The magic happens in the reader app.

Does it have access to a passport ID? Image database?

How is the one verifying the validity of the certificate supposed to check if it's actually the holder of the certificate standing in front to clear admission?

You show your photo ID, and the person that is checking looks if the name on your ID matches the name in the QR code. The reader Apps are dumb, they only show the content of the QR code and verify that the signature is valid.

Yeah sure, how am I going to verify that, and what about my grandmother - I foresee many problems with doing that even as a programmer?

Your grandmother is a bouncer at a club ?

Your granny doesn’t need to verify this, these are used by employees of venues that want to limit access to their facilities to people who are either vaccinated or tested negatively.

I'm talking about people like me or my grandmother who want to verify that the guard at a club uses application that works fully offline and doesn't save any data - the QR code we're handing over contains our personal data and on top of that we're actually cryptographically verifying our whereabouts while using it, so I want to be absolutely sure the government doesn't have access directly without a court order. // yes I have had a real, serious problem with the government using data it got for other purposes against me for its own gain (I won the court, but it nearly destroyed my life and I'm still not where I was before and won't be for a long time).

I'm pretty sure the guard doesn't give a flying fuck about my personal information, just like the programmers - so how do I verify myself? Or am I to stay at home forever if I care about my privacy? The EU said very different things about these issues, is that forgotten now? The same goes for the other identity-related EU initiatives, where did all the talk about privacy go? Was it just propaganda, because it certainly seems so now, as there are so many so obvious loopholes it can't be an accident?

I don't know in what country you are, but mine (the Netherlands) has open-sourced everything around the corona-check apps, including backend, design, etc. on GitHub (https://github.com/minvws).

If you or your granny aren't good at reading code, you just have to trust that other members of the public who are would have made some noise in the media if something fishy was going on.

> Or am I to stay at home forever if I care about my privacy?

Yes -- just like you've always been, long before this pandemic. Every time you're out in public, you're out in public.

Check name, compare with identification, and done? Most of the EU has an identity document.

The person reading can use their eyes to read a passport/photo ID ;) You don't need an app to do that.

Many forms of ID also have some form of NFC/RFID to read out data wirelessly. I don't know why you'd buy something to do it automatically, but you totally could.

You'd still end up comparing a picture to someone's face, though, so you can't really remove the middle man without going into some dangerous facial recognition tech.

Your id does not contained a cryptographically signed vaccination status, which this is.

You know it’s possible to carry ID and this QR code at the same time

Name+DOB in digital form is more than enough to track people, even with an offline verification process: We can expect that any number of "interested parties" will attempt to get access to the computer systems of venues operating these QR code scanners, or of their suppliers.

Having someone at the door look at a paper ICVP and a photo ID with their analog eyes has much better privacy properties. (Still bad though.)

https://en.wikipedia.org/wiki/International_Certificate_of_V...

They are still using their "analog eyes".

The verifier app is a dumb app that simply verifies the signature of the QR code payload and displays the relevant info on screen, which they look at with their analog eyes and compare to the photo id. The only network activity and/or storage is related to downloading the public keys of the issuing authorities.

Source code is available on github.

My point was that once you make that data machine-readable, it's not good enough to have privacy-by-policy of not storing it - IT security being what it is.

Ah, the threat of the imaginary hackers ("interested parties").

The QR code scanners will probably just be the official app installed on smartphones the venue will need to supply to the security personnel. Who's going to hack this? Banks can already track your credit card payments to figure out your profile, Google can track your location through your phone. Russian, Chinese or North Korean hackers probably don't care about where you spend your evenings.

> Ah, the threat of the imaginary hackers

"The imaginary is that which tends to become real" -André Breton

> Banks can already track your credit card payments to figure out your profile, Google can track your location through your phone.

For people who don't even avoid these easily defeated tracking vectors (with cash and de-googling), sure, vaccine passport tracking won't make a big difference.

Groan, "let me put a random name to some saying to justify my actions"...

Just because you can find a quote you think is profound and attach a name to it, doesn't justify super-paranoia. Do you get out of the house, or are you avoiding the virus? Life's about judging risks and benefits, and IMO you're way overblowing the risk of these hackers. What Andre Breton thinks is irrelevant.

It links 'a person' to 'a piece of health information'. Imagine what you or any data platform could do with that (big) data.

Here we hide personal health information in a QR code and are expected to give random strangers 'consent' to this personal data to gain 'access' to a venue or 'service'.

Sounds awfully lot like a cookie consent-popup.

No, it links a name and a date of birth to a number of vaccinations.

Without any kind of ID the QR code is useless.

Yes, The name and date of birth are linked to a number of vaccinations, AND the exact vaccine, AND date it was administered, AND the country it was administered, (I also now have a good guess about you nationality) AND the disease the vaccine works against.

Do you really need to know the last four if you all you really want to know if the identified person should be granted access?

But that’s the exact information I want to pass to someone?

I’m not sure how else to give someone the information that person X has had vaccine Y, other than actually transmitting that exact information?

Yes, it’s (slightly) sensitive information. But if one decides that we want to have a system based on this exact information, and it had to be “offline capable”, what are the options?

> Do you really need to know the last four if you all you really want to know if the identified person should be granted access?

If the requirements are that verifiers must themselves be able to decide which vaccines are acceptable, number of doses or time since last dose, and which issuers are allowed, then yes.