> Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me.
In the case of Quebec's app, there are significant issues. It's not just that they permit privacy violations; it's that the other side of it is broken.[1]
[1]: https://www.cbc.ca/news/canada/montreal/vaccination-passport...
Edit: that obviously doesn’t reduce the severity of the PII breach issue though, or change the fact that it undermines the security of the covid passes. If anything it’s worse because you’d be able to see other stuff like childhood vaccinations.
What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as key to being able to trust it.
The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. I'd be more curious how it would be able to handle any other jurisdictions' codes, unless it has US keys available as well.
I appreciate that the data contained in the code is as minimal as it can be, while the official app is displaying even less. Working off-line should keep it reliable as well, since it does not make or require server calls. This too would be different from Portpass, since it apparently stopped working.
See https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bc... for a quick overview.
Quebec's app does the same thing, it has the public key builtin for validation. The only time the app can connect is to download an updated list of rules that determine if the enclosed information in the QR code related to vaccine status still protects the owner (and label them as adequately protected if they meet those criterias).
SMART Health Cards - California, Louisiana, Walmart, New York and surrounding areas (Excelsior plus), Quebec (I believe, they don’t have a public spec), and some others.
EU DGC - All eu countries, some others like the UK.
Both are fairly well thought out and use public key cryptography. I’m not a huge fan of the signed JWT thing that SMART uses but wouldn’t let perfect get in the way of good. Why anyone would go and build something that isn’t largely compatible with either or both of these is beyond me.
In many of these instances it seems like the public health department is getting scammed by local players who say they can do something like this and then have Not Invented Here causing massive issues.
I’d love to work on a verifier which supported both the EU and SMART standards in one app.