Hacker News Reader

I'm speculating somewhat as I haven't been through the process, but it seems like the test centers give you a string that the app converts into the QR code. The app is supposed to work offline, though perhaps the initial string -> QR code does an online lookup and thus is signed externally to the test centers.

View on HN

The string is a BASE45-encoded payload that has already been signed before encoding as a QR-friendly string. The BASE45 is because QR codes only support 45 characters (versus more common BASE64). But by the time the string -> QR happens, the signing has already taken place from the lab who provides the string.

Reply on news.ycombinator.com