Quebec politicians’ Covid-19 vaccine passport QR codes allegedly hacked | Hacker News Reader

Quebec politicians’ Covid-19 vaccine passport QR codes allegedly hacked

theglobeandmail.com

8 pointsghostpepper6 comments

Hacked seems like a stretch. Sounds like they've just encoded the information raw in the QR code, and someone got a picture of it?

The article goes into a bit more depth; since very little information is required to get a copy of your QR code, they likely found or guessed the required information to simply fetch the QR code for the politicians the way they would download their own.

Sounds like if you have someone's name, birthdate, and social insurance number (like an SSN but meant to be more secret), you can get a QR code that has someone's name, birthdate, and vaccination status.

In other words, if you have two pieces of commonly available information, and one piece of secret information, you can get two pieces of commonly available information and one piece of information that you're going to have to share with others anyway.

From the article:

> Quebecers shouldn’t worry much about their codes being stolen, he said, because the QR codes contain less personal data than the information needed to steal them.

With someone's name, birthdate, and SIN, you can likely get access to a lot more private data than this QR code system provides you.

It's not a SSN but a health insurance number, which is basically structured like this: three first letters of your lastname, the first letter of your first name, the two last digits of your birth year, the month in two digits format of your birthdate, the day in two digits format of your birthdate and a somewhat random number between 00 and 15 IIRC.

So if you know someone named John Doe and their birthdate (ex: October 11th 1951), you can mostly guess their health insurance number (ex: DOEJ 5110 11xx).

Not exactly rocket science.

Is there not a digital signature involved? There was a previous discussion here https://news.ycombinator.com/item?id=27354815

Yeah it's either that or they got it through the portal by guessing their health insurance number which is made up of your first and last names with date of birth and finally two numbers that serve as a way to handle people with the same name born on the same day.

For example, John Doe born in 2001-01-01 with have the health insurance code DOEJ010101XX where XX is how many people with the DoEJ were born that day. So usually you need 0-10 guesses to get it.

Just did the process and it also asks for your mother's maiden name and when and where you got your first dose so it's not like this can allow attackers to leak everyone's info and while I didn't try it myself I am fairly sure that the requests are rate limited.

Finally the info in the QR code itself is just Name + Date of Birth + when and where you got your two doses so it's not like it actually means anything.

Manitoba is doing pretty well with the QR code’s. Hopefully there won’t be any problems here

Reply on news.ycombinator.com