Comment by GekkePrutser | Hacker News Reader

Comment by GekkePrutser | Hacker News Reader

Parent Full thread

The QR is issued based on medical information but in most cases not directly linked (it's a separate database). But it's not an airtight system.

The gap there is that the venues have to check the QR with your ID to see if it's got the same name. Usually they don't bother. So people can just use someone else's. The QR is super secure (signed with a private key) and can't be faked but the person's identity has to be validated by other means and cross-checked with the QR info. So basically it comes down to the whole fake ID thing that people have always used for underage drinking etc. And a lot of places don't bother in my experience, they just scan the QR and see if it comes up green.

I really hate having to ID myself everywhere though. Especially because the QR is digitally scanned so can be collected really easily. I really care about privacy and this can be used for tracking to the extreme. Nothing to stop restaurant owners and shops from collecting the personal info they scan. I'm fully vaccinated but I'll probably not go for dinner anymore and will boycot public transport as much as I can.

Also, if we just make vaccines mandatory there's no need to check as everyone's got one.. The lowest covid risk possible, and no privacy invasion.

I feel like the current measures are tailored too much towards the needs of the antivaxxers. I understand their concerns but a society where we have to ID ourselves every 5 minutes and be tracked as a result is a horror scenario too. I'm hoping for a bit more debate on this but the countries that have introduced this (France, Italy) have ignored any criticism.

Also, it doesn't really help the antivaxxers as in those countries they will have to get a 50-euro covid test every 2 days if they want to go shopping, use public transport, eat out etc. In the end I think many of them will get the vaccine anyway as they can't afford that. And then when (nearly) everyone is vaccinated, will they drop the QR codes? I doubt it... So really all of us will be worse off in the end.

I know it's not a nice debate to have but we really need to think of the effects of these decisions on society in the long term.

> Also, if we just make vaccines mandatory there's no need to check as everyone's got one.. The lowest covid risk possible, and no privacy invasion

How do you make them mandatory without privacy invasion? You must keep records on who is unvaccinated.

The precursor to every 20th century atrocity was diving the population by decree.

The state already knows who is and isn't vaccinated, otherwise they couldn't issue the QR codes. This is already a total known in Europe. It's linked to your healthcare ID (a lot of countries in Europe have nationalised healthcare)

The QR codes themselves enable businesses and government to track your detailed movements every day though. This is why that's much worse.

I wonder if it's possible to devise a QR code verification system that doesn't erode privacy.

For example, what if guests could regenerate the QR code, or the app did it automatically, every five minutes? And the QR code contained nothing but a cryptographically verifiable assertion that the person presenting it is vaccinated, together with a picture (or a reference to a downloadable picture) of the guest? That would prevent the host from being able to gather anything beyond what they already can from their CCTV, while getting the vaccination assurance they need.

Trouble is, I can't think of a way to do this without connectivity, and that's problematic due to downtime, service availability, and so on. A privacy eroding fallback to an offline system would be possible, but runs the risk of privacy violators simply "accidentally" losing connectivity.

Anyway, there's a challenge for HN. Design such a system :-)

The authorities actually are trying to get us to use their app which does indeed generate a new code every time. However this is something I don't like because then I have any tracking of the actual app to worry about too. Especially because their lineage is pretty murky. I've gone to a lot of trouble to get facebook and google out of my life and this feels like a big step back. So I use the paper code exclusively.

Of course that also presents issues with people not owning smartphones, not knowing how to use them or having dead batteries as you mention already.

But what you describe would be better than the current setup if the operator is really transparent about how any personal info is used, yes.

All the covid tracking apps during the first wave were really privacy conscious (avoiding personal info, using open source etc) but the whole QR thing as introduced in Europe doesn't seem to have taken this into account at all. Of course that's because it's more personal in general but the whole open source thing has been dropped too. Only Switzerland seems to be doing that now.

Reply on news.ycombinator.com