Hacker News Reader

Comment by wezzo | Hacker News Reader

How easy is it to fake Austrian vaccination cards? The ones my friends have (in Dallas, TX) are indistinguishable.

Essentially you need to get issued a fake vaccination record by the actual medical system.

My local news had some people admitted to hospital with Covid and despite having the certificate, not having been actually vaccinated (which can be seen in blood tests some time afterwards) which has resulted in identifying some medical personnel who had been issued fake certificates of vaccination without actually vaccinating people; since every certificate "knows" when and where exactly you got the vaccine, which exact batch/vial of vaccine was used, and the institutions' medical records will show who (supposedly) made the injection.

The prosecution for the document forgery is still ongoing, but since some of the affected patients died from severe covid, that's essentially wrongful death through intentional medical malpractice, so the involved doctors/nurses will not only lose their licenses to practice but are quite likely to see jail time, and since a nontrivial ratio of people do get ill as Covid is still spreading, if someone fake-vaccinates a lot of people, they are likely to be identified.

We use the EU-wide QR system. I don't know how easy is to get a fake certificate that would pass scrutiny, but here in Austria nobody seems to really check them. If you have something with a QR code on it, they let you pass.

Yeah it uses cryptographic signing, but fails at the human level when the checker doesn't use the app to check it and doesn't check the holder's ID.

But there were reports that some Germans were selling the certificates on the "dark web" (i.e. you have to know the WhatsApp number of the seller), and are working with rogue pharmacy employees to issue valid certificates...

In stores and restaurants they are rarely checked, but in the cinema and in concerts I had to bring a document.

FWIW I wasn't checked at any cinema I go to, nor was I checked by my employer, and in fact, I wasn't even checked when I went to the hospital (of course I assume they had it on record, but that's just after you check-in and everything).

As for stores, I don't think they are supposed to check at all. Or at least I hope so. Personally I have never been checked.

Strange, I've shown the CovPass app in the past when either a test or vaccination were required, for eating inside, for example. But I think rules change from city to city. I don't think it's needed anymore, anyways.

In Greece we had cases of fake certificates which were issued by crooked doctors who had access in the system. So I guess the same must apply all over Europe.

I read some assertions that in Greece there were some doctors who took like 400 euros bribe to make a fake injection, but injected the actual vaccine anyway so that the reality matched the paperwork - from a local perspective, is that true or if so, was it widespread?

It is true, but no, it wasn't widespread. I find it funny though, like the ultimate act of trolling.

It's a digitally signed QR code with your name on it. You can't fake it. Some just reuse some other QR code and hope nobody cross-checks the name with some other ID.

here in Lithuania we already have some cases when people were caught using fake/other people's QR code and got punished for it.

another case was that doctors were bribed to sign a document that person was vaccinated even if that person has not visited vaccination center. so yeah, there are attempts, but at the same time, law enforcement works its job sometimes.

Reply on news.ycombinator.com