Hacker News Reader

Comment by Quigglez | Hacker News Reader

I want to make sure we're talking about the same thing. When I hear people say "vaccine passport" I assume they mean "COVID-19 vaccination documentation". Is that a correct interpretation, or does a vaccine passport mean something more? If it is just "COVID-19 vaccination documentation", has there been a push to not allow the paper documentation? I've been primarily using my paper documentation without issue. As far as I'm aware, digital access to your vaccination status is simply a nice to have redundancy.

View on HN

I need to lead this with "I'm fully vaccinated and pro-vaccine" so nobody gets the wrong idea (I'm disappointed that this is the state of discourse) BUT...

Anyone can print a piece of paper. If vaccination requirements are going to have any teeth whatsoever, they will need to be much more invasive. A central database is the minimum. You'll need holographic cards with your picture, like driver's licenses. Spot checks on restaurants to ensure they're checking ids properly, and serious consequences for failure - you'll need a license to serve food, and the FABC (food and alcoholic beverage control) board will be able to fine you or revoke it.

Basically, you'll need to treat almost all of public society the way we treat alcoholic beverage sales.

I personally find that terrifying and would rather see covid run rampant.

Anyone can print a piece of paper, but it’s also amazing how much a small obstacle can affect people’s behavior.

So yes, to get 100% compliance you would need the measures you outline, but who says that’s the goal?

The vaccination certificate in the EU has a QR code that can be cryptographically verified to have been issued by a legit authority, tells why the certificate has been issued (e.g. vaccination, negative test, etc), and embeds the name of the person such that their identity can be cross-checked against some form of official ID.

So there's no need for anything more complex than a piece of paper you can download + print. What you can't do is make a QR code of your own, change the validity reason of an existing code, or use somebody else's certificate with your own identity.

You still need the enforcement regime. Restaurants/bars/etc must have someone at the door scanning everyone's QR code (and cross checking it against a photo ID). Law enforcement must run stings against restaurants to ensure they're checking properly.

It's gross.

Restaurants can have the ID check done by the waiter when taking the order. There is very little overhead, certainly no need to employ an extra person to check papers at the door. I doubt any law enforcement is running random stings. They would probably wait for members of the public to report this first.

I don't think checking IDs is gross, and obviously if you do, there is nothing I could say to change your mind. But it doesn't change the fact that Covid passports are easily implementable with paper, there is no need for the to be "holographic picture ID".

I certainly wouldn't want to go to a restaurant which checks my ID.

We're heading to a state of affairs where you can't move in public anonymously. This is a dystopian nightmare.

You seem to have latched on to the least important part of what I've said. Yes, a centralized database combined with always-on internet access can suffice instead of holographic cards (in the same way that nowadays, police officers don't really need to look at your drivers license - they can just look you up from their car), but that's strictly worse from a privacy/dystopia perspective. And it does not work at all for offline dining.

Holographic cards would actually be better since it doesn't notify a central authority where and when everyone dines. You seem to be comfortable with the idea that "party of 6" sits down, and the waiter spends the next 5 minutes screwing with his phone scanning everyone's (printed?) QR codes and verifying faces. I would rather get covid.

Here in the US, ABC boards do in fact run stings on bars and restaurants to make sure they are checking ids. And yes history has shown that it is absolutely necessary if you want compliance.

There is no need for a centralized database or always on internet access. How did my description suggest that either would be needed? As the verifiee, you need to print a piece of paper and have an ID. As the verifier, you need an offline app. No central authority is notified of the scan. None of this is rocket science, it is basic public key cryptography.

It does not take 5 minutes either. In practice it takes about 5 seconds to scan and validate the cert.

You have built an elaborate fantasy of how bad the system would be, rather than look at how the systems deployed for half a billion people actually work. Literally none of your stated fears actually bears out in practice. Suggesting you'd rather just get Covid is just depraved.

OK, I'll concede that PK cryptography can be used to eliminate the online requirement given that you don't need a revocation mechanism. You're still going to need active measures to ensure restaurant compliance. And signing these without a centralized database at the signing authority? Theoretically possible, practically impossible.

Tell me, where is it that these systems are working for half a billion people?

I'm guessing this is somewhere with a vastly different cultural landscape than the US. Depraved or not, I still value what little anonymity I have left.

This is how the EU (and some associated countries) have it set up. One obviously would like to centralize the signing just so for some basic auditing and to limit the number of public keys that get installed. But that just means a central signing service, it does not need to have persistent storage in said central location. In practice having the generated certs in a central DB is very useful for the users though, since it makes it trivial to install the certs on a new phone etc.

Reply on news.ycombinator.com