News for hackers. Stuff that matters.
Re:Private keys used to sign EU Digital Covid Certificate mi... by gpderetta on Wednesday October 27, 2021 @07:37AM (#29011841)
At least in UK the app will generate a new certificate on the fly.
Re:Private keys used to sign EU Digital Covid Certificate mi... by cwizou on Wednesday October 27, 2021 @08:00AM (#29012046)
It's definitely a solution when you have an app (assuming you have a 3rd party source of identification of users), but since it's a French key, a sizeable portion of people, mostly elderly, are not using the "official" app but a paper printed QR code that was given to them at the time of the second injection (or a picture of said code).

Since the French app is pretty terrible (it used to be the barely functional contact tracing app that didn't want to use Google/Apple's API, so there's a pretty strong popular stigma against it), even a sizeable portion of smartphone users use an alternative too (I personally have my QR code in Apple's Wallet, but there are other 3rd party solutions).

Depending on when that key was in use, this may be an epic bureaucratic mess to solve here in France if they have to reissue many.

Edit : I'll quickly add that while there's a database of vaccinated people handled by CNAM (the single payer social security administration), it doesn't seem extremely accurate : my best friend and one of his collegues were vaccinated, issued a QR code, but they weren't added to said database and had a terrible time getting the situation fixed. In the end, a pharmacist reissued a "vaccination" for them to "get them in the system". So that database is probably at best incomplete (for the process of reissuing).

Re:Private keys used to sign EU Digital Covid Certificate mi... by distances on Wednesday October 27, 2021 @08:07AM (#29012113)
Does carrying just a QR code work fine for you? My experience from Germany is that nobody scans the code, they just scroll to details to see there's two vaccinations recorded. This far my QR code has only actually been scanned at the airport.
Re:Private keys used to sign EU Digital Covid Certificate mi... by cwizou on Wednesday October 27, 2021 @08:19AM (#29012232)
So I haven't had an issue yet and having the QR code is definitely sufficient in France (and always attempted to check when appropriate in my personal experience, no ID check though as that was deemed illegal).

There is however a prevalent issue with QR code scanning that I noticed twice personally (and friends reported the same experiences at other places), which is that most restaurants use a super cheap phone/tablet with a terrible camera that usually is unable to focus on a smartphone screen correctly.

Once, the person was honest about it and explained they kept having issues with it, and I tried to help him focus correctly his device (QR code size + luminosity seems to be the issue from what I saw).

The second one tried a couple of time, didn't manage to focus and told me "all ok" despite it's device not having scanned me (I could see the screen).

If I had to travel though, I'd definitely take the paper certificate on top of it, as, at least here in France, that's considered for better of for worse the source of truth.

Re:Private keys used to sign EU Digital Covid Certificate mi... by pmontra on Wednesday October 27, 2021 @09:10AM (#29012827)
My experience in Italy is evenly split between these two cases:

1. Scan the code with the app every time.

2. Ask if I have the pass, maybe look at it once, hopefully remember me the next times.

There is also a small percentage of cases of no questions asked, ever.

By the way, I'm using a printed copy of the pass. It never runs out of battery, I don't mind if it falls on the floor when I'm using it, it works even if I'm using the phone for something else. Cons: it needs to be replaced if its key gets revoked.

Re:Private keys used to sign EU Digital Covid Certificate mi... by darkwater on Wednesday October 27, 2021 @08:40AM (#29012500)
In Italy they scan it regularly at restaurants, at least where I'm from. And I have a UE certificate, not an italian one, and never had any complain.
Re:Private keys used to sign EU Digital Covid Certificate mi... by VortexDream on Wednesday October 27, 2021 @08:22AM (#29012257)
I've had my QR code scanned going to bars and restaurants in Germany. Works fine.
Re:Private keys used to sign EU Digital Covid Certificate mi... by topranks on Wednesday October 27, 2021 @06:39PM (#29019923)
In France it was scanned a lot when I was there in August.

In Ireland it’s hit and miss. About 60% of the time had to produce it, but very few places want to see ID as well, which is needed to prevent people just using someone else’s pass.

I’m all for it so I’d love to see better enforcement.

Re:Private keys used to sign EU Digital Covid Certificate mi... by mgraupner on Wednesday October 27, 2021 @08:57AM (#29012710)
Same for me, everybody touches my phone to scroll down the screen, nobody scans it. Way to handle a pandemic...
Re:Private keys used to sign EU Digital Covid Certificate mi... by nicoburns on Wednesday October 27, 2021 @09:17AM (#29012903)
> Since the French app is pretty terrible (it used to be the barely functional contact tracing app that didn't want to use Google/Apple's API, so there's a pretty strong popular stigma against it)

Yeah the UK very wisely put the passports and the contract tracing in separate apps (helps that the NHS already had an app pre-pandemic). Not sure if it was intentional, but it certainly sidesteps this issue!

Re:Private keys used to sign EU Digital Covid Certificate mi... by m-p-3 on Wednesday October 27, 2021 @09:12AM (#29012856)
There is no pretty way to fix that, anything signed by a revoked key automatically becomes invalid.
Re:Private keys used to sign EU Digital Covid Certificate mi... by topranks on Wednesday October 27, 2021 @06:38PM (#29019913)
I was on holiday in France and imported my Irish code to the French app. Found it real easy to use.
Re:Private keys used to sign EU Digital Covid Certificate mi... by Aachen on Wednesday October 27, 2021 @07:41AM (#29011875)
So it also automatically resigns the forged certs, or how does it tell the difference?
Re:Private keys used to sign EU Digital Covid Certificate mi... by jonathanstrange on Wednesday October 27, 2021 @08:44AM (#29012542)
It tells the difference by looking up the test results in a database. At least that's how it works in Portugal. You can also use the app to look up other health related information.
Re:Private keys used to sign EU Digital Covid Certificate mi... by gpderetta on Wednesday October 27, 2021 @09:01AM (#29012755)
As far as I understand, it connect to some NHS server and after authentication it fetches a certificate that has been signed by the server.
Re:Private keys used to sign EU Digital Covid Certificate mi... by cm2187 on Wednesday October 27, 2021 @07:44AM (#29011899)
Don't know for covid passport (since it is not enforced in the UK), but for travel certificates I believe the QR code has a validity of 3 months.
Re:Private keys used to sign EU Digital Covid Certificate mi... by secondcoming on Wednesday October 27, 2021 @08:43AM (#29012537)
The covid passport is enforced in Scotland.
Re:Private keys used to sign EU Digital Covid Certificate mi... by lmilcin on Wednesday October 27, 2021 @07:40AM (#29011866)
I am not using an app. I am not installing any third party apps on my phone, government or not, period.

The certificate I am using is printed on a piece of paper I carry with me.

Re:Private keys used to sign EU Digital Covid Certificate mi... by Aachen on Wednesday October 27, 2021 @07:43AM (#29011897)
Similar here. I use the app since it doesn't do anything invasive, but I also have a paper backup (I don't always carry it) because it's a bit too important to be dependent on a phone only. I bet I'd first find out about my certificate being revoked at some check point where my phone isn't working and I can't easily get a new one...
Re:Private keys used to sign EU Digital Covid Certificate mi... by gpderetta on Wednesday October 27, 2021 @07:42AM (#29011881)
well, print it again then.
Re:Private keys used to sign EU Digital Covid Certificate mi... by lmilcin on Wednesday October 27, 2021 @07:47AM (#29011927)
I know this, but a lot of people may not know because they don't care to read HN. Then they try to board a plane and get rejected.
Re:Private keys used to sign EU Digital Covid Certificate mi... by gpderetta on Wednesday October 27, 2021 @08:16AM (#29012203)
to be fair, yes, you are right, it is going to be a pain for a lot of people.
Re:Private keys used to sign EU Digital Covid Certificate mi... by bilekas on Wednesday October 27, 2021 @07:53AM (#29011975)
> not installing any third party apps on my phone

Just out of curiosity, is that for privacy reasons or ? Seems rather strange for a smartphone ?

Re:Private keys used to sign EU Digital Covid Certificate mi... by GoblinSlayer on Wednesday October 27, 2021 @08:00AM (#29012038)
Can't you keep it in a jpeg file and show that?
Re:Private keys used to sign EU Digital Covid Certificate mi... by TacticalCoder on Wednesday October 27, 2021 @08:04AM (#29012092)
You can do both. In addition to these two methods I also have a print of that QR code in my car.
Re:Private keys used to sign EU Digital Covid Certificate mi... by ben_w on Wednesday October 27, 2021 @07:51AM (#29011954)
In general? Or just COVID apps?