Covid-19 vaccine certs on the dark web [pdf] | Hacker News Reader

Covid-19 vaccine certs on the dark web [pdf]

arxiv.org

29 pointsYeri86 comments

I find the whole covid thing a nightmare. I got vaccinated (2 shots) in Argentina, and since Argentina doesn't have the concept of vaccine proof, as far as EU is concerned, I'm unvaccinated. So when I go to EU I can't do half the things there like going to pubs or restaurants, or in some cases even public transport, and have to get vaccinated twice. Not sure how healthy that would be, and no idea why this is (seemingly) something people are okay with.

Fear has overridden the rational mind of many people in the current period.

In both directions. Some take extreme precautions because of fear, others take extreme risks because of fear.

I wondered how true this was, but Argentina seems to have digital proof of vaccination:

https://www.argentina.gob.ar/miargentina/servicios/vaccine_c...

Or are you saying that the EU won't accept this as proof of vaccination?

First of the digital certificate is a joke, since it can't actually be obtained via the Mi Argentina app, where it fails to show up. When contacting the government, they will tell you that they are working on that (?). But what I meant was proof for a foreign country, yes, that is meant for when traveling. So not only does most of EU not accept Sinopharm vaccines, which is what I got here (there was no ability to choose), but I also don't have proof that works outside of Argentina (and, well, not even IN Argentina).

That definitely sounds like a total pain. I presume it's resolvable if you can get vaccinated where you are now and make sure with a doctor you've had a suitable delay between the shots (as with booster shots).

EU Green Pass system includes all EU countries and some non-eu countries listed here and Argentina is not in the list at the moment: https://ec.europa.eu/info/live-work-travel-eu/coronavirus-re...

I believe, countries that want their certificate be accepted by EU need to macth the EU requirements and formats.

For example, Turkey is in the list and the Turkish vaccine certificate system will generate a QR code upon your request that is valid in the EU.

I was in France in August. We had our American vax paper pass. Most of the time it was accepted without anything. Only once did we have to talk with a government official about what it was.

We were some of the first American travelers that they had seen since lockdown. I imagine now it’s a more widely known proof of vaccination.

Countries can also independently accept other countries certificates.

Turkey initially procured Chinese vaccine which is not accepted by EU but some EU countries with strong ties to Turkey will accept people who are vaccinated using that vaccine too. Also, Turkey had a certificate system before the EU Green Pass and were accepted by those countries.

These days, in France, you can go to basically any pharmacy and get a CDC card converted into an EU Digital COVID certificate for €36. This certificate is then valid in all EU countries.

Do you have a source for that? Or know anyone who has actually done that? Specifically, persons not resident in FR, or not citizens of FR?

I did it. This is officially supported [1].

[1]https://www.diplomatie.gouv.fr/en/coming-to-france/coronavir...

No Latin American countries except for Panama. Guess they got their papers in order this time.

The EU explicitly wants countries to join. The EU-DCC is designed to be an international system - lots of EU countries already had domestic systems, so we focused the design explicitly on being a state-verified (and managed, and policed) proof of vaccination.

Only States can sign the EU-DCC, and to do so they must meet various standards for security (proper key management, opsec, HSM, crypto strength). They must also agree to accept the EU-DCC of all other member countries, and respect privacy. And police their systems (identity and arrest frauders).

All pretty standard things, and a great complement to the systems used domestically. Having a state provide an abstraction layer of their local issuers is super effective - how can you expect an American state to do quality controle on a Russian pharmacy who are signing a Smart Health Card? They have to invade Russia to police it?

Until recently, I've always thought one of the pillars of western society was that we rarely have to interact with government and be subject to the whims of government bureaucracy. Basically, this is the only way to live with how bad bureaucracy is and how poorly it serves edge cases. Your example - "if you're not in the system you don't exist" is exactly why nobody should be prevented from going about their lives at the whims of government provided data. I actually think this should be a fundamental freedom.

Are passports and visas included in the "whims of government provided data"? It would be an interesting time if the invention of passports was abolished.

Do you usually have to show your passport to eat at a restaurant? If you're American, would you like to see a European system where you have to show your passport at hotels?

If you're American, you must be used to stuff like being required to show your driver's license for admittance to a brewery. I'd call it a draw.

Since I was about 25, I've generally avoided places that ask for my ID - or treat me like a here animal in any other way. Same reason I don't go to Costco/Walmart. The difference is that businesses normally have a choice in how they treat people. For the vaccine rules I've seen, businesses all treat you like a presumed criminal until you prove otherwise. This is not something I would pay for. And as I said, in a free society, businesses and their customers would have a choice, without government interference, and that dynamic would decide what they chose to do.

> For the vaccine rules I've seen, businesses all treat you like a presumed criminal until you prove otherwise

Can't understand for the life of me why people treat COVID hygienic measures like a personal attack. There's a very contagious pathogen around, the basic idea is not transmitting it to others. It's common sense, not a worldwide government conspiracy.

So you've retreated to the "everyone that disagrees with me is a conspiracy theorist" argument?

Thanks for the discussion.

If you disregard that last part, does my comment still feel extremist?

The pharmacies in Germany will issue you a certificate if you ask nicely, with your native vaccination documents and your passport.

Do you have a source for that? Or know anyone who has actually done that? Specifically, persons not resident in DE, or not citizens of DE?

I did that for my friend visiting me in Germany

I was disappointed to not see more discussion of how the certificates could have been falsified. It looks like a pretty elaborate system, hopefully they will be able to revoke only the fraudulent signers and have them stand trial.

This makes it sound as if faking a certificate is some arduous task that one would need to turn to the "dark web" for. Here in the US, the CDC vaccination card can be obtained as a PDF through a quick google search. This can be printed and then filled it out by hand.

You don't use a certificate (QR code) in the US?

Nope, and the way they fill out the card can vary widely from retailer to clinic. My CDC card has stickers for my doses, but handwriting that is barely legible is a very common way for providers to fill out the card.

Yes and no.

The CDC offers a heavy paper card for recording vaccination status. This is the source of truth, as far as I can figure.

Larger medical providers also offer records in digital format that can be loaded into Apple Wallet (and similar) and generate a QR code for ease of use.

Nope. And I was instructed by the (private/for-profit) provider who administered the injection, to fill it out myself, my name and dates. They either hand wrote or stamped the brand and lot of vaccination and the initials for the provider (the business itself). Pretty weird, and certainly not certified, authenticated, verifiable. In fact the provider submitted the wrong dates for both of my vaccinations, which are the dates my state has on file, officially. Something approximating official, is my state's smartphone app, which provides an in-state legally recognized digital driver's license and a variant of the CDC vaccination card (no handwriting, not a copy of my paper one, but using an overlay of text based on the information received form the provider). But this app is recently rendered non-functional on Android (and even when the app worked, it required an internet connection to produce either record, no offline storage and no screenshot allowed when the app is in the foreground, unlike the iOS version of the app).

So hilariously, the closest "certified" copy by virtue of it being generated by my state from their app which has legal sanction, has the wrong dates and I also can't access it anymore anyway.

Most places in the U.S. that request it (concert venues so far the only place I've been asked to produce it) have said they will accept photos of the original in lieu of the paper copy.

It is only due to the weak standards of those asking to see a copy, that this isn't a bigger problem than it sounds. Which then renders the paradigm sort of an exercise im merely following instructions more than it ensures folks aren't attending some kind of COVID party.

Is there any such security analysis of coWIN from India?

Just to share some news from my country: there are increasing numbers of people entering ICU, while having fake certificates. Latest death was of a 27yo "vaccinated".

What country? Also not sure if the answer will be too technical but how do they determine if someone who has a certificate doesn’t really have the vaccine?

The cert should have a date, location, signature, and maybe even a dose identification - all of which can be checked against the database of whomever supposedly administered it.

Please see my sibling comment.

It seems I was overthinking how to verify things and forgot that databases exist. Although I might have assumed that the vaccine certificates are checked as they enter the hospital (at least here in my country).

Also never occurred to me that someone in the ICU will show a certificate or pretend to be vaccinated (at that point what do you get?).

Not sure if I’m missing standard social cues or something more obvious with my questions.

in some countries actual vaccine is used, and all paperwork is in check, you pay 25 euro to the doctor, they squirt the vaccine in the sink and you get a cert

I guess when you end up in ICU, either you or your family members might tell the doctor, especially after getting confusing blood test results.

There are many (thousands?) of criminal cases currently open in Romania for doctors forging certificates for 2-300 Euros - emptying the dose in the sink and issuing a "vaccinated" certificate. So the certificate is totally valid as far as the system goes (but just like Blockchain, depends on real-world trust to actually function).

Wouldn't those death be validated against the actual database of vaccinations, and not the persons vaccination certification?

Depends if he got the certificate through bribing or not

in EU when they check your certificate, if they do it correctly, it IS checked against a database that has your name and date of vaccination. So the schemes to get a certificate include an IRL doctor doing the paperwork and submitting it to the database, and probably discarding your vaccine. In fact, people get this "service" by corrupting their family doctors with no need for darkweb.

Why would you have a fake certificate as getting your first dose, and in most cases, second dose is already possible around the world?

Antivaxxers want to be able to enter places where a QR code is required, but don't want to get vaccinated.

Or they’ve already had it and want the same freedoms as those vaccinated? ONS study on infection/reinfection during the delta period over the summer charts 5 to 8 show previous infection is as good as or in some cases better than the vaccines.

https://www.ons.gov.uk/peoplepopulationandcommunity/healthan...

Sure - but if they really want to go their local bar, you can either expose your computer to dark web to buy a certificate, or just go and get a free shot…

Whilst your comment is factual, I think it doesn’t make sense in the context. The barrier to purchasing a certificate off the dark web is high and require a fair amount of financial and personal conviction / exposure…

You can also bribe a doctor/nurse to "vaccinate" you, no barrier here.

Again, this comment doesn’t make sense in the context either… I responded to the difficulty of conducting a transaction on the dark web - you respond with comparing the dark web to a persona bribe?! I don’t understand why people seem to throw logical debate out the window when it comes to covid… I get that for some people it’s a personal affront, but in my opinion that’s no excuse to just throw logical processing out the window.

My answer explained is: you were right the dark web is a high barrier, because there exist simple ways to overcome the certificate mandate - like bribery.

Why do you say "free shot", while side-effects (short and long term) can't be ruled out on an individual basis.

Neither can be death, hospitalization, or long covid...

According to our government 1/5000 gets a serious myocarditis infection. With two shots thats 1/2500.

Antibodies should be recognized, especially as some people cannot get the vaccine.

I’m not sure I buy this. Who can not get the vaccine but is also trying to access areas that require vaccination? The overlap seems small/non-existent. Do you have examples of cases where this might apply?

Any of the legal medical exemptions.

Is there an official list somewhere? I’ve looked and been unable to find one that contained permanent medical conditions that would prevent all of the available COVID vaccines.

The vaccine is contraindicated for people with my cancer. I have taken it as I was I was in a high risk trial but I’m certainly still alive enough to travel places.

I’m glad you were able to get the vaccine, and I hope you beat cancer. Cancer has taken many loved ones from me.

Those that were infected and recovered from it do have the same freedoms as the vaccinated here in Germany by the way (for half a year after recovery, at least). They can acquire vaccination status with just a single jab during that half year.

Germany makes it deliberately hard (in many cases impossible) to prove that.

People count as recovered if they no longer show any symptoms and have proof of a positive PCR test for Covid that is older than 28 days but not older than six months. This does not sound unreasonable, imo.

"Recovered person" is defined here if you want to look it up: SchAusnahmV §2.4, §2.5 [0].

[0] https://www.bmjv.de/SharedDocs/Gesetzgebungsverfahren/Dokume...

The positive test has to be made in Germany and in most counties of Germany you need a doctor that confirms by signature that you went into quarantine, also in Germany.

According to §2.5 from the legal text [0](it was a draft that I linked to earlier. This is the real thing now), an attestation, in textual or digital form, of a previous SARS-Cov2 infection confirmed via a PCR test or similar test (not antibody-tests!) in German, French, English, Italian or Spanish language is accepted as proof of recovery. It does not include restrictions on where the test was taken.

[0] https://www.gesetze-im-internet.de/schausnahmv/BJNR612800021...

Sir, I like facts and you do facts correctly.

That is federal law which is usually overruled by state law as stated in paragraph 7.

I couldn't find anything pointing to stricter requirements for the "recovered" status anywhere. Do you have an example? If that's too sensitive I would be fine if you name the federal state in which stricter rules are said to be applied? I can look up everything else by myself.

On the one hand, certainly to gain access to areas where non-vaccers actually have no access. But I think that a big motivation is also to feel superior to the authorities, that want to give you the feeling of an unalterable proof of vaccination through cryptography. If a citizen who is critical of the state actions now has the opportunity to deceive them, self-satisfaction will develop.

So they’re teenagers

Basically yes, that's been my impression so far. "No one fucking tells _me_ what to do!". That, or deluded.

First dose is not sufficient for access to restricted activities, and the second dose requires a waiting period of 2-3 weeks AFAIK. Then there's the likely possibility of requiring a third dose (https://www.thetimes.co.uk/article/eu-covid-passes-set-to-ex...), making coordination even more difficult.

Adding to that some people believe (uh oh) that you're also taking on higher risks of life threatening adverse reactions for each subsequent dose.

There is already a requirement of the third dose as in a few countries the certificate of the second dose expires after 9 months.

Many see the censorship as a reason to pause. Some people were injured by the first dose but not in a way that satisfies the bar for a medical exemption. They need to function and don't want to risk more complications.

Other's have prior immunity and don't think the vaccine risk is worth it.

Some research and read articles like this: https://www.ahajournals.org/doi/10.1161/circ.144.suppl_1.107... - "Mrna COVID Vaccines Dramatically Increase Endothelial Inflammatory Markers and ACS Risk as Measured by the PULS Cardiac Test: a Warning" They watch video of healthy soccer players collapsing dead on the pitch. They conclude they are young without comorbidities and it makes them apprehensive.

FWIW if you feel like you're about to drop dead you probably should be worried about already having a comorbidity that will be dangerous if you get Covid. The latter is way more likely than randomly dropping dead.

I'm young, fit and had a heart attack during exercise this year. No real known reason other than the acute problem at the time. I later got vaccinated and then had Covid with no problems.

It's the increased frequency of these players dropping dead. Also, why was all cause mortality higher in the vaccinated cohort in the Pfizer trial? And given this, why was the control group eliminated a third of the way through this study?

> It's the increased frequency of these players dropping dead.

But still far less likely to happen than you having a comorbidity for Covid.

Any proof of this claim?

Yeah it’s trivial, the comorbidities are well known for Covid as well as their incidence per capita. So is the chance of having a heart attack whilst being a footballer or if we want to get more general having a heart attack below the age of 40.

There are far more people with diabetes per capita alone unless you think there is a rash of undiagnosed heart attacks.

For my singular experience I’m a point of interest to every medical professional I meet going through the process of recovery because normal heart attack patients are either old or if they’re my age or younger generally have a genetic condition. That’s how unusual it is.

Pathetic. If you’re going to stand up to the government, stand the fuck up! Don’t hide like a rat.

While your comment is needlessly inflammatory, you're right that this kind of behavior is considered "backwards escape" and is ultimately harmful towards the aims of dissenters. The right way to challenge totalitarianism is to build parallel structures (eg. stop supporting Windows by switching to Mac or Linux).

In this case the flame is necessary, because these people are behaving like cowards, and many of them need to be slapped out of it.

I am similarly annoyed by the "natural immunity" argument. Whether or not natural immunity is as effective as vaccination (it seems to be?), what I care about and oppose is having to prove medical status as part of daily life. As soon as you shift the argument away from "should we have to show a certificate" to "what gets you a certificate" or faking one, you've already conceded that it's ok to have to show one in the first place. It's not OK and I wish we spent more time on that.

This is reminiscent of colonial generals denouncing the ambush tactics of guerillas as cowardly. If they were men, they would fight in the open, etc.

No. Here are your guerilla tactics:

http://www.jointhewhiterose.com/

Hiding will only grant legitimacy to tyrants.

Wahhhhh! I can't impose my fascist lockdown and enslave all of humanity with a fake virus and a fake vaccine from fake doctors and fake politicians.

Fuck this shit.

I say we make the vax pass printer go bRRRRRRRR!!

Better than that you can buy wifi/5g/4g/lte jammers for ~$100 - turn that shit on anywhere where someone is checking digital passes.

If the state is going to declare bio-warfare on the population the population has a duty to respond with electronic warfare.

As long as their price is high and availability low I am kind of supportive of existence of such a market because although I'm supportive of the measures taken by the governments, including the EU Green Pass, I do acknowledge the risks of total control and I'm happy that this marketplace demonstrates that the total control does not exists.

Rebels should exist, no matter how ridiculous or unfair their cause is. Every now and then, rebels have a point and when they don't have a point they still develop methods to rebel and keep the door open.

Some would be quick to claim a failure for the EU Green Pass system but I think that it's a huge success. The most traditional and barbaric infectious decease prevention method, the lockdowns and border controls, are quite manageable with this solution.

I have been to Bulgaria recently. For context, Bulgaria hase vaccination rates in the low 20s despite the vide availability of all kind of the EU approved vaccines and you can see that the spread delivers similar death per infection rates as the previous waves. Bulgaria currently employs lockdowns to tackle the spread and Green Pass proves to make life and business easier than the previous lockdowns because the lockdowns don't need to be as severe.

Reply on news.ycombinator.com