Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serious privacy/security concerns raised about Portpass vaccine verification app

cbc.ca

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Serious privacy/security concerns raised about Portpass vaccine verification app

#21

Post by m-p-3 »

tlavoie wrote: post #18
noodlesUK wrote: post #4

There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others. EU DGC - All eu countries, some others like the UK. Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT…

British Columbia uses the SMART Health Cards as well, as written up in this blog post: https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-1... What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as ke…

> The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in.

Quebec's app does the same thing, it has the public key builtin for validation. The only time the app can connect is to download an updated list of rules that determine if the enclosed information in the QR code related to vaccine status still protects the owner (and label them as adequately protected if they meet those criterias).

Re: Serious privacy/security concerns raised about Portpass vaccine verification app

#22

Post by tlavoie »

m-p-3 wrote: post #21
tlavoie wrote: post #18

Earlier quoted context omitted.

British Columbia uses the SMART Health Cards as well, as written up in this blog post: https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-1... What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as ke…

> The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. Quebec's app does the same thing, it has the public key builtin for validation. The only time the app can connect is to download an updated list of rules that determine if the enclosed information in the QR code related to vaccine status still protects the owner (and la…

Thanks, I was curious about updates here as well. To that end, I don't know if ours does any such updates directly, or if that would come in the form of an app update.

Re: Serious privacy/security concerns raised about Portpass vaccine verification app

#23

Post by tlavoie »

sk2020 wrote: post #17

That “privacy” is a concern for a “papers, please” surveillance system is a bit surprising.

Done properly, there is no surveillance, no record of where your code is being scanned. This includes by the scanning app. The SMART Health Card format at least, contains everything needed in the code, and little else. The app just needs the issuer's public keys to verify the signature.

That the anti-everything crowd will pout and stay home is precisely the point.

Re: Serious privacy/security concerns raised about Portpass vaccine verification app

#24

Post by bool3max »

sk2020 wrote: post #17

That “privacy” is a concern for a “papers, please” surveillance system is a bit surprising.

Hasn't everyone in the modern world lived under a "papers, please" surveillance type system for multiple decades now?

Re: Serious privacy/security concerns raised about Portpass vaccine verification app

#25

Post by narrator »

redis_mlc wrote: post #15
narrator wrote: post #11

Can this be used for a China style social credit score system? I have explained how the social credit score system works in China and people think I'm talking about a TV show. They refuse to believe it's actually real.

In China, the vaccine testing data is already integrated into their social credit score system, so you can't get on public transit, etc. without completing the vaccine milestones. In the US, the govt. has an internal system called XKeyScore that tracks your email, web and credit history. In Australia, they have a "private" vaccine tracking app, but from Day One the police admitted having access to the database. (The…

This is why you don't accept the vaccine passport. It will be the camel's nose under the tent that will be used to gameify every aspect of our lives.

In the social credit score future, everyone gets UBI, but only people who jump through every little tiny hoop the government can think up can actually do anything with that money.

Re: Serious privacy/security concerns raised about Portpass vaccine verification app

#26

Post by TurkishPoptart »

Why is this vaccine verification app even needed at all? If the vaccine works as intended, then the individual and those around him or her are protected. If it doesn't, then this is not really about public health at all but something far more nefarious and concerning.

Re: Serious privacy/security concerns raised about Portpass vaccine verification app

#27

Post by ashwagary »

bool3max wrote: post #24
sk2020 wrote: post #17

That “privacy” is a concern for a “papers, please” surveillance system is a bit surprising.

Hasn't everyone in the modern world lived under a "papers, please" surveillance type system for multiple decades now?

This is mostly only true with international travel.

Re: Serious privacy/security concerns raised about Portpass vaccine verification app

#28

Post by ashwagary »

ggm wrote: post #14
exodust wrote: post #12

Earlier quoted context omitted.

> I want a vaxx QR code tied to me I don't. Nor do I want to be micro-chipped like the family pet. The article is not about travel, it's about gaining entry to an ice hockey match. It's in same realm as gaining entry to a restaurant or any local business. Not everyone wants KYC enforced on basic human activity such as satisfying your hunger for dumplings or meeting a friend for coffee. They claim it's a temporary mea…

Fine. We want different things. Like I said I know people in health informatics, they're professional and highly motivated about improving health outcomes. This isn't a simple black or white good or bad space and it's not (in my view) a boil the frog slowly moment either. That said, I distrust the L/NP and Dutton especially, regarding PII. I don't want to go back into indoor dining and venues with whackjob libertaria…

>I don't want to go back into indoor dining and venues with whackjob libertarians breathing all over me.

This doesn't require anyone to change their behavior but you.

Re: Serious privacy/security concerns raised about Portpass vaccine verification app

#29

Post by noodlesUK »

tlavoie wrote: post #18
noodlesUK wrote: post #4

There are two fairly decent existing standards for covid vaccination proof that I am aware of. SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others. EU DGC - All eu countries, some others like the UK. Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT…

British Columbia uses the SMART Health Cards as well, as written up in this blog post: https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-1... What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as ke…

The reason I am not a fan of signed JWTs as a technology is because of their cryptographic agility. There have been too many circumstances where even big players who should have known better have fallen afoul of alg: none or hmac where they weren’t expecting it.

See https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bc... for a quick overview.

Post reply on HN