News for hackers. Stuff that matters.
Re:Private keys used to sign EU Digital Covid Certificate mi... by CodesInChaos on Wednesday October 27, 2021 @07:24AM (#29011749)
Nobody verified my code so far, they just eyeball the app. So the practical impact of such a leak is probably small, since people will fall for dumb forgeries already.
Re:Private keys used to sign EU Digital Covid Certificate mi... by wasmitnetzen on Wednesday October 27, 2021 @08:44AM (#29012543)
It varies widely by country. From personal experience and what I've heard from relatives, at private venues:

* Germany: usually quick glance at the QR code

* France: usually properly scanned

* Sweden: not even planned to be used

* Italy: usually properly scanned

Re:Private keys used to sign EU Digital Covid Certificate mi... by toyg on Wednesday October 27, 2021 @08:51AM (#29012640)
* England: what is even covid
Re:Private keys used to sign EU Digital Covid Certificate mi... by whywhywhywhy on Wednesday October 27, 2021 @11:47AM (#29014855)
Honestly feels completely back to normal here, streets and bars are full of people again, definitely only about 30% still wearing masks.

Not endorsing it either way, just surprised how quickly everyone gave up on it here when places in Europe are still implementing passports and requiring scans to enter stores/restaurants.

Re:Private keys used to sign EU Digital Covid Certificate mi... by toyg on Wednesday October 27, 2021 @12:47PM (#29015789)
There continues to be a dominant mainstream view that whatever Europe does, "we" have to do the opposite because "we" know better. The results are very clear in the infection numbers, with transmission ratio back to 1 and above.

It will be a long winter.

Re:Private keys used to sign EU Digital Covid Certificate mi... by native_samples on Wednesday October 27, 2021 @01:09PM (#29016066)
No there isn't. England has been mostly doing the same as neighbouring countries so far.

It hasn't implemented COVID passes yet because they're pointless. As BoJo pointed out just a few days ago, the pass is meaningless. Vaccinated people get infected and pass it on, and do so at the same rate as unvaccinated people (actually a higher rate in the UK at the moment).

Re:Private keys used to sign EU Digital Covid Certificate mi... by toyg on Wednesday October 27, 2021 @08:52PM (#29021018)
> England has been mostly doing the same as neighbouring countries

Except it hasn't - on the mainland masks are still compulsory in loads of places, just to start. Look at the infection rates and tell me there is no obvious discrepancy with a straight face.

> COVID passes yet because they're pointless

They are not a medical instrument, they are a policy instrument. They are effectively a push to force the obtuse and obstinate novax constituency, which is still over 15%-20% all over, to get the jab, by forcing them to choose between daily invasive tests and a one-off vaccination. It's basically compulsory vaccination by the backdoor, so that they can hit 90%-95% vax rates.

> Vaccinated people get infected and pass it on,

Not if they keep using masks and hanging around with other vaxed people only. That's why the transmission rates on the continent are where we would expect them to be, and here they are out of control. If you give up all efforts like we've done, of course the virus spreads with or without passes.

Re:Private keys used to sign EU Digital Covid Certificate mi... by native_samples on Thursday October 28, 2021 @03:10AM (#29023285)
Your beliefs about infection and transmission rates are wrong. The UK does vastly more testing than most European countries. Normalize by testing rate and the UK is no different to anywhere else. Here's an example query for you:

https://ourworldindata.org/explorers/coronavirus-data-explor...

At any rate, I'm curious why you still believe infection rates are linked to policy. There are so many counter-examples by now: for the UK specifically, after it had it's "Freedom Day" and removed masking requirements and other measures cases fell significantly and immediately. Florida got rid of all measures and now has one of the lowest rates in the USA. Studies have been done to measure the correlation between various types of policies and outcomes, always with a null result. Infection rates and policy just don't seem to be linked at all, sad though it is to say.

"They are not a medical instrument, they are a policy instrument"

And the UK already has very high vaccination rates. Well above the levels originally claimed to be needed, especially over 90% amongst the vulnerable, meaning they're pointless both on their face and if you treat them as a form of extra-judicial punishment.

I agree with you that they're actually the latter, but they're presented as a medical instrument by governments. Hence why testing and recovery gets you a certificate. If you view them as in reality being mandates that circumvent the judicial system then Europe - a continent that spent much of the 20th century as a basket case overrun with dictators and fascists - is once again lying to its people in the name of totalitarian control. Why on earth should England follow them down that road? It's one that's been walked before, always with horrific ends.

"Not if they keep using masks and hanging around with other vaxed people only"

I think you're just making things up now. No data indicates this that I'm aware of, transmission rates aren't "out of control" once you correct for testing rates and if vaccinated people only stop being infectious when wearing masks (lol) then it's not the vaccines stopping transmission, is it?

Re:Private keys used to sign EU Digital Covid Certificate mi... by wongarsu on Wednesday October 27, 2021 @09:41AM (#29013165)
In Germany I've had some people scroll/interact with the app to make sure it's not just a screenshot, but so far nobody ever scanned my QR code.
Re:Private keys used to sign EU Digital Covid Certificate mi... by varajelle on Wednesday October 27, 2021 @10:38AM (#29013873)
And what if it was a screenshot? What's wrong with a screenshot?

I'm alway taking screenshot of my qr code for boarding pass and things like that so I don't have to keep the airline app open and it works without network.

Re:Private keys used to sign EU Digital Covid Certificate mi... by wongarsu on Wednesday October 27, 2021 @12:47PM (#29015779)
The easiest way to pretend you are vaccinated is to take a screenshot from somebody with the certificate and photoshop the name.

Of course that's trivial to detect by interacting with it or scanning the QR code (which won't match the photoshopped name).

Re:Private keys used to sign EU Digital Covid Certificate mi... by vladharbuz on Wednesday October 27, 2021 @09:04AM (#29012780)
* Denmark: Usually only a quick glance at the QR code

* Switzerland: Usually, but not always, scanned

(Obviously anecdotal.)

Re:Private keys used to sign EU Digital Covid Certificate mi... by aqme28 on Wednesday October 27, 2021 @09:07AM (#29012803)
Berlin: Seems like most places will actually scan it.
Re:Private keys used to sign EU Digital Covid Certificate mi... by csunbird on Wednesday October 27, 2021 @09:55AM (#29013315)
But, they do not check your id. You can just get a valid certificate from your friend (a screen shot even!), and enter the premises.
Re:Private keys used to sign EU Digital Covid Certificate mi... by framecowbird on Thursday October 28, 2021 @02:47AM (#29023134)
Definitely not my experience, I must have shown it hundreds of times and nobody has ever scanned it, not even in hospitals
Re:Private keys used to sign EU Digital Covid Certificate mi... by kace91 on Wednesday October 27, 2021 @07:30AM (#29011783)
I had it verified constantly, both in airports and (on a trip to Italy) on pretty much every restaurant or bar I went to. I think it was only once that they were fine with showing it, all the others had scanners.
Re:Private keys used to sign EU Digital Covid Certificate mi... by Semaphor on Wednesday October 27, 2021 @07:43AM (#29011893)
I don’t go out a lot, but I’ve had no verification in 2 restaurants and one bar so far. Just a check that it’s scrollable in one case, otherwise just that the name sounds like it could be mine. No scanning of the QR code, no ID check.

And I’m not even using the official app for Germany, but the "Corona Tracing" fork.

Re:Private keys used to sign EU Digital Covid Certificate mi... by lixtra on Wednesday October 27, 2021 @07:33AM (#29011802)
But did you have to show an ID or could you just show a John Doe certificate?
Re:Private keys used to sign EU Digital Covid Certificate mi... by kace91 on Wednesday October 27, 2021 @07:40AM (#29011864)
In the case of airports, ID was needed. For restaurants I guess I could have shown any valid QR.
Re:Private keys used to sign EU Digital Covid Certificate mi... by Aachen on Wednesday October 27, 2021 @07:48AM (#29011935)
Same here. Only when entering a non-EU country after flying there, they checked with a scanner. Nowhere else. Not that I do a lot of risky activities at the moment, though, so perhaps I've just gotten unlucky with the places where it should have been checked.
Re:Private keys used to sign EU Digital Covid Certificate mi... by ben_w on Wednesday October 27, 2021 @07:58AM (#29012022)
In Berlin this is wildly variable.

Some places have no checks at all; other places you need to show one of {show the QR code, use the Luca contact tracking site, fill out a paper form}; at least one needs the QR code and a valid ID card (not sure what, but excluding the health insurance cards despite those being photo ID).

They didn’t scan the QR codes in the places I’ve been to, they just looked at them. This isn’t the first time I’ve seen cargo-cult attitudes to how the content of mobile or tablet screens relates to security.

Re:Private keys used to sign EU Digital Covid Certificate mi... by ginko on Wednesday October 27, 2021 @07:53AM (#29011977)
My experience was very mixed with my (limited) travel I did this year. In Austria they just eyeball your certificate. In Italy everyone used an app to verify the qr code (although I've still only gotten my ID checked once).
Re:Private keys used to sign EU Digital Covid Certificate mi... by neals on Wednesday October 27, 2021 @07:41AM (#29011879)
While I'm having great fun with my galaxy Fold, waving my huge QR code at the clubs all the way from the back of the line.
Re:Private keys used to sign EU Digital Covid Certificate mi... by raxxorrax on Thursday October 28, 2021 @02:43AM (#29023112)
Exactly my experience. Not a fan of a vaccine pass, but I did show it at a restaurant they didn't even know what to do with it. Looked at it a bit confused, said 'yes, yes' and that was it. No check whatsoever. I don't mind that at all to be honest.

Airports check it, but other than that...

Re:Private keys used to sign EU Digital Covid Certificate mi... by stavros on Wednesday October 27, 2021 @08:01AM (#29012059)
In Greece, the vast majority verifies certificates, with high-density venues like clubs asking for ID as well.
Re:Private keys used to sign EU Digital Covid Certificate mi... by LammyL on Wednesday October 27, 2021 @02:28PM (#29017136)
I was in Greece (Santorini) for the past 5 days and nobody asked about COVID certificate and hardly anyone wore a mask.
Re:Private keys used to sign EU Digital Covid Certificate mi... by jagger27 on Wednesday October 27, 2021 @09:59AM (#29013363)
I haven't had my Canadian QR code properly scanned once either.
Re:Private keys used to sign EU Digital Covid Certificate mi... by AMD_DRIVERS on Wednesday October 27, 2021 @10:47AM (#29013996)
I've had mine scanned a few times now, only when eating in. I'm in Ottawa FWIW, people seem to be doing it mostly right here. Kind of annoying that I have to show my ID too, but luckily they accept an OHIP card as ID, saves having to find my passport.
Re:Private keys used to sign EU Digital Covid Certificate mi... by jagger27 on Wednesday October 27, 2021 @11:23AM (#29014536)
I’m also in Ottawa, for what it’s worth. I’ve found people were more thorough with the first non-QR system than the new one.
Re:Private keys used to sign EU Digital Covid Certificate mi... by consumer451 on Wednesday October 27, 2021 @02:18PM (#29016968)
The only place that really checks with the app in my world is a sweaty dance club in Prague. This is actually very appropriate. They even match with my ID.