Digging into Quebec's electronic proof of vaccination
1–10 of 42 posts
Re: Digging into Quebec's electronic proof of vaccination
#2Québec's government has historically been incompetent regarding anything digital (a lot of their website are still barely usable), but I want to give credit where credit is due: their vaccine appointment website as well as their proof-of-vaccination has been really well done.
Re: Digging into Quebec's electronic proof of vaccination
#3Québec's government has historically been incompetent regarding anything digital (a lot of their website are still barely usable), but I want to give credit where credit is due: their vaccine appointment website as well as their proof-of-vaccination has been really well done.
> their vaccine appointment website
It would have been even better if they did the "your ticket is reserved" with a countdown to give you time to fill the form.
Re: Digging into Quebec's electronic proof of vaccination
#4Québec's government has historically been incompetent regarding anything digital (a lot of their website are still barely usable), but I want to give credit where credit is due: their vaccine appointment website as well as their proof-of-vaccination has been really well done.
> their vaccine appointment website It would have been even better if they did the "your ticket is reserved" with a countdown to give you time to fill the form.
Yep... that was a bit stressful
Re: Digging into Quebec's electronic proof of vaccination
#5The underlying cryptographic technology here: "Verifiable Credentials" is quite exciting. If you have ever wondered "why aren't bureaucracies using digital signatures?" then VCs are interesting.
It's a pretty decent technical spec for signing statements like "This person has this age" or "this person is vaccinated" or "this person is authorized for this bank-account as executor of a will". It is a spec written by cryptographers and hackers.
At the same time, it is a spec being used by banks, governments, and health-care. That is, its not just a nice technical ivory tower idea, it is actually liked by people who would use it. Why do these organizations want to use this? Because, without cryptographic guarantees, your business processes involve a whole lot of bureaucracy, manual checking of data, implicit trust relations, and friction (so much friction).
That friction is part of why people would actually want to use it. Essentially, all you need to do to share required data is scan some QR codes. Another, maybe more important part, is control over your data. You determine who you show your VC. It is not needed for two organizations to have access to all of their shared data they need. They give the used the data, and the user hands it over, or he doesn't.
The general concept behind all of this is sometimes called SSI (Self Sovereign Identity).
Re: Digging into Quebec's electronic proof of vaccination
#6Québec's government has historically been incompetent regarding anything digital (a lot of their website are still barely usable), but I want to give credit where credit is due: their vaccine appointment website as well as their proof-of-vaccination has been really well done.
As an immigrant from the US, I find most of Quebec's government websites to be quite good actually. But maybe that's just my low standards.
Re: Digging into Quebec's electronic proof of vaccination
#7Québec's government has historically been incompetent regarding anything digital (a lot of their website are still barely usable), but I want to give credit where credit is due: their vaccine appointment website as well as their proof-of-vaccination has been really well done.
As an immigrant from the US, I find most of Quebec's government websites to be quite good actually. But maybe that's just my low standards.
Can you still catch a bus in Montreal at 26:30h? :) Used to be able to see bus schedules online for busses STM well-passed the 24h mark. Something about the technology not being ready for late-night busses on the 'next day' being attached to 'today'? Or something.
Re: Digging into Quebec's electronic proof of vaccination
#8I'm surprised to be out of the loop on this. This is the first I've heard of Quebec's vaccine passports. As the OP says, it also implies there is an app, with a vendor, an infrastructure, and key management. (smarthealthit and azure as it appears to turn out)
The ethics and legality of vaccine passports are still very controversial, and using Quebec as a test ground for it seems like its part of an inevitable push, independent of popular assent to it. It's force, basically.
Using a JWT is sufficient for the purposes, and the vaccination status is basically a digital ID. This provides some mature and flexible structure to the token format, as opposed to say, a blockchain based one. The scanning app with the URI endpoints is going to be the interesting piece.
Having worked in the design of related concept, the main failure modes here are a compromise of the signing key which is probably in an azure HSM instance, or cached somewhere as just a k8s secret, mobile malware that steals or corrupts tokens, and then infrastructure ddos against that API endpoint during a holiday airline rush. There's also the question of how the code verification app works, as that's where the real vulnerabilites would be.
Given the amount of co-ordination required for a scheme like this to work, it is difficult to believe this is not being done in secret, and if so, why?
Re: Digging into Quebec's electronic proof of vaccination
#9Earlier quoted context omitted.
As an immigrant from the US, I find most of Quebec's government websites to be quite good actually. But maybe that's just my low standards.
Can you still catch a bus in Montreal at 26:30h? :) Used to be able to see bus schedules online for busses STM well-passed the 24h mark. Something about the technology not being ready for late-night busses on the 'next day' being attached to 'today'? Or something.
Their immigration and SAAQ sites are what I've interacted with most recently. Both "just worked" and had reasonable UI and UX without having to disable adblockers or use IE or any nonsense like that. There are small nits occasionally, but by and large they work for their intended purposes I've found.
Re: Digging into Quebec's electronic proof of vaccination
#10Québec's government has historically been incompetent regarding anything digital (a lot of their website are still barely usable), but I want to give credit where credit is due: their vaccine appointment website as well as their proof-of-vaccination has been really well done.
As an immigrant from the US, I find most of Quebec's government websites to be quite good actually. But maybe that's just my low standards.
Most government or government-adjacent (sépaq, Hydro Québec) websites are pretty decent. There's a few awful exceptions like the SAAQ disabling their online services at 11pm, as if their servers need to go to bed? Or the city of Longueuil's tax portal which looks like it is from the 90s!