Digging into Quebec's electronic proof of vaccination • Hacker News Board

Re: Digging into Quebec's electronic proof of vaccination

#31

Post by monkeybutton » Tue, Jun 01, 2021, 6:26 PM UTC

Rebelgecko wrote: post #23

jefft255 wrote: post #2

Québec's government has historically been incompetent regarding anything digital (a lot of their website are still barely usable), but I want to give credit where credit is due: their vaccine appointment website as well as their proof-of-vaccination has been really well done.

When I visited Quebec I was actually surprised by how common it was for the government to use cryptographic signatures. For example the wingdings hieroglyphics that get printed on every receipt (I guess to prevent tax evasion?). Edit: an example- https://mobile.twitter.com/nneonneo/status/92323100662615654...

I love how often this comes up; whenever someone nerdy visits Montreal the first reaction to seeing those wing-dings is "I must know more!". Like this thread here: https://mailarchive.ietf.org/arch/msg/81attendees/fEjDmtd8Kf...

Re: Digging into Quebec's electronic proof of vaccination

#32

Post by jszymborski » Tue, Jun 01, 2021, 6:57 PM UTC

motohagiography wrote: post #8

I'm surprised to be out of the loop on this. This is the first I've heard of Quebec's vaccine passports. As the OP says, it also implies there is an app, with a vendor, an infrastructure, and key management. (smarthealthit and azure as it appears to turn out) The ethics and legality of vaccine passports are still very controversial, and using Quebec as a test ground for it seems like its part of an inevitable push, i…

Just to add some context re: Quebec.

Quebec's current Premiere is a populist who has been gaining huge amount of popularity points with his constituents (albeit, with Montreal being a bit of an exception) in bucking the Federal government; especially when it comes to matters of the Canadian Human Rights charter.

Re: Digging into Quebec's electronic proof of vaccination

#33

Post by philistine » Tue, Jun 01, 2021, 7:11 PM UTC

motohagiography wrote: post #8

I'm surprised to be out of the loop on this. This is the first I've heard of Quebec's vaccine passports. As the OP says, it also implies there is an app, with a vendor, an infrastructure, and key management. (smarthealthit and azure as it appears to turn out) The ethics and legality of vaccine passports are still very controversial, and using Quebec as a test ground for it seems like its part of an inevitable push, i…

> and using Quebec as a test ground for it

Who are you implying is using Québec as a test ground? The reality is simple: Québec implemented something of its own volition. Nothing nefarious here.

Re: Digging into Quebec's electronic proof of vaccination

#34

Post by JoshMandel » Tue, Jun 01, 2021, 7:14 PM UTC

For reference, the SMART Health Cards Framework (https://spec.smarthealth.cards) is the underlying specification behind these QRs. I've had the privilege of working with a broad swath of the healthcare IT ecosystem (in the US and internationally) on these openly licensed, standards-based specifications for consumer access and data sharing.

The SMART Health Cards Framework is designed to dovetail with SMART on FHIR APIs for consumer access (which all Electronic Health Record vendors in the US are on the hook to support over the next year).

Re: Digging into Quebec's electronic proof of vaccination

#35

Post by interestica » Tue, Jun 01, 2021, 7:17 PM UTC

philistine wrote: post #33

motohagiography wrote: post #8

I'm surprised to be out of the loop on this. This is the first I've heard of Quebec's vaccine passports. As the OP says, it also implies there is an app, with a vendor, an infrastructure, and key management. (smarthealthit and azure as it appears to turn out) The ethics and legality of vaccine passports are still very controversial, and using Quebec as a test ground for it seems like its part of an inevitable push, i…

> and using Quebec as a test ground for it Who are you implying is using Québec as a test ground? The reality is simple: Québec implemented something of its own volition. Nothing nefarious here.

Who is Quebec?

Re: Digging into Quebec's electronic proof of vaccination

#36

Post by motohagiography » Tue, Jun 01, 2021, 7:59 PM UTC

philistine wrote: post #33

motohagiography wrote: post #8

I'm surprised to be out of the loop on this. This is the first I've heard of Quebec's vaccine passports. As the OP says, it also implies there is an app, with a vendor, an infrastructure, and key management. (smarthealthit and azure as it appears to turn out) The ethics and legality of vaccine passports are still very controversial, and using Quebec as a test ground for it seems like its part of an inevitable push, i…

> and using Quebec as a test ground for it Who are you implying is using Québec as a test ground? The reality is simple: Québec implemented something of its own volition. Nothing nefarious here.

Given all vaccine passport programs necessarily need federal acceptance and co-ordination for them to be portable outside the province, it is a test for a program by the federal government. Few people have any exepectation that Quebec will conform to national social norms and this is why it's being used as pilot project for what appears to be a national attack on civil liberties.

Re: Digging into Quebec's electronic proof of vaccination

#37

Post by filearts » Tue, Jun 01, 2021, 9:07 PM UTC

cryptoz wrote: post #7

nikisweeting wrote: post #6

Earlier quoted context omitted.

As an immigrant from the US, I find most of Quebec's government websites to be quite good actually. But maybe that's just my low standards.

Can you still catch a bus in Montreal at 26:30h? :) Used to be able to see bus schedules online for busses STM well-passed the 24h mark. Something about the technology not being ready for late-night busses on the 'next day' being attached to 'today'? Or something.

Not anymore. The busses only come every 5m90s on that route.

Re: Digging into Quebec's electronic proof of vaccination

#38

Post by rocqua » Tue, Jun 01, 2021, 10:04 PM UTC

koojen wrote: post #18

rocqua wrote: post #5

The underlying cryptographic technology here: "Verifiable Credentials" is quite exciting. If you have ever wondered "why aren't bureaucracies using digital signatures?" then VCs are interesting. It's a pretty decent technical spec for signing statements like "This person has this age" or "this person is vaccinated" or "this person is authorized for this bank-account as executor of a will". It is a spec written by cry…

I've worked with VCs and personally I found them unnecessarily complex and over hyped by a certain gang of people/companies. all the hyped benefits causes dependancy on being available to download contexts, access lists/blockchains of public signatures etc etc

Does that mean you prefer a different standard for "signed statements", or do you think the idea of "signed statements" is just not useful (or not useful yet).?

Re: Digging into Quebec's electronic proof of vaccination

#39

Post by atonse » Wed, Jun 02, 2021, 2:06 AM UTC

rocqua wrote: post #5

The underlying cryptographic technology here: "Verifiable Credentials" is quite exciting. If you have ever wondered "why aren't bureaucracies using digital signatures?" then VCs are interesting. It's a pretty decent technical spec for signing statements like "This person has this age" or "this person is vaccinated" or "this person is authorized for this bank-account as executor of a will". It is a spec written by cry…

Thanks for the background. For fun I did a thought experiment a couple weeks ago, of designing a vaccine verification system and arrived at the same cryptographic abstractions (without JWT and JWS, but same for offline verification with public keys) and it’s good to see the design matches mine, mainly as a validation to myself that I am understanding a practical application of those crypto building blocks.

The added bonus is there’s already an open standard I can use that’s been poked at by smarter people.

Exciting!

Re: Digging into Quebec's electronic proof of vaccination

#40

Post by rocqua » Wed, Jun 02, 2021, 8:39 AM UTC

atonse wrote: post #39

rocqua wrote: post #5

The underlying cryptographic technology here: "Verifiable Credentials" is quite exciting. If you have ever wondered "why aren't bureaucracies using digital signatures?" then VCs are interesting. It's a pretty decent technical spec for signing statements like "This person has this age" or "this person is vaccinated" or "this person is authorized for this bank-account as executor of a will". It is a spec written by cry…

Thanks for the background. For fun I did a thought experiment a couple weeks ago, of designing a vaccine verification system and arrived at the same cryptographic abstractions (without JWT and JWS, but same for offline verification with public keys) and it’s good to see the design matches mine, mainly as a validation to myself that I am understanding a practical application of those crypto building blocks. The added…

The real interesting part here, if you want to start making this more widely available, is determining whose signatures you trust.

Self-signed statements already have some value. You can litigate those in court. But when you wanna enter e.g. the Netherlands, how are they to know which key belongs to Quebec?