Hacker News Reader

Comment by r1ch | Hacker News Reader

This design looks pretty sound, revocation seems like the big missing piece but I guess that could be done by pushing an updated scanner.

Here in The Netherlands our app is also used for proof of a negative test. I wonder if giving signing powers to however many hundreds of test locations will backfire at some point. Then again I don't know if our national QR codes are even cryptographically signed to begin with.

View on HN

From the qr generated and qr expiry timestamps, it looks like they are only valid for 2 days, so revocation isn’t that much of a problem.

I was thinking more along the lines of one of the signing keys leaking.

I don't know how the signing process is for this specific green pass, but the national France one is signed exclusively by the French healthcare system: vaccination centers and test locations can emit a signed pass remotely and print it, but they don't possess the private key locally.

I'm speculating somewhat as I haven't been through the process, but it seems like the test centers give you a string that the app converts into the QR code. The app is supposed to work offline, though perhaps the initial string -> QR code does an online lookup and thus is signed externally to the test centers.

The string is a BASE45-encoded payload that has already been signed before encoding as a QR-friendly string. The BASE45 is because QR codes only support 45 characters (versus more common BASE64). But by the time the string -> QR happens, the signing has already taken place from the lab who provides the string.

> I wonder if giving signing powers to however many hundreds of test locations will backfire at some point.

In Germany the vaccine proof can be generated at (most?) pharmacies. If that would become an issue, I don't think it would only be one in the Netherlands.

Should be most pharmacies but they have to check your vaccination booklet (or proof of vaccination, they give you extra papers at the vaccination location). It seems to work alright considering atleast one person I know is facing charges for falsifying medical documents and falsifying signatures due to them trying to fake their vaccination and bringing that to the pharmacy.

Reply on news.ycombinator.com