An important detail - this was a third party app, NOT an official government one. So, people were essentially uploading their PII to some guy's server and hoping for the best.
This is what we all feared, and hoped wouldn't happen. But here it is.
This is what we all feared, and hoped wouldn't happen. But here it is.
Because it's just fueling misinformation and mistrust of what will eventually be the official apps. C'mon CBC. People stupidly using random third party apps and you're making it out like it's the official government 'should be trustworthy' one when it isn't and is just a random app data leak story.
And honestly, I think I would trust the government-developed app far less than a private one. Have you SEEN any government website before?
Not sure how this is an "important detail," as it doesn't even make any difference: governments have a god-awful track record of securing data[1][2]. Any sane infosec professional realizes vaccine passports (or any other "passport" app) is a terrible idea. Heck, Apple has zero-day exploits like every other week.
[1] https://www.infosecurity-magazine.com/news/us-leaks-pii-two-...
[2] https://federalnewsnetwork.com/defense-news/2020/02/disa-exp...
Yes. A passport is orders of magnitude harder to forge than for some app written by a random government contractor to leak data.
Because it's just a QR code, you can store it however you'd like. If you want, you can print it out and carry it around in your pocket. It's easy to check: you just need to read the information and check that it's digitally signed by a trusted authority (both of these can be done by an app), and check the the person listed in the QR code is the person in front of you (e.g., by asking for an ID).
There has been a lot of progress both in fundamentals and implementations on this front over recent years but even decades old schemes using attestations would have been a huge improvement over “dump and read data through trusted server”.
Here’s a trivial one that anyone could implement without using anything new from the past decade: Whoever stands as “trusted party” could have signing certificates distributed to the verifier-side of the app. They sign hashes of the relevant info. All data sharing needed is once per issuance of “vaccination certificate”. No persistence of PII necessary. If you don’t want to have to disclose PII as part of validation, that’s where the fancier schemes come in.
If you can’t or won’t spend resources to do it properly then yes, physical card is preferred.
It’s not that terrible compared to what’s out there and falls in the “trivial” category (which is not necessarily a negative; less complexity is good) but it’s far from ideal and it’d have to improve before pushing it globally.
As an example, some jurisdictions might declare individuals with single doses protected.
Another real example: the EU is unwilling to accept Covishield vaccinations, despite it being AstraZeneca/Vaxzevria manufactured in India.
I don't see this as any different than carrying around any other ID in my wallet. My driver's license also has my name and date of birth (plus information about my eyesight and home address).
The nice thing about the vaccination passport is that it is like a card in your wallet. There's no centralized server that's being queried. It's offline and distributed.
I did all of these things (printed, screenshot, pulled up a webpage) and also had a successful scan of a picture of a QR code that I had in my photoreel (which showed the entire printout, of course, with my name, etc. on it).
How about that.
The amount of tyranny people are willing to accept as a response to this is still baffling to me, it is like this is the first time humanity has ever encountered a communicable illness...
This is not the proper way to respond to said illness and does not bode well for the future of individual liberty
https://en.wikipedia.org/wiki/Office_of_Personnel_Management...
eHealth, as cumbersome and obtuse as it is, is unquestionably secure. It's not perfect, but it's good enough. We have the IPC (https://www.ipc.on.ca/) and several other checks and balances that must be satisfied before a system can hold health data. Not to mention the federal requirements such as PHIPA.
These safety requirements are completely out the door when some guy runs a vaccine app. This leak wasn't a mishandled CVE or a zero-day - it was just lazy and sloppy design.
Personally, I'm neutral on the technological aspect of 'passports'. I would prefer a hard-copy if possible to keep tech out of the question entirely, but there are absolutely ways to do it well, or at least good enough. This isn't it - this was an opportunist seizing the disorganization of the Alberta government from what I gather.
A passport is going to be a debacle, and there will be leaks like this one and likely worse. If you happened to look at the clerks screen on their tablet when you got your last shot, the vaccination rollout was done using a salesforce app, and it's very likely it didn't go through the same checks and balances (like a privacy impact assessment) as internal govt apps.
IMO, it's got a huge legal problem where it doesn't collect consent in any meaningful way (an anonymous clerk ticks boxes on a screen you can't see, with no way of verifying they have obtained your consent). At least when you sign a physical consent form, you can write-in that you are getting the shot under duress from your employer, but the rollout doesn't track that, and that's by design.
The same can be said for public sector employers collecting vaccine certificate information as a condition of employment (have fun with the unions on that one), as they are also subject to PHIPA, and most of them do not have the facilities for PHIPA compliance in the handling of employee health information (PHI). There are so many technical issues with passports that it's going to be a complete discredit to government, but my impression is they don't actually care. This is a putsch to elevate a class of apparatchiks who do not assert their freedoms or rights, and where they are headed, they don't need legitimacy or credibility.
There is a generation of people in government and other institutions now who are basically terrible people whose plan is to squeeze the toothpaste out of the tube in terms of data, "temporary measures," and passing laws that won't withstand court challenges, and they imagine themselves as being muscular about policy. I'd predict it ends very badly for them, and if not for them, then definitely for the rest of us.
One wonders why they think it will work this time.
Oh, it’s a lot more than the public sector that will be finding themselves to now be health information custodians by collecting this data.
The only way to get traction will be to find a way for it to be used to scapegoat conservative party politicians, otherwise, it's not going to go anywhere. Basically, unless you can pin it all on Doug Ford, the press is going to ignore it.
> There is a generation of people in government and other institutions now who are basically terrible people whose plan is to squeeze the toothpaste out of the tube in terms of data, "temporary measures," and passing laws that won't withstand court challenges, and they imagine themselves as being muscular about policy.
"Why are you opposing these temporary emergency measures? Are you a conspiracy theorist with something to hide? Flag this one in the system Gladys..."
Official government software is systematically high quality after all [0].
I'm hoping that more countries will follow the danish example, where the vaccine passport was dropped on September 10, 2021.
This amount of control doesn't make any sense in countries with high percentage of vaccination such as Canada.
Another country about to make this mistake is Scotland.
Hmmm that is an odd spelling for coerce, force, threaten...
This is highly unconstitutional on many levels, and will likely be dismissed by the Supreme Court, but the fact that it's even being considered by the administration as an option is disturbing.
Other nations such as France and Australia are locking people in their homes and preventing them from traveling or performing basic essentials activities like grocery shopping without proof of vaccination.
> Federal employees, federal contractors and health-care workers at facilities that receive federal funding must show proof of vaccination, with no testing option.
> 80 million U.S. workers will have a choice between providing proof of vaccination or submitting to weekly Covid testing.
Your examples of France and Australia are also not accurate. According to [1]
> There may be circumstances in the future in which proof of vaccination will be required, such as border or re-entry requirements, or continued employment in particular areas. One example of this is the mandatory vaccination requirements for all residential aged care workers which will come into effect on 17 September 2021 in line with relevant state and territory directions.
For France there is no mandate like you described [2]. No one is keeping anyone from doing essential things like grocery shopping, I don't know where you got that from but I suggest you do some research.
[0] https://www.cnbc.com/2021/09/10/what-you-need-to-know-about-... [1] https://www.health.gov.au/initiatives-and-programs/covid-19-... [2] https://www.rfi.fr/en/france/20210930-health-pass-becomes-ma...
In Australia elderly and children are being tackled and pepper-sprayed by police for not wearing masks. They're returning to their prison colony past. Don't even try to pretend what they're doing is a remotely acceptable way to treat human beings.
The vaccine passport you describe in your attempt to "debunk" me still sounds harshly authoritarian, do you think you're quelling anyone's fears by describing how proof of vaccination will be required to participate in basic society?
- Full liability for vaccine manufacturers
- No censorship of dissenting views
- Open discussion with all views represented instead of suppressed
- Honesty on unvaccinated vs vaccinated case, death numbers
- Following the science instead of what’s convenient for politicians at the moment
This is like saying "We should stop all the DUI checkpoints like this other country did," when that country doesn't have a DUI problem but 30% of drivers in our country are drunk.
Denmark: 76.7% / 75.1%
Canada: 77.5% / 71.4%
Scotland: 76.7% / 70.2%
Canada will most likely overtake Denmark as more people have had the first vaccine shot.
- It's not 'experimental'
- It's not 'gene therapy'
- It has broad support from every major medical and public health organization on the planet, who based their decisions on the empirical research demonstrating its safety and effectiveness.
It is literally gene therapy. While most vaccines present a neutered form of a virus for your immune system to safely respond to and develop antibodies that will be useful in counteracting the version of the virus in the wild, mRNA vaccines quite literally insert themselves into your cells and try to insert that "training" RNA code into your immune system artificially without your body doing it on its own terms. This is what gene therapy is.
The medical boards based their decisions on the empirical research that doesn't exist yet? That's wild, they're time travelers?