Re:What's Inside the EU Green Pass QR Code?
by kevincox on Tuesday June 22, 2021 @10:01AM
(#27591715)
It does contain a bit more information than required, such as the specifics of the vaccine. But I think the personal information such as name is required. The code needs to be tied to some form of ID otherwise a single code could be copied and used by everyone. So the name and date of birth are likely used so that it can be compared to your drivers license or passport to ensure that the QR code actually belongs to you.
[ Parent
| on HN ]
Re:What's Inside the EU Green Pass QR Code?
by sunshineforever on Tuesday June 22, 2021 @10:26AM
(#27592025)
Couldn't someone just generate a fake QR code with their name and DOB on it?
Re:What's Inside the EU Green Pass QR Code?
by kevincox on Tuesday June 22, 2021 @10:29AM
(#27592076)
IIUC the data in the QR code is signed, the article mentions it but doesn't show the signature.
DCC (Digital Covid Certificate it's called, not Digital Green Pass) is essentially a spec for a QR code (as demonstrated nicely in this post) + an EU signing gateway which is used for signing the certificates. The EU acts similar to a CA in case of SSL certificates.
Re:What's Inside the EU Green Pass QR Code?
by alkonaut on Tuesday June 22, 2021 @12:41PM
(#27593923)
At the very least it should be signed. Also, the issuing authority is on there so it should be possible to verify the information if necessary too.
Re:What's Inside the EU Green Pass QR Code?
by distances on Tuesday June 22, 2021 @11:25AM
(#27592852)
They could also produce a fake vaccination booklet, or fake Covid test result. I'd guess both of these would be easier. All will result in forgery charges if caught. I think the chosen approach is pretty solid for the purpose.
>It does contain a bit more information than required, such as the specifics of the vaccine.
between eu member states, the acceptance of e.g. sputnik-v (the russian corona vaccine) varies. having the name (or id) of the vaccine in the code allows countries who don't recognize a given vaccine to validate codes issued by other eu nations, who are more open to such a vaccine. (what a horriblly worded sentence, i hope you get what i'm trying to say)
Re:What's Inside the EU Green Pass QR Code?
by kevincox on Tuesday June 22, 2021 @10:16AM
(#27591894)
Yes what is "required" is controversial. What I meant to say is that they could have chosen to go for a yes/no type of verdict but instead they chose to let the reader decide if they consider the protection acceptable. Both decisions have pros and cons.
Re:What's Inside the EU Green Pass QR Code?
by distances on Tuesday June 22, 2021 @10:28AM
(#27592059)
What's "acceptable" can vary by country. They couldn't have done this with the acceptance bit only.
Additionally, the situation is constantly changing. A vaccine effective today might be considered insufficient tomorrow, e.g. due to mutations, new studies etc.
Re:What's Inside the EU Green Pass QR Code?
by rsynnott on Tuesday June 22, 2021 @11:18AM
(#27592751)
> It does contain a bit more information than required, such as the specifics of the vaccine
That seems reasonable; it's totally plausible that a future variant defeats a vaccine, and at that point you would want to be able to detect people who'd been given that one.