Can this be used for a China style social credit score system? I have explained how the social credit score system works in China and people think I'm talking about a TV show. They refuse to believe it's actually real.
Serious privacy/security concerns raised about Portpass vaccine verification app
11–20 of 29 posts
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#12Earlier quoted context omitted.
Down voted,really? explain
you upped the jargon for expressing an opinion.The KYC is indeed necessary because people will fake these. You mixed up a technology whine, with politics, in one sentence. Unpack things a bit and you might have got less downvote. I want to travel. The sector needs a reboot. I want a vaxx QR code tied to me, which has good fake protection which lets me travel. I am not stupid (very, maybe a bit) and I know there are a…
> I want a vaxx QR code tied to me
I don't. Nor do I want to be micro-chipped like the family pet.
The article is not about travel, it's about gaining entry to an ice hockey match. It's in same realm as gaining entry to a restaurant or any local business.
Not everyone wants KYC enforced on basic human activity such as satisfying your hunger for dumplings or meeting a friend for coffee.
They claim it's a temporary measure at certain venues, but they claim a lot of things. "We're announcing a 2 week snap lockdown" was said hundreds of days ago here in Melbourne. Only the tip of the Untruth iceberg.
Australians have already been tricked into a mandatory MyGov account. You can't delete that online account like you can your social media. Technically it's fine, but the concept and heading is concerning.
The voting public have less and less say in these things, and the fog of a pandemic is perfect cover to introduce a range of new mandates, otherwise shelved for being too unpopular.
Some will call this paranoia, others due diligence or an integrity test / pub test. I don't think it helps to exempt things like an Australia Card from the pub test because you think it would be "bloody useful". That's inviting the Trojan horse in with full knowledge of what's inside, and being okay with it because of the travel permissions it grants you.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#13> The app claims to use AI and blockchain to verify records and keep data secure Yeah, as soon as I read this I know it's going to be complete horse manure.
Obligatory xkcd https://xkcd.com/2030/
Take 2 https://xkcd.com/2267/
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#14Earlier quoted context omitted.
you upped the jargon for expressing an opinion.The KYC is indeed necessary because people will fake these. You mixed up a technology whine, with politics, in one sentence. Unpack things a bit and you might have got less downvote. I want to travel. The sector needs a reboot. I want a vaxx QR code tied to me, which has good fake protection which lets me travel. I am not stupid (very, maybe a bit) and I know there are a…
> I want a vaxx QR code tied to me I don't. Nor do I want to be micro-chipped like the family pet. The article is not about travel, it's about gaining entry to an ice hockey match. It's in same realm as gaining entry to a restaurant or any local business. Not everyone wants KYC enforced on basic human activity such as satisfying your hunger for dumplings or meeting a friend for coffee. They claim it's a temporary mea…
Fine. We want different things. Like I said I know people in health informatics, they're professional and highly motivated about improving health outcomes. This isn't a simple black or white good or bad space and it's not (in my view) a boil the frog slowly moment either. That said, I distrust the L/NP and Dutton especially, regarding PII.
I don't want to go back into indoor dining and venues with whackjob libertarians breathing all over me. If you want to avoid governments, get vaccinated and prove it somehow or stay outside. I'm voting for parliaments which impose societal controls on stupidity, the state has you from birth with a blood sample and footprint.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#15Can this be used for a China style social credit score system? I have explained how the social credit score system works in China and people think I'm talking about a TV show. They refuse to believe it's actually real.
In China, the vaccine testing data is already integrated into their social credit score system, so you can't get on public transit, etc. without completing the vaccine milestones.
In the US, the govt. has an internal system called XKeyScore that tracks your email, web and credit history.
In Australia, they have a "private" vaccine tracking app, but from Day One the police admitted having access to the database. (The police called reporters stupid for believing the app data was ever private.)
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#16Seriously no need for a vaccine verification app at all. I work in Illinois and am vaccinated with Moderna. The state maintains a database with my vaccine record including Moderna.
The idea that some third party app needs to show my record as “proof” to a store or venue is asinine.
Just my two cents.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#17That “privacy” is a concern for a “papers, please” surveillance system is a bit surprising.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#18There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others. EU DGC - All eu countries, some others like the UK. Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT…
British Columbia uses the SMART Health Cards as well, as written up in this blog post: https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-1...
What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as key to being able to trust it.
The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. I'd be more curious how it would be able to handle any other jurisdictions' codes, unless it has US keys available as well.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#19There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others. EU DGC - All eu countries, some others like the UK. Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT…
British Columbia uses the SMART Health Cards as well, as written up in this blog post: https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-1... What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as ke…
Also, while the details of the vaccination are contained in the payload, the app displays only the bare minimum of data to the user: verified vaccination status, and the holder's name to compare with photo ID (required in BC for adults).
I appreciate that the data contained in the code is as minimal as it can be, while the official app is displaying even less. Working off-line should keep it reliable as well, since it does not make or require server calls. This too would be different from Portpass, since it apparently stopped working.
Re: Serious privacy/security concerns raised about Portpass vaccine verification app
#20There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others. EU DGC - All eu countries, some others like the UK. Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT…
> Quebec
I confirm that Quebec uses SHC.