn-dcc-development/hcert-spec/issue…

> It is meant to encode pure binary data (cbor) and not to be human readable or URI or anything like that.

Well the reason to care is to avoid QR decoder quirkiness, otherwise you should probably just use the binary encoding.

> I read through some Github issue [1]

According to a comment near they end they were originally going to try to pack everything as a single base 45 bignum, so that half explains it. But not why they'd stick with 45 characters when changing that.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#210

Post by throwaway55421 »

Jenda_ wrote: post #206
throwaway55421 wrote: post #194

Earlier quoted context omitted.

So you can _apply_ for permission to take part in everyday life. Great. It's a no from me.

Some countries have chosen the other way: they left the vaccination up to people, and now nobody can take part in everyday life because of lockdowns.

False dichotomy, lockdown is a choice.

I will never lock down.

Post reply on HN