Hacker News Reader

> Apart from the name/manufacturer of the received vaccine, there is no superfluous data inside, so the QR code is not a privacy nightmare, as some have feared.

It has someone's name and DOB in it, which, when scanned, creates a record of their identity at that location at that time.

Coordination between scanners can create a crude track log.

It's still a privacy nightmare.

View on HN

Name and DOB are necessary to cross check the certificates with IDs/passport to make sure screenshots aren‘t passed around

It is the same way necessary as having your passwords stored in plain-text to verify your password.

Name and DOB could be hashed and compared to the hash inside the QR code.

Such a system would be a nightmare for matching names reliably.

There may be variations between different documents (e.g. it might exclude middle names, people might use a different name on different documents, accented characters, hyphens, might be in a different order, might have a title or honorific such as "MR").

Reflecting on it, it doesn't solve anything, as I still have to give my name and date-of-birth to the person validating it anyway.

Otherwise, there is a large degree of normalisation in the id documents in the EU, and you could simply hash each variation.

Reply on news.ycombinator.com