Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I faked tons of Covid passes – “Weak Key Cryptography in real world”

ctrsec.io

Post reply on HN
Print view View original

191–200 of 222 posts

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#191

Post by jazzyjackson »

airesearcher wrote: post #85

Physical Covid certificates are also not secure at all. They are easy to copy or fake. Any scheme which simply puts a cryptographic number on a some Physical card - or behind a regular QR is not secure. A simple photocopy will work just as well as the original. Not to mention Photoshop. But there is actually a new way to make physical things - like printed Covid vaccination cards - provably unique and authentic. Much…

usa has a real problem with this, afaik there is no way to get a duplicate/back up of your hard copy vaccination record. so i’m supposed to carry a piece of paper with me, and not lose it, i guess that’s what makes it a passport.

meanwhile ime most places with vaccine requirement accept a photo on my cell phone - not exactly cryptographically signed stuff over here.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#192

Post by sofixa »

Jenda_ wrote: post #159
heinrich5991 wrote: post #91

Earlier quoted context omitted.

The QR codes in Germany include your name and a digital signature. You can photocopy them, but the photocopy doesn't work for another person (if the venues would actually ask for your ID).

There is another problem even after asking for your ID - how can they verify it's you (based on the photo on the ID) when you have a face mask?

They ask you to take it down momentarily to check your face. Come on now, a kid could have thought of that and it has been used for months ( just go to an airport or whatever).

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#193

Post by zerocount »

galaxyLogic wrote: post #177
freeflight wrote: post #142

Earlier quoted context omitted.

I know dozens of people working in the healthcare sector skeptical of covid vaccines, among them virologists specialized in RNA viruses. Their skepticism is far more nuanced, and evidence based, than the "All vaccines are poison/bill gates gonna 5G us!" covid vaccine skepticism is usually framed as. They do not oppose any other common sense measures, like mask wearing, they simply want to be careful about vaccines th…

From the link below we see evidence that the chance of dying from Covid-19 is multiple times bigger for the unvaccinated than for the vaccinated. I wonder what kind of "smart" person ignores this evidence and puts their life at risk at will? Hey my chance of dying from Covid is 10 times bigger because I don't get vaccinated, but I won't because I believe an even worse fate awaits me if I do. What do they think that w…

The chance of dying of Covid-19 while being unvaccinated is very low. The benefit of being vaccinated is a further reduction in the chance of dying if infected and a reduction in symptom severity if infected. There is still a very low chance of severe symptoms and/or death if infected while being vaccinated. Also, there have been cases of people dying within weeks of receiving a vaccine dose; I won't comment on what that implies.

I'm not vaccinated. I did get Covid-19 and recovered well. The only lasting effect seems to be that I smell an anti-freeze odor at times. I don't feel like I was putting my life at risk by not getting vaccinated, in fact, I feel even more strongly against getting a vaccine that appears to be more beneficial to those who are at high risk of severe symptoms and/or death than the general population.

In any case, I respect others' opinions on the matter and don't judge them for their decisions on vaccination. The fact that vaccinated people can still get infected and possibly transmit the virus to others seems to indicate we should stop focussing on a general solution and focus on those in high risk categories. The Covid-19 pill seems like a good first step in that direction.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#194

Post by throwaway55421 »

roca wrote: post #137
bluefox wrote: post #135

Earlier quoted context omitted.

You told sushsjsuauahab that he/she is a small minority of people. I'm sure that makes sushsjsuauahab and others who have their own (gasp) reasons not to get the vaccine feel better... See, it's this one-size-fits-all dictum backed by sanctions that's the problem. The vaccines help prevent sickness, but government policies hurt healthy people.

Dunno about other countries but in NZ you can apply for medical exemption from vaccine mandates. A panel of medical professionals evaluates your situation and if they agree, you get a vaccine pass that works the same as for a vaccinated person.

So you can _apply_ for permission to take part in everyday life.

Great. It's a no from me.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#195

Post by sschueller »

dvt wrote: post #23
coolso wrote: post #21

Good! Keep it up. Let things be, enough of this vaccine pass comrade BS. We who are vaccinated should be at peace and trust this vaccine will reduce the likelihood of severe illness. Those who aren’t, I wish them the best, but that’s their choice. Hopefully this will finally encourage smokers to quit and the obese to cut out a few sodas per day.

> Good! Keep it up. Let things be, enough of this vaccine pass comrade BS. You're going to get heavily downvoted, but I totally agree. The vaccine pass is a complete farce. I even have non-technical friends that have faked vaccine passes. For someone even remotely technical, it's trivial to Photoshop. If only we had the same fervor when it comes to demonizing weight gain, we could save 10x more lives.

Photoshop? Where do you live that the passes are not cryptographicaly signed?

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#196

Post by sschueller »

airesearcher wrote: post #85

Physical Covid certificates are also not secure at all. They are easy to copy or fake. Any scheme which simply puts a cryptographic number on a some Physical card - or behind a regular QR is not secure. A simple photocopy will work just as well as the original. Not to mention Photoshop. But there is actually a new way to make physical things - like printed Covid vaccination cards - provably unique and authentic. Much…

Here is Switzerland and EU your name is encoded in the signed qr code. If you photocopy a pass your name won't match and everywhere you go you must show ID with the pass.

For places that are 3G you have the option in the app to not disclose your vaccination status in the code. So the scanning entity will know ow if you have one of the 3 possible requirements. Vaccinated, recovered or tested.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#197

Post by dlsa »

LordDragonfang wrote: post #178
dlsa wrote: post #167

Earlier quoted context omitted.

Unfortunately the governments implementing these measures seem absolutely determined to treat Orwell's 1984 as a training or howto manual. As we descend further into authoritarianism, tracking and other privacy busting measures will become even more normalised and entrenched. You'll soon need to show identity and other papers to get into a shop to buy a hammer.

On a note entirely unrelated to the above comment, I find it somewhere between humorous and worrying that people who seem to have never actually read 1984 seem insistent on invoking it for things that are entirely unrelated to the book and have occurred for decades in most countries (showing documents for travel, having to get vaccinated for certain jobs) and ignore all the other things happening that were actually i…

Plenty of parallels but you won't get exact matches... yet a few things stand out.

I'd point at the war-on-terror as a good example of a permanent or equivalent always-at-war situation. Its not a stretch to suggest that a lot of the privacy and surveillance is based around anti-terrorism initiatives and plenty of security theater is now in place because of that. The war-on-drugs was another version of that. The war-on-... rhetoric in general is almost cliché now. This is not to say its not serious but consider the 1970s had quite a lot of terrorism going on. eg The UK had regular bombings from the IRA.

Political correctness tends to adjust definitions in ways very reminiscent of Double-speak. It seems to be a rich source of new words and terms. Like a conveyor belt.

The surveillance aspect is obvious.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#198

Post by dlsa »

sofixa wrote: post #188
dlsa wrote: post #167

Earlier quoted context omitted.

Unfortunately the governments implementing these measures seem absolutely determined to treat Orwell's 1984 as a training or howto manual. As we descend further into authoritarianism, tracking and other privacy busting measures will become even more normalised and entrenched. You'll soon need to show identity and other papers to get into a shop to buy a hammer.

How did you get there? Vaccination requirements have been a thing for decades in many countries. Showing proof of vaccination to go to the mall or cinema isn't tracking anyone ( with the EU implementation at least, can't talk about all of them) about anything - it's just an app reading a QR code and deciding if it's valid locally, no internet required. Heck, in France the government explicitly stated nobody has the r…

Ironically I got told that you can be required to show immunisation certification to enter a hardware store. My thought-to-be-silly-to-make-a-point example about the hammer is reality right now.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#199

Post by crocodiletears »

dzhiurgis wrote: post #99

Offline first seems such an oversight from contact tracing perspective. Also NFC tags could’ve been better solution, but probably would’ve sent too much Bill Gates vibes.

From what I've been able to gather, these QR code systems are mostly based off of the WEF's Commonpass digitial identity standard (either directly, or inspired by), which seems to be a graduated version of the ID2020 project (many of the same ideas and sponsors).

The projects are meant to present a standardized format for the provision of easily validated information about an individual in environments where low-end hardware is common and internet connectivity is unreliable.

The QR code was chosen as the standard form of information transfer because it can be printed on paper and remain easily validated if someone lacks a device to put it on.

The codes aren't primarily meant to control pandemic spread, this just happens to be the first thing driving their widespread adoption.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#200

Post by pier25 »

freeflight wrote: post #142
2fast4you wrote: post #134

Earlier quoted context omitted.

Unfortunately, you’d be surprised. I know of at least one

I know dozens of people working in the healthcare sector skeptical of covid vaccines, among them virologists specialized in RNA viruses. Their skepticism is far more nuanced, and evidence based, than the "All vaccines are poison/bill gates gonna 5G us!" covid vaccine skepticism is usually framed as. They do not oppose any other common sense measures, like mask wearing, they simply want to be careful about vaccines th…

I'm fully vaccinated, but I've read a couple of times how vaccines are making this worse since they provide a vector for the virus to evolve against.

These claims make sense to my layman understanding, but I really have no idea.

Post reply on HN