Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I faked tons of Covid passes – “Weak Key Cryptography in real world”

ctrsec.io

Post reply on HN
Print view View original

151–160 of 222 posts

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#151

Post by walterbell »

barbazoo wrote: post #150
saurik wrote: post #149

Real talk: are people saying they wanted this to be secure? If we are going to do this "vaccine paperwork to do anything" regime, I wouldn't want it to be some super secure mechanism that had digital proof of personhood provided by some government entity with an unhackable key! This key size frankly seems like the perfect balance: it took some months for someone to get around to breaking it, and then it took some mon…

Why though when it's very little effort to use a stronger key? What's the downside?

Dystopian sci-fi is for mental immunization, not emulation.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#152

Post by joelbondurant »

galaxyLogic wrote: post #63
pier25 wrote: post #28

Here in Mexico the gov issued vaccination certificates always have errors. People have resorted to downloading the PDF and "hacking it" (editing it in Acrobat). Nobody ever actually checks whether the certificate is valid or not.

I think most people who are smart enough to fake the certificate are smart enough to get vaccinated. What do you win by using a fake certificate vs. getting protected by the vaccine?

Imagine being numerically incompetent enough to fear the common cold and lust for communist tyranny.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#153

Post by joelbondurant »

JumpCrisscross wrote: post #16
sushsjsuauahab wrote: post #7

Earlier quoted context omitted.

It seems that actually nothing has had a meaningful impact on coronavirus spread.

> seems…nothing has had a meaningful impact on coronavirus spread Not sure if trolling, but in case not, vaccination has had “a substantial impact on mitigating COVID-19 outbreaks” in America [1]. [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7709178/

I can't imagine being as stupid as you.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#154

Post by Jenda_ »

infotogivenm wrote: post #144
IngvarLynn wrote: post #143

Here is how government-issued QR codes (not only vaccination ones) works in my country: it's just a link to government site. Why reinvent crypto, PKI and all? Also solves updates/invalidation issues.

If you want to minimize the time people spent waiting in queue to have these passes scanned, an offline validation method makes a lot of sense. Also optimizes time spent in queue while site is down or overloaded.

Offline method also helps with privacy, as there is no central online database where the validation requests can be observed.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#155

Post by Perenti »

jimmydorry wrote: post #145
dlsa wrote: post #126

This kind of breach isn't possible in Australia since their laws can beat the laws of math. Countries with less powerful laws are apparently not so lucky. https://www.gizmodo.com.au/2017/07/prime-minister-says-the-l... (Yeah, tongue firmly in cheek. Laws of math oddly enough seem to work just fine for taxation, depreciation, etc etc)

It's unfortunate that we've had successive governments (both sides) attacking privacy and security. From a casual glance, it looks to be done out of incompetence, when you see such headlines. But boy is that a long streak of coincidences.

Sadly, it seems to be power for the sake of power. I've been involved with a few govt green papers over the last 20 years, and most of the proposals are about bureaucrats extending their reach. It's why I vote Green now, as both Labor and Liberal have become so focused on preserving their power that they ignore the Rest Of The World and The Science.

For non-Australians, our Liberals are your Republicans, with all their faults, and our Labor is your Democrats, with all their faults.

Our Greens seem to have broadened their platform to include social justice and true libertarianism, so they're no _as_ powerhungry.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#156

Post by closeparen »

walterbell wrote: post #151
barbazoo wrote: post #150

Earlier quoted context omitted.

Why though when it's very little effort to use a stronger key? What's the downside?

Dystopian sci-fi is for mental immunization, not emulation.

Dystopian sci-fi is when carefully crafted internet memes convince people to kill themselves and each other en masse. We're well past that point.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#157

Post by Perenti »

galaxyLogic wrote: post #63
pier25 wrote: post #28

Here in Mexico the gov issued vaccination certificates always have errors. People have resorted to downloading the PDF and "hacking it" (editing it in Acrobat). Nobody ever actually checks whether the certificate is valid or not.

I think most people who are smart enough to fake the certificate are smart enough to get vaccinated. What do you win by using a fake certificate vs. getting protected by the vaccine?

Our greyhound has a certificate now...

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#158

Post by Jenda_ »

jokethrowaway wrote: post #49
0xTJ wrote: post #42

Earlier quoted context omitted.

Choosing not to be vaccinated is a harm to society. Being vaccinated isn't just about protecting yourself. It is people's choice not to be vaccinated, and they're responsible for the consequences of that choice, including not being allowed in spaces where they're a hazard to others.

That's a ridiculous narrative for covid where vaccinated people are marginally less contagious than unvaccinated people. The main benefit of the covid vaccine is reducing symptoms when you get covid and reducing hospitalisations. If you are worried about getting covid, vaccinate yourself. That's it, you don't need anyone else to be vaccinated.

> If you are worried about getting covid, vaccinate yourself. That's it, you don't need anyone else to be vaccinated.

What if I'm worried about healthcare system collapse by surge of unvaccinated people, resulting in disruption of non-covid-related medical care? This disruption can even last after the epidemic ends, as the medical staff is burning out and quitting. (this is happening right now in .cz)

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#159

Post by Jenda_ »

heinrich5991 wrote: post #91
airesearcher wrote: post #85

Physical Covid certificates are also not secure at all. They are easy to copy or fake. Any scheme which simply puts a cryptographic number on a some Physical card - or behind a regular QR is not secure. A simple photocopy will work just as well as the original. Not to mention Photoshop. But there is actually a new way to make physical things - like printed Covid vaccination cards - provably unique and authentic. Much…

The QR codes in Germany include your name and a digital signature. You can photocopy them, but the photocopy doesn't work for another person (if the venues would actually ask for your ID).

There is another problem even after asking for your ID - how can they verify it's you (based on the photo on the ID) when you have a face mask?

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#160

Post by Jenda_ »

sushsjsuauahab wrote: post #123
roca wrote: post #114

Earlier quoted context omitted.

Comparing failure to vaccinate with smoking or obesity are off the mark because it is not easy to quit smoking or overcome obesity. If there was an effective, cheap, safe and instant cure for smoking addiction or obesity and people refused to take it, societies would indeed by highly critical of those people consuming hospital resources.

It is not easy for me to vaccinate myself when I've had adverse reactions in the past.

To mRNA vaccines?
Post reply on HN