It is cryptographically signed, so creating your own QR code that would be accepted by the apps would be difficult without the signing key.

Even ignoring that though: including both the ID and detail allows it to work both ways. In official situations (e.g. at a country border) you might be able to validate against a server, but the local nightclub probably doesn't have access to a validation server.

You could just copy someone else's code though, unless they also check photo ID or something (seems unlikely for a pub).

Yes. This is officially acknowledged (at least in the german CovPass app) and is a feature. You are able to "manage" multiple passes in said app. This is intended for accessibility (elderly partners with a shared smartphone, legal guardians for people with disabilities).

And yes, in theory at least the name should be crosschecked with a form of ID. It's just a digital copy of a legal document, you could easily borrow or copy the paper version from someone else as well.

You are right with regards to the technical side, but there is an important detail to note. Those certificates only can be used for travelling between eu states. Any other use is currently banned and would need to ammend the EU regulation.

So the local nightclub cann't(legally) check these certificates.

Are you sure? Isn't https://greencheck.gv.at/ a tool for private nightclubs, event managers, hospitality and so on to check the "grüner Pass" QR-Code certificate of their guests in Austria for accordance with their 3G rules (Genesen (recovered), Geimpft (vacinated), Getested (tested))? Am I missing something there?

In slovenia, clubs/restaurants/etc. are not allowed to check any vaccination/test/recovered data (you still need to be one of those, they can ask if you are, but are not allowed to verify).

Only health inspectors can do so, and they do random checks. Honestly, I don't know how this will end, because people are really fed up with this situation and all the lies from the government, and a club full of drunk people vs a few inspectors won't end well.

I'm from Slovenia as well and get asked to show my ID and vaccination slip regularly.

If I understand correctly, one of the pandemic laws requires them to verify, but the Information Commissioner's Office has countered that with one of their classic "well yes, but actually no" opinions saying that they're not actually allowed to demand that kind of information. What "demand" means here, of course, doesn't seem to be defined well, so I'm guessing they're still allowed to refuse service if you don't show them some proof.

Or maybe all of that has changed in the 20h since I was last at a bar - the speed at which the current government is making seemingly entirely random changes to the covid rules is genuinely impressive.

That's interesting, but I guess it needs some legal support at the Austrian level, because the regulation doesn't prescribe those uses for the certificate.

There is a law in Austria for this.

Each state can create (and have created) additional restriction.

For example here in Italy I need the green pass to go to a wedding next week

I don't think that is true, at least not universally in all EU countries. And here in Germany they're allowed to check the old paper vaccination pass, so there is no reason to think they're not allowed to check the digital version.

As far I have been told by the national authorities of my country, that's the case. I haven't read the whole regulation but this paragraph I think it addresses it:

This Regulation establishes the legal ground for the processing of personal data within the meaning of point (c) of Article 6(1) and point (g) of Article 9(2) of Regulation (EU) 2016/679, necessary for the issuance and verification of the interoperable certificates provided for in this Regulation. It does not regulate the processing of personal data related to the documentation of a vaccination, a test or a recovery event for other purposes, such as for the purposes of pharmacovigilance or for the maintenance of individual personal health records

Member States may process personal data for other purposes, if the legal basis for the processing of such data for other purposes, including the related retention periods, is provided for in national law, which must comply with Union data protection law and the principles of effectiveness, necessity and proportionality, and should contain provisions clearly identifying the scope and extent of the processing, the specific purpose involved, the categories of entity that can verify the certificate as well as the relevant safeguards to prevent discrimination and abuse, taking into account the risks to the rights and freedoms of data subjects

So, if my interpretation is right, a national law backing those "secondary" uses must be in place.

And it is in a few countries. Austria and Germany included.

Danish teens just took screenshot of their QR code and shared it with friend. It only valid for an hour, the your friend needs to send you a new one, but it was enough to get in to the gym and stuff like that.

Some even sold screenshots on Facebook.

Now the app have all sorts of cool colour effects when you tilt your phone.

I can't find any articles that either talk about "danish teens" or "sold screenshots on facebook". Do you have any sources you can link?

The QR codes design is pretty sound, so as long as they are validated correctly and checked against an ID this should not be possible.

This one [1] doesn't specifically mention facebook.

You can run the text through a translator yourself, but the main quote: "Henover weekenden har vi allerede set de første eksempler på danskere, der sælger QR-koder i lukkede grupper på sociale medier" roughly translates to: "During the weekend we have experienced the first examples of people selling QR codes in closed groups on social media".

Edit: This article [2] is about 6 teens being charged with forgery of the pass.

[1]: https://www.inputmag.dk/snyd-med-coronapas-er-dokumentfalsk/

[2]: https://www.dr.dk/nyheder/regionale/oestjylland/seks-gymnasi...

What I don't quite get is that the certificate is linked to me personally.

Notably, it contains my full name, including middle name, and date of birth.

It notably states that it's only valid together with an identification document.

It's possible, of course, that gyms and nightclubs don't check very thoroughly, but I certainly wouldn't risk passing a border with a fake certificate.

> I certainly wouldn't risk passing a border with a fake certificate

[..] especially given that you can also cross a border with a negative antigen test, which is pretty easy to come by. I must have done getting on for 50 of them so far this year.

Yes, it's fairly obvious that none of this works if you don't verify that the identity matches the ID (the yellow paper pass won't either!), but you can nevertheless expect that plenty places won't do that. Or even just see "app shows the right color and a QR code", there was an embarrassing amount of media coverage of the fact that if you set the system time in the future the German app will show the "right" color even if someone hasn't waited long enough after their vaccination... which of course has zero effect on if validation succeeds or not.

There is not even an app here, people just show QR codes from wherever they have stored them.

The only thing you should verify is photo. Because you can't really verify an ID either (other than checking a photo). So QR code should just encode a photo URL (and sign it) and QR scanner should display that photo.

Currently the image is retrieved via a very powerful distributed database with embedded authentication, consisting of millions of wallets and handbags. The authentication key is the name and date of birth, and is printed on both the pass and the medium that stores the image.

That would mean some centralized data store. I'd be against such a measure. Current approach is device only, with very limited risk of data breach.

May be it's possible to encode some kind of low-res compressed image in QR-code? I did not run the math. Or may be it's even possible to scan photo from smartphone display, run some kind of image hash and compare it to hash inside QR-code. This way it would be possible to work completely offline. I think it's called perceptual hashing, though I'm not sure if it's cryptographically secure.

The issue is not about compression (well, it could be).

It is is about the authority that delivers the QR code: if it doesn't have the data (photo) it can't produce the QR code.

For example, I have been vaccinated in April, long before the green pass appeared. No one took my picture at that time (and that's not the task of doctors to take pictures and store them in central database, for privacy reasons). I still deserves a QR-code to go out of home.

In France we have ID cards which can link a photo to the name and birth date. So encoding name and birth date in the QR-code are enough.

That's so strange, and almost suggests that the people implementing these apps don't understand the security model behind these codes.

Any information on the users phone can 100% not be trusted. It should just show the QR code. On the other hand the scanning App has to validate the signature, check if the dates are correct and display a big info that the QR is only valid if the name is the same as the one on a presented ID.

Maybe this should have been a design requirement from the EU spec.

> the people implementing these apps don't understand the security model behind these codes

I'm not entirely sure that the people implementing the policies understand the 'herd immunity' model, nor the by now fairly comprehensive statistical data on who is and isn't at significant risk from Covid19.[0]

Q: If a healthy 18 year-old chooses to attempt to go to a nightclub unvaccinated, who exactly is put at risk from this?

[0] https://www.ons.gov.uk/aboutus/transparencyandgovernance/fre...

A: non-immune people this 18-year comes in contact with later

Public health bodies will struggle to convince healthy young people to take a vaccine that gives them very little direct benefit.

"Children's risk of severe disease from Covid is tiny, deaths are extremely rare and have only occurred in UK children with profound underlying and life-limiting conditions. The direct benefits to them of vaccination would be low."[0]

[0] https://www.bbc.com/news/health-57496074

we live in society

> we live in society

Insert quote from Margaret Thatcher from 1987?[0]

More seriously, there is no [longer] one approved way to live, thank goodness.

We rightly demand that larger / mainstream groups respect minorities.

At what point is it OK to stop listening or respecting minority views, and who gets to decide that?

[0] "you know, there's no such thing as society. There are individual men and women and there are families" https://www.theguardian.com/politics/2013/apr/08/margaret-th...

Iron Mags is dead. Too bad so much of the stupid shit she said lives on.

I would take a vaccine to protect my grandmother.

I would even take a vaccine to protect some abstract person with a broken immune system whom I never met and probably never will.

I would even do that if the vaccine wouldn't help me (which it does).

It is called empathy and caring for each other.

> Q: If a healthy 18 year-old chooses to attempt to go to a nightclub unvaccinated, who exactly is put at risk from this?

That person, plus every person they come in contact with.

Oh, you can compute the total "risk" of course. Assuming the person is contaminated and you put their personal "risk" treshold at an arbitrary 2% (which I just pulled out of thin air: chance of getting unacceptable side-effects: p(side_effect|contaminated)). You then have to sum that up for every person they come in contact with.

sum((1-vacc_effectiveness)*personal_risk*transmissiveness).

The real contribution might be even greater than that, as the contaminated will go on carry the virus to other people.

In theory if the number of people is large enough, you should be able to replace the values with average ones, but it's likely that 18 yo will spend more time with 18 yo than 70 yo.

To sum it up, herd immunity only works if enough people are immune (vaccinated). Everyone should feel responsible for it, even 18 years-olds (unless you take a very individualist view of life, which seems like a dominant feeling in the US: it works a lot like the prisoner's dilemna). Anyway, I'm just proud of performing my civic duty, I won't be a carrier for that virus.

That’s not how vaccine effectiveness works. There’s already a probability less than one of getting Covid if unvaccinated, and the effectiveness of the vaccine is the reduction from that.

So if over the course of their study period, 100 unvaccinated people got covid out of a thousand tracked, with a 98% effectiveness, only 2 people in the 1000 people vaccinated group would have gotten it.

So vaccines are really effective. Even more so for preventing serious complications.

> chance of getting unacceptable side-effects

There are a considerable number of people out there - some of whom are young and healthy and at vanishingly small personal risk from Covid19 - who if you mention the phrase "unacceptable side-effects" their first thought would be of side effects from vaccination, not the virus.

The boss at my daughter's kindergarten had Covid19 last summer. She had to quarantine for two weeks, then came back to work. She told me (unprompted) that sitting out the quarantine was way worse than the virus.

Telling these people they are stupid or anti-social - or simply downvoting them :) - may not be the most effective strategy to make them change their mind.

How should society approach this?

How should governments approach this?

I don't give my name and date of birth to walk into a store or restaurant so why should this QR code force you to? Presumably all you want to know about this person is whether or not they are a toxic, contagious, diseased biohazard to you; everything else is none of your business.

If someone is showing someone else's proof of vaccination while they are not vaccinated, they actually might be a threat.

The QR code by itself is not proof of anything until you have verified that it actually belongs to the person showing it. That's where the ID comes in.

Just out of curiosity, what is the minimum net improvement in public safety you think justifies asking every person to show their identity information every time they walk into a shop or restaurant? After all the progress made so far with traditional disease mitigation, what would happen if you simply don't choose to force everyone to show their IDs everywhere they go? If you're saying vaccines and lockdowns weren't enough, what is the target you're chasing exactly? Is it really worth it?

I am not sure what you want to get at but if someone wants to be treated like being vaccinated, they should have to proof that they actually are. Anything else incentivizes behaviour that undermines the efforts to get a grip on the pandemic (i.e. it would let the unvaccinated flaunt the rules by just claiming that they no longer pose a threat to others and the pandemic would happily rage on).

We do not implement these measures here (Germany) at the moment. Anyone can visit stores or e.g. retirement homes without having to show a negative test result or proof of vaccination. Before easing the measures, people with proof of vaccination were treated like having a negative result in general, i.e. they could do all the things that others also could but without the hassle of having to be tested.

This is what I don't understand either... vaccines work, health systems in most eu countries are pretty empty of covid patients now, anyone who wants a vaccine can get one... but we're still requiring people from countries with 99positive/100k to show vaccination proof to enter a country with 98positive/100k.

We have the vacciness, anyone can get one for free, just open up, and let the antivaxxers risk it if they want.

It's not that simple.

Even with a vaccine you can get COVID. Any body hosting a COVID virus is an environment where mutations happen.

We don't just want people to stop dying from COVID. We also want to stop new more dangerous strains of the virus to emerge or propagate.

I think that the point is to raise social pressure to get people to get vaccinated.

If you are vaccinated, you just show your pass and go into the bar. If you aren't you have to produce a test. A recent test. So frequent renew. Or you might just not be allowed to get in.

So just get the vaccine and life will be easier.

If you don't want the vaccine, just stay at home.

In the US context I would say this is a privacy violation. It's another avenue of obtaining identifying information about you, to abuse with no restrictions.

But one of the main benefits of the GDPR is making it illegal for businesses to keep surveillance records on you. This way you don't have to worry about keeping basic information like your name secret in the first place.

The US really needs something like the GDPR to restore some societal trust. As it stands, I'm planning on wearing a mask into stores etc for as long as I can get away with it.

> In the US context I would say this is a privacy violation.

Yeah, but that's the US. Which is well known for being pretty wacky on these things.

> It's another avenue of obtaining identifying information about you, to abuse with no restrictions.

How? You hold up your vaccine pass to the bouncer, and your photo ID, so he can see that the vaccine pass is actually yours: He compares the face in the ID to yours, and the name on the pass to that on the ID. Then he turns away from you and says "Next, please". In two minutes he has forgotten your name, and in thirty he remembers your face to the extent that he can say "Yeah, I think I let that one in tonight."

Does he photograph your pass and ID, or type them into some computer system? Hardly. So what's to "abuse"?

> This way you don't have to worry about keeping basic information like your name secret in the first place.

In any sane society, your name isn't supposed to be a secret.

Dang, Americans are a funny people. Paranoid about all the wrong things.

> I certainly wouldn't risk passing a border with a fake certificate.

Border guards are even less interested in the validity of your covid certificates than nightclub bouncers. They have very limited amounts of time they can spend on processing people without the whole system collapsing

Welcome to the Schengen area.

You will not enter any Schengen country without the border guard checking if you have an entry in the Schengen Information System.[1]

A reply is available within seconds after the border agent scans your ID document (passport or identification card).

Travelling between Schengen countries doesn't require an id or a passport, but currently countries have restrictions on entry most of them either insisting on you being vaccinated or to present a current Covid test.

I'm travelling to Paris by train on Friday. which has the following requirements for entry:

  From 9 June, fully vaccinated people from EU or 
  Schengen Associated Countries will not be subject to 
  testing or isolation requirements.

  Accepted vaccines:

  Pfizer/BioNTech
  Moderna
  AstraZeneca
  Johnson & Johnson (Janssen)

further

  All travellers (from 9 June: all non-vaccinated 
  travellers) are subject to the requirement for a pre- 
  departure negative COVID-19 test taken within 72 hours 
  prior to arrival.

Now sure, chances are small that I'm even checked in the train. But if I am then it would be pretty dumb to present fake documentation. Don't you think so?

[1] https://ec.europa.eu/home-affairs/what-we-do/policies/border...

What I don't understand is, why do countries require all that for people from countries which have pretty much the same number of infected as they do (per capita)? If chances of a local spreading the disease is the same as for the tourist, because both countries have eg. 95positive/100k people, why bother?

Recently, the argument has been that they don't want variants to cross borders. They eventually will, but it's one more reason to say that "covid outside" != "the covid we have at home".

But neither of the conditions in the EU pass says you don't have covid now. Vaccinations are not 100% (numbers go down to 70%, and a lot of infections for vaccinated people are asymptomatic, so even worse, because you don't stay at home, and noone tests you), PCR tests don't guarantee you didnt catch it between the test and "now", and having covid 5.5 months ago, does not guarantee you don't have it now.

But they increase the likelihood by a lot. There can't be a perfect system (apart from no one crosses the border, which is not feasible for other reasons), so this is a pretty good compromise.

That's crazy. Governments always return the freedoms the take once emergencies are over. I'd find a citation but I am almost to the front of the line and need to remove my shoes.

Unless you drive by car and say you are in 'transit'. Nobody in Schengen will/can stop you (or even check). With the exception of the border police having reasonable doubt you are a border commuter/worker.

I’ve been regularly crossing schengen borders using fake documents since this whole nonsense started. Most of these papers are impossible to authenticate. Sure, these QR-codes will have cryptographic signatures, so we’ll just switch to foreign certificates instead.

Why would it be dumb to use fake documents when it’s literally impossible to get caught?

I can safely discuss this on the internet too, it’s not like anyone took photocopies of the documents I showed them.

FWIW I’m not some antivaxxer nutjob, I’m happy to wear masks and self isolate when I’m sick. I’m just going to fight the surveillance state in any way I can.

> You will not enter any Schengen country without the border guard checking if you have an entry in the Schengen Information System.[1]

This is actually not correct. Many EU citizens do not have SIS entries but are still able to travel. This is likely to change in the future though.

> I’ve been regularly crossing schengen borders using fake documents since this whole nonsense started

Why would you do that? Unless you're pulling some dodgy shit there is really no reason for this and frankly, I don't believe you.

> Many EU citizens do not have SIS entries but are still able to travel.

Huh? Of course you don't have an entry in the SIS if there's no reason to be entered. SIS is not a directory about every resident in the Schengen area, let alone the whole world. If you do have an entry, however (dpending on its contents) you can be damn sure that you're in for an extended interview with border authorities.

> Why would you do that? Unless you're pulling some dodgy shit there is really no reason for this and frankly, I don't believe you.

Because I like to travel regardless of government restrictions? Is that “dodgy shit”?

I just brought a friend who is a Russian citizen to France with documents showing that she had a car booked to transfer her to Switzerland for surgery.

Right now anyone entering the UK from certain countries needs documents to show that they’re in “transit” to avoid quarantines.

> Huh? Of course you don't have an entry in the SIS if there's no reason to be entered

My bad, I misunderstood what you were saying.

> Because I like to travel regardless of government restrictions? Is that “dodgy shit”?

Yes.

HTH!

> currently countries have restrictions on entry most of them either insisting on you being vaccinated or to present a current Covid test

Anecotal data point #1:

I've entered Italy three times [by road] in the last six months, each time with a sheaf of paperwork to hand demonstrating my need to travel, negative test, EU27 residency, the full nine yards.

During none of the three visits did I even see a border guard / police / Carabinieri / $whoever at or close to the border, never mind get stopped, never mind have my documents checked.

There is policy, and there is reality. Maybe the gap between them in Italy is marginally larger than in some other places?

AFIK the countries of the Shengen area haven't suddenly hired many guards to control everybody just because of COVID.

I don't of internation sources. But you can google translate this one https://nyheder.tv2.dk/samfund/2021-06-01-snyd-med-nyt-coron...

The Swiss verifier app reminds you in big letters that it's only valid with photo ID.

> Now the app have all sorts of cool colour effects when you tilt your phone.

Any video for that?

Does the Danish one not contain name etc? The idea was that you'd be comparing that against photo ID.

It does not, well it does, but you have to click to unhide it. There isn’t a Danish ID withou a SSN on it, and that’s secret. There where some resistance to allow resturant and other venues like that see your name and SSN.

So no, due to privacy, there no nane show by default.

The Danish app gives the user two options. You can either show one that contains name and DOB or one that doesn't.

It's not clear (to me) when you are supposed to show the code with additional information, and I haven't been asked to do so.

> It's not clear (to me) when you are supposed to show the code with additional information, and I haven't been asked to do so.

The option with more data is only for official situations, like border control. That version is also in English and French.

The French app (Tous AntiCovid) shows my name along with the 2D-DOC (QR code).

No, actually the danish app has 3 versions.

1. No personal information at all. It only says valid or not valid. 2. Name and date of birth 3. Foreign travel, with name, date of birth as well as information about test type or vaccination type etc.

A two way handshake/challenge would be the ideal way to solve that.

ie. the patient would scan a qr code (containing a nonce) on the checkpoint, and include that number in the token which was then shown to the checkpoint.

Digital signature would prevent that (assuming scanner does a good job at verifying one). "Looking at the hexdump" section of TFA, last 64 bytes (cyan-coloured).

On top of that, online verification (e.g. by certificate ID) might be possible, too.

Yeah, didn't fine the hash in that JSON

Most likely because it’s not 100% guaranteed the server will be accessible, as then having that data will be a good backup system.

It's signed.

I think at least partial offline-support was a requirement.

I guess the certificate id is the id value you speak of.

It would be cool if the whole thing was signed by a government public key, then you could verify it offline.

It is. This is signed by the relevant health authority in each country as far as I understand. And the official apps for reading them can verify the signature offline.