[HN Gopher] I faked tons of Covid passes - "Weak Key Cryptograph...
___________________________________________________________________
I faked tons of Covid passes - "Weak Key Cryptography in real
world"
Author : jtaft
Score : 135 points
Date : 2021-11-26 17:32 UTC (5 hours ago)
(HTM) web link (ctrsec.io)
(TXT) w3m dump (ctrsec.io)
| acqbu wrote:
| Well done, great job!
| muterad_murilax wrote:
| Anyone knows if this is applicable to Covid passes used in the
| European Union as well?
| est31 wrote:
| From this [0] list it seems there are a bunch of RSA root
| certificates, but they all use RSA 2048 or 4096, both of which
| are still secure (with 4096 having diminishing returns compared
| to RSA 2048 [1]).
|
| The article was about RSA 512 which has been known to be weak
| and crackable for a long time [2].
|
| [0]: https://github.com/eu-digital-green-certificates/dgc-
| partici...
|
| [1]: https://www.gnupg.org/faq/gnupg-
| faq.html#no_default_of_rsa40...
|
| [2]: https://it.slashdot.org/story/99/08/29/0213230/512-bit-
| rsa-k...
| threeseed wrote:
| EU is in discussions right now to expire COVID passes unless
| you have had recent vaccines i.e. booster shots. Which means
| any security mechanism that is defeated will just be fixed
| every 9 months.
|
| Seems like a lot of hassle for a vaccine that is safe and will
| save your life.
| jinpa_zangpo wrote:
| The private keys for the European Green Pass have been leaked
| and fake passes signed with the keys are being sold on the dark
| web.
|
| https://threatpost.com/eus-green-pass-vaccination-id-private...
| CorrectHorseBat wrote:
| >UPDATE: French & Polish authorities found no sign of
| cryptographic compromise in the leak of the private key used
| to sign the vaccine passports and to create fake passes for
| Mickey Mouse and Adolf Hitler, et al.
|
| Afaik it was a leaked login, not a leak of the keys.
| jokethrowaway wrote:
| Shouldn't they have a record of all the things they signed?
|
| I would expect them to know where and when that Adolf pass
| was generated
| radicalbyte wrote:
| The private keys were _NOT_ leaked.
|
| There have been fraudulently obtained passes sold on the dark
| web. There have also been numerous arrests throughout the
| whole of Europe for this.
|
| The vast majority of the dark-web suppliers are scammers -
| many of the adverts include a mix of QRs people have posted
| to social media and a large number of example QR. Including
| examples that I have generated in the past and used in
| presentations / on github.
| d0gsg0w00f wrote:
| Why not just charge the unvaccinated with attempted
| manslaughter or reckless endangerment and put them all in
| jail? /s
| lucb1e wrote:
| Ah yes, repeat the evil dark web narrative. As if a VPS in
| Russia would get you into trouble. Criminals will be
| criminals, also if tor etc. wouldn't exist and non-criminals
| wouldn't get to be anonymous, too.
| jeroenhd wrote:
| The keys were not leaked but the web interfaces that allowed
| generation of these certificates was left open and
| accessible.
|
| Passes have been sold (through the clear web and the dark
| web) but many have also been revoked since. As far as I know,
| the certificates being sold right now are either someone
| else's certificate (for places that don't check your ID when
| you walk in) and certificates generated by people working for
| places that also give out legitimate certificates, such as
| some pharmacies and hospitals.
| stavros wrote:
| They haven't been revoked yet?
| acqbu wrote:
| Some have, but not all... yet.
| gaius_baltar wrote:
| Random question, but related: Like this example, I see lots of
| other applications that require a QR code storing binary data and
| chose to encoded this data as Base64 (or others) and then add it
| to a ASCII-only QR code format. Why don't they use a binary-mode
| QR code? Compatibility?
| zirror wrote:
| The EU's Digital Green Certificate [1] uses Base45, which I
| think they basically invented. They do this because "even in
| Byte mode a typical QR-code reader tries to interpret a byte
| sequence as a UTF-8 or ISO/IEC 8859-1 encoded text."[2] They
| use the 45 chars allowed by the alphanumeric-mode IIRC.
|
| [1]: https://github.com/eu-digital-green-certificates/dgc-
| overvie...
|
| [2]: https://datatracker.ietf.org/doc/draft-faltstrom-base45/
| TechBro8615 wrote:
| The most common reason is probably because it's easier to
| develop, debug and test code that outputs ASCII strings rather
| than binary blobs.
| gnabgib wrote:
| It's a weird situation, but it's very obvious with HC1 and SHC
| cards.
|
| It starts with JWT. JSON is a human readable format (in utf-8),
| if humans don't need to read, the data could be binary, and the
| format could be exact. JSON isn't an exact spec, which is
| mostly inherited from JavaScript (there's no such thing as an
| integer only floating point, so 1e3==1000==1000.0==1.00e3 in
| human-readable form, as a stored number they are identical).
| Then there's differences in white-space (new lines,
| indentation) - although this could likely be overcome with
| convention. Because of this the JWT creators said instead of
| signing the data, we'll sign the exact representation in the
| payload - but of course with white-space and formatting
| variance (including a deserialize/serialize loops changing
| representations, or - in the case of bearer tokens, the HTTP
| spec allowing newlines/white space to be inserted at the
| protocol level) they had to encode it as non-human readable
| (base64). Now everyone agrees you're signing that exact Base64
| representation of the JSON object. But! We've build a(n
| arguably verbose) human readable format that isn't readable by
| humans.
|
| The SHC spec (common in North America) actually holds a JWT
| that's signed by an elliptic curve private key. You can
| validate the signature with a public key. The public/private
| choice here is great, the JWT is terrible.. they've doubled
| down on the mistakes. Further to keep the QR smallish, they
| zipped the payload portion (which is supported by JWT - this is
| done before the base64 stage), and use only the minimum QR
| resilience setting (which is fine if it's on a screen, if it's
| printed this may lead to reading problems). Now we have human
| readable (JSON) compressed in machine readable (deflate) in
| machine readable (base 64) in machine readable (QR) - for
| machine reading purposes. They didn't even trim the fluff
| (every SHC begins with 56 because.. you guessed it, the `{`
| character), or use sensible choices (they don't use
| IssuedAt/iat, but NotBefore/nbf to indicate the generation
| date). Anyway, SHC (reasonably) noticed because of the (mostly)
| base64 encoding the character set is only 64 characters (6
| bits) which doesn't use the ASCII space (7 bits) very well, so
| they store the first 'shc://' in ASCII and the rest is a number
| (there are three modes in QR: ASCII, binary, numeric - the
| density loosely matches binary representations - a numeric
| digit (0-9) takes 4 bits, ascii char takes 7 and binary takes
| 8).
|
| ASCII doesn't support the world very well, UTF8 isn't supported
| by QR (except as binary).
|
| In the SHC case, because it's signing a specific format/output
| of the JSON data, it doesn't have the white-space formatting
| concerns that JWTs have to overcome. If they wanted to stick
| with a JWT like format (JSON object), they could have skipped
| the base64 before sign step, at which point they might as well
| get rid of the header (we're no longer to JWT spec), deflate
| the message to be signed, and put the signature after the
| deflated message. All the same data, less of the overhead, and
| better use of the binary space.
| ipython wrote:
| It doesn't make any sense to me why they gzipped the data.
| I've looked at a few real world DGCs and the "compressed"
| output was actually larger than the original data! Just adds
| more complexity for no purpose...
| sgtnoodle wrote:
| Perhaps so that generic QR code scanners can parse it and then
| know to forward it along to the appropriate app?
| dmurray wrote:
| Almost always technical incompetence, I think.
|
| At some level "compatibility" is correct. System 1 outputs
| binary data, system 2 takes that and turns it into JSON, system
| 3 encodes that in base64, system 4 turns that into QR codes,
| and system 4 was what was mandated for producing all of the
| organisation's QR codes.
| umurkontaci wrote:
| > The reason for representing Health Cards using Numeric Mode
| QRs instead of Binary Mode (Latin-1) QRs is information
| density: with Numeric Mode, 20% more data can fit in a given
| QR, vs Binary Mode. This is because the JWS character set
| conveys only log_2(65) bits per character (~6 bits); binary
| encoding requires log_2(256) bits per character (8 bits), which
| means ~2 wasted bits per character
|
| https://spec.smarthealth.cards/#encoding-chunks-as-qr-codes
| johnchristopher wrote:
| > Although the code was provided, we took around 2 days to get
| this running since the code was written back in 2015. Some
| libraries are not currently supported forced us to make several
| changes on the code. The project was then running smoothly.
|
| Why not use a VM with older libraries and tools ?
| fouc wrote:
| Looks like the source code is meant for Amazon's EC2, so it was
| depending on the python/libraries on the EC2 back then, 5-6
| years ago.
| johnchristopher wrote:
| Doh, of course. Thanks :).
| yissp wrote:
| I remember here in Canada there were concerns about this sort of
| thing when rolling out our proof-of-vaccination system, but
| practically speaking, the number of people with both the
| technical understanding and inclination to do this is surely too
| small to have a meaningful impact on COVID spread.
| sushsjsuauahab wrote:
| It seems that actually nothing has had a meaningful impact on
| coronavirus spread.
| JumpCrisscross wrote:
| > _seems...nothing has had a meaningful impact on coronavirus
| spread_
|
| Not sure if trolling, but in case not, vaccination has had "a
| substantial impact on mitigating COVID-19 outbreaks" in
| America [1].
|
| [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7709178/
| twofornone wrote:
| That paper is purely based on a model with [optimistic]
| assumed effectiveness and transmission parameters. It does
| not consider any actual infection statistics to come to its
| conclusion.
|
| I'd love to see a paper explaining why some two months ago
| cases were already at or approaching record highs in
| countries with 70-90% vaccination rates, like UK, Israel,
| multiple EU nations...Gibraltar is particularly interesting
| because it has a nearly 100% vaccination rate, yet the case
| rate continues to climb unabated. [0]
|
| People are treating these vaccines as though they were
| sacrosanct and unquestionable. Meanwhile the pandemic
| continues nearly unabated and no, this is not a "pandemic
| among the vaccinated", despite the fervor with which
| certain interests have attempted to paint such a picture.
| Public UK data suggests that vaccinated individuals may
| actually be _more_ likely to be infected some months after
| their second doses. But no one is talking about that...
|
| 0. https://www.worldometers.info/coronavirus/country/gibral
| tar/
|
| 1. https://vladtepesblog.com/2021/10/10/is-this-ade-uk-
| data-sho... - yes, it's a blog, but it links to the data
| for you to review yourself. Check the last two columns of
| the chart on page 13.
|
| This wouldn't be the first time that humans failed to solve
| a complex problem, I don't see why its so difficult for
| people to accept this possibility.
| jschwartzi wrote:
| In my state the vaccination rate is above 70% and the
| hospitalization rate has decoupled from the positive
| rate. The spike this winter ended in October whereas last
| winter it didn't end until January. We've been on a
| downward trend even with shows and restaurants open and
| people having parties. So I would cite that as evidence
| the vaccine is protecting our population.
| twofornone wrote:
| Or perhaps people are acquiring immunity through contact
| since the majority of cases have been known to be mild or
| asymptomatic since the pandemic started? And/or the virus
| is mutating into less infectious substrains?
|
| Cold/flu viruses come and go. This virus will do the
| same. People will see it as evidence that the vaccines
| worked when in reality the pandemic very likely would
| have ended without them, yet here we are facing
| mandates...
| d0gsg0w00f wrote:
| Right, and this is why I have a problem with employer
| enforced mandates even though I'm vaccinated. The
| government taking away your right to work and support
| yourself based on some pretty flimsy data about the
| public good for something that should be a personal
| decision. Fact is, the vaccinated really shouldn't be
| losing much sleep over the unvaccinated other than maybe
| those dirty people might be taking up an ICU bed when I
| need one.
|
| Ok fine, you want to enforce this: then just man up and
| imprison the unvaccinated using force. Don't hide behind
| employers and make them do your dirty work. Taking away a
| person's right to work is only 2 degrees separated from
| making them dependent on the state. It's a fear tactic
| they're hoping they won't ever have to enforce--not that
| much different than holding a gun to someone's head.
|
| At the end of the day you're never going to be able make
| someone do something against their will. People who go
| against the mainstream will already suffer social
| consequences. If you have to do something with government
| resources then beef up the ICU beds .
|
| While you're at it you may as well make it illegal to
| work if you're a smoker, or obese, or if you've ever had
| a car accident because those things may lead to eating up
| an ICU bed for some other person that stands on a higher
| moral ground.
| cik2e wrote:
| I like this site for COVID data: https://covidactnow.org/
|
| At a glance, infection rates and vaccination rates seem to
| be uncorrelated at best.
| boc wrote:
| Current vaccines are non-sterilizing and therefore do not
| effectively stop the spread/transmission of SARS-CoV-2
| (the virus) but is very effective at preventing the
| disease the virus causes (COVID-19). Initially the
| vaccines were able to keep viral loads low enough to
| meaningfully stop the spread, but the Delta variant
| resulting in far higher viral loads and removed that
| advantage compared to the original virus.
|
| Arguing that the infection rates are uncorrelated is one
| thing, but serious illness and death is what we really
| need to care about with this virus. And for those
| metrics, vaccination is highly-correlated to better
| outcomes.
| maigret wrote:
| That's a common error, reused by antivaxxers. They are
| indeed because even what we consider relatively high
| infection levels are just enough to get 15-20% of the
| population infected per year. This is less than the part
| of unvaccinated people. That's why having a very high
| vaccination rate is critical to kill COVID. Above this
| threshold you'd see the infection rate affected. Still,
| vaccinations are good strategies because they still
| reduce infections, or at least severe forms of it.
| Without it in many countries would have been totally
| saturated by Delta.
| sgtnoodle wrote:
| The link you provided describes a simulation based on
| assumed vaccine effectiveness. It's also from 1 year ago.
| It doesn't seem to reflect any statistically backed
| insights into what's actually happened over the past year.
| Or am I missing something?
| galaxyLogic wrote:
| According to the following graph deaths per 100,000
| people are: 18 for unvaccinated 3 for vaccinated. at the
| peak of the graph between July and October 2021.
|
| Doesn't that tell us that vaccinations help to
| significantly reduce Covid-deaths?
|
| https://ourworldindata.org/grapher/united-states-rates-
| of-co...
| DenisM wrote:
| Reduce deaths? yes. But it tells us nothing about
| reducing spread.
| sgtnoodle wrote:
| Trying to find some actual data, I googled "covid deaths
| by month" and I stumbled upon this:
| https://www.worldometers.info/coronavirus/coronavirus-
| death-...
|
| Notably, the "Growth Factor" plot looks qualitatively
| very similar from April 2020 until now. Before then, the
| data looks more noisy to me but not necessarily different
| on average. I believe folk started getting vaccinated in
| December 2020? Based on that plot, it doesn't look like
| the vaccine is helping much for the death rate. Maybe
| that data source is not legitimate, or maybe "growth
| factor" isn't the right metric to look at?
| bonzini wrote:
| The current virus has a natural growth factor that is
| about 3x larger than the OG. So vaccines are at least 66%
| effective if they are keeping it at bay. Probably more
| since lots of countries have very low restrictions
| compared to last year.
| Ambolia wrote:
| "Covid deaths" are also a very meaningless metric where
| every country or region does whatever it wants. Excess
| deaths would be a better metric, but also hard to remove
| from there all the damage done by lockdowns, stress
| generated on the population, and by hospitals stopping
| attending other diseases in some places.
| sgtnoodle wrote:
| So what's the right available metric to look at that
| statistically quantifies the effectiveness of the
| vaccines? Or does one not exist?
| Ambolia wrote:
| Control groups. But most countries and trials seem
| decided to get rid of them as fast as possible.
| ziml77 wrote:
| Why would you remove the excess deaths caused by
| hospitals not being able to handle non-COVID illnesses
| due to taking care of COVID patients?
| Ambolia wrote:
| Because those are dependent on the response to the
| disease, not the disease itself.
| smnrchrds wrote:
| The current standard all provinces have switched to uses
| "Elliptic Curve keys using the P-256 curve", does it not?
|
| https://spec.smarthealth.cards/
| satellite2 wrote:
| I think the concern were most regarding key theft than a
| cryptographic attack.
| Tyr42 wrote:
| No one has actually scanned my QR code so far, only scrolled
| down to see it say "two doses". So it doesn't matter.
| defaultname wrote:
| The QR-code based solutions, using elliptic curve asymmetric
| cryptography, aren't breakable by anyone at present (maybe
| someone has some monster quantum computer and they could, but
| they wouldn't be making fake vaccination certificates). The
| private keys could be stolen or misused of course, but there
| are very well proven solutions to that given how much of the
| industry relies upon asymmetric encryption and signing.
|
| Originally the certificates were simple "yeah, they are
| vaccinated" PDFs that people would alter, which was a pretty
| low bar.
|
| In discussions like this I think we really need to frame this
| in the proper context. We're talking about a certificate saying
| that you did something that you could do for _free_ , which has
| significant personal benefits, and even greater social
| benefits, and that a large majority of the public is entirely
| behind. Making a fake vaccination certificate is like making a
| fake Grade school graduation certificate -- if someone is at
| that point in their life, something has gone seriously wrong.
|
| The demand for certificates was just trying to entice the small
| percentage of holdouts, and of those surely there will be some
| who will go to great lengths, including committing pretty
| significant crimes, to avoid it. That pathology can't be fixed
| easily.
| jeroenhd wrote:
| The problem is that the people that are a) evil enough and b)
| technical enough to understand this will sell COVID passes for
| hundreds of dollars each.
|
| Here in the NL there have been tons of people that sold COVID
| passes, some working at vaccination places, others working at
| testing places. Instead of hacking anything, they've just been
| committing regular fraud. The street value of these passes
| seems to be round EUR300 to EUR500. The government has been
| blacklisting these passes ever since they were first spotted,
| leaving many of their "customers" angry now that they can no
| longer fraud their way through the necessary checks.
|
| The problem is not so much a technical one, as modern crypto is
| quite unbreakable. The pass in the article is based on RSA-512,
| which has been proven to be breakable all the way back in 1999.
| With elliptic curve cryptography the system can still remain
| unbreakable even with shorter keys that can fit into a small QR
| code, though space is rarely a problem with these codes anyway.
| TylerLives wrote:
| How did the government recognize the fake passes? Just asking
| so I can alert my government if I see them somewhere.
| jeroenhd wrote:
| You can't tell from the signature itself, but one big group
| of people got caught with a vaccination record entered into
| the system from a company that exclusively takes tests.
|
| I don't know the exact methodology the government uses to
| catch fraudsters, but from someone who just scans the
| certificates there's no way to find a fake record.
|
| That is, a fake record that matches the person's ID card
| details. Here in the NL, that's your initials and your
| partial birthday. Most abuse is people using other people's
| certificates, which can trivially be caught by checking the
| necessary identification, as you're told to by the scanning
| app anyway.
| [deleted]
| jgeralnik wrote:
| The author went out of their way to hide the factors of N,
| presumably so that nobody else would actually be able to generate
| signed certificates. However, they did this by hiding half the
| digits of the factors.
|
| Revealing so many digits of the factors actually allows easily
| factoring the original number using a version of coppersmith's
| method (easy as in under a second on my laptop instead of the 9
| hours on a distributed cluster the authors used). This is
| actually a pretty classic CTF exercise.
|
| If I'm still nerdsniped by this tomorrow I'll try my hand at
| implementing this and factoring the number myself
| coolso wrote:
| Good! Keep it up. Let things be, enough of this vaccine pass
| comrade BS.
|
| We who are vaccinated should be at peace and trust this vaccine
| will reduce the likelihood of severe illness. Those who aren't, I
| wish them the best, but that's their choice.
|
| Hopefully this will finally encourage smokers to quit and the
| obese to cut out a few sodas per day.
| 0xTJ wrote:
| Choosing not to be vaccinated is a harm to society. Being
| vaccinated isn't just about protecting yourself. It is people's
| choice not to be vaccinated, and they're responsible for the
| consequences of that choice, including not being allowed in
| spaces where they're a hazard to others.
| jokethrowaway wrote:
| That's a ridiculous narrative for covid where vaccinated
| people are marginally less contagious than unvaccinated
| people.
|
| The main benefit of the covid vaccine is reducing symptoms
| when you get covid and reducing hospitalisations.
|
| If you are worried about getting covid, vaccinate yourself.
| That's it, you don't need anyone else to be vaccinated.
| barbazoo wrote:
| > That's a ridiculous narrative for covid where vaccinated
| people are marginally less contagious than unvaccinated
| people.
|
| Almost two years in and people still don't understand that
| there is a difference in severity of an infection. When
| vaccinated, you are much less likely to develop severe
| symptoms and very unlikely to have to get hospitalized.
| threeseed wrote:
| "immunisation with either the Pfizer or AstraZeneca vaccine
| reduced the chance of onward virus transmission by 40-60%"
| [1]
|
| That is not marginally less and which is why people should
| be vaccinated. Also unvaccinated people place significant
| strain on the hospital system preventing elective surgery
| and increasing my costs as a taxpayer.
|
| [1] https://khub.net/documents/135939561/390853656/Impact+o
| f+vac...
| _dain_ wrote:
| > "immunisation with either the Pfizer or AstraZeneca
| vaccine reduced the chance of onward virus transmission
| by 40-60%" [1]
|
| so why are there still soaring case rates in the
| countries with the most vaccines? I'll trust my lying
| eyes, thank you.
|
| it's honestly insulting that you can post some pissant
| "study" like this and expect to be taken seriously when
| anyone can just look at the case rates and vax rates by
| country and see that it's obviously wrong.
| threeseed wrote:
| a) There are still soaring case rates because vaccination
| rates are not 100% and you have waning immunity. People
| who are dying are the ones who are unvaccinated. But you
| will still get breakthrough cases which nobody has ever
| denied will happen.
|
| b) If you some independent study which proves your
| statement that vaccines only "marginally" affect
| transmission then please post it.
| _dain_ wrote:
| https://eugyppius.substack.com/p/ukhsa-vaccine-
| surveillance-...
|
| case rates are as high or higher among the vaxxed in
| every age group that matters.
|
| as for 100% vaxx rates as our way into the promised land:
| a) lmao and b) this is unfalsifiable. we could get up to
| 99.9% vaxx rates and corona fanatics like you would still
| say it's the intransigent 0.01% holdout are keeping us
| from crossing the finish line. you are just like every
| other ideological zealot who dismisses the empirical
| failures of their ideas (nazism, communism, etc) by
| saying all those real life examples weren't really the
| True Ism, and that we would have immanentized the
| eschaton already if not for all those pesky people with
| their free will.
|
| not to mention there are stable wild animal reservoirs of
| the virus and those are never going away.
|
| again, you haven't made any coherent argument as to why I
| can't just look at the case rates by country and compare
| them to vaxx rates and draw the obvious conclusion. am I
| not allowed to say the sky is blue without a peer
| reviewed study?
| wott wrote:
| > so why are there still soaring case rates in the
| countries with the most vaccines?
|
| Vaccinated people are not submitted to the same
| constraints (such as mandatory tests for accessing this
| and that) so carry the virus in more places favourable
| for transmission. They also don't worry as much about
| getting the virus (at the same time rightfully so and not
| rightfully so), so they give up on taking the precautions
| they took the previous year, and they also do not take a
| test when symptoms arise but remain light. All this
| unfortunately compensate for the fact that, individually,
| they are less subjected to spreading the virus.
|
| Over here, when a vaccinated person tests positive, their
| pass is not even revoked :-/ Also, in order to promote
| vaccination, tests which were free have been made paying
| for non-vaccinated people; so as a perverse result, non-
| vaccinated people now test less, thus spread more too.
|
| Basically, the current attitude (both individual and
| official) seem to imply that it does not matter any more
| to care about spreading the virus, so long as you are
| relatively/fairly protected against the consequences. I
| don't think this is going to turn well, but...
| _dain_ wrote:
| >Vaccinated people are not submitted to the same
| constraints (such as mandatory tests for accessing this
| and that) so carry the virus in more places favourable
| for transmission. They also don't worry as much about
| getting the virus (at the same time rightfully so and not
| rightfully so), so they give up on taking the precautions
| they took the previous year, and they also do not take a
| test when symptoms arise but remain light. All this
| unfortunately compensate for the fact that, individually,
| they are less subjected to spreading the virus.
|
| this is complete conjecture and moreover the conditions
| vary by place. for my part (in england) there are no
| meaningful restrictions on anyone whatsoever, so this
| can't be the explanation. I've also heard completely
| opposing theories, that the _un_vaccinated aren't worried
| about getting the virus so they don't get tested. you can
| spin any theory you want. nobody knows shit.
|
| (by the way, england currently has the lowest case rates
| out of the four UK countries + ROI, despite those other
| jurisdictions having coronapass regimes of varying
| strictness)
| _dain_ wrote:
| No, stripping unvaccinated people of their fundamental
| freedoms (as happened in countries like Lithuania and
| Austria) is a harm to society. More than harm, it's a
| complete disintegration.
| pawelmurias wrote:
| How is locking down only the anti-vax retards any worse
| then locking down everyone?
| _dain_ wrote:
| "how is shooting one person worse than shooting two
| people?"
|
| how about we don't shoot anyone.
| bonzini wrote:
| If you have the magic recipe for curing everyone that
| gets sick, I am all for it.
|
| Because metaphorically "not shooting anyone" does not
| equate to not having a lockdown, if that results in
| hundreds of literal deaths every day.
| _dain_ wrote:
| hundreds!
|
| my god there isn't a jak soy enough for you
| dvt wrote:
| > Good! Keep it up. Let things be, enough of this vaccine pass
| comrade BS.
|
| You're going to get heavily downvoted, but I totally agree. The
| vaccine pass is a complete farce. I even have non-technical
| friends that have faked vaccine passes. For someone even
| remotely technical, it's trivial to Photoshop.
|
| If only we had the same fervor when it comes to demonizing
| weight gain, we could save 10x more lives.
| threeseed wrote:
| 5+ million people have died from COVID.
|
| Despite having most of the world being under lockdown as well
| as increasing vaccination. Without those measures it could
| easily have been hundreds of millions.
|
| It is ridiculous and baseless to compare it to obesity which
| is not causing any significant strain on the hospital system
| like COVID is.
| dvt wrote:
| > It is ridiculous and baseless to compare it to obesity
| which is not causing any significant strain on the hospital
| system like COVID is.
|
| Wrong[1][2][3][4]. I get that it may not be politically
| convenient for you, but let's not mince words: obesity is
| killing many more people than COVID ever did or ever will.
|
| [1] https://www.cardinalhealth.com/en/essential-
| insights/obesity....
|
| [2] https://www.npr.org/templates/story/story.php?storyId=1
| 11302...
|
| [3] https://www.the-
| hospitalist.org/hospitalist/article/123191/o...
|
| [4]
| https://www.theguardian.com/society/2018/apr/04/obesity-
| putt...
| asddubs wrote:
| weight gain isn't contagious
| dvt wrote:
| Actually, it _is_ , as it tends to be intergenerational[1].
| Parents that don't care about their health will raise kids
| that don't care about their health.
|
| [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5305001/
| coolso wrote:
| Furthermore, even outside of an immediate family, the
| more overweight people are, the more socially acceptable
| it becomes, resulting in more obesity.
|
| There's also the massive costs to our healthcare system
| and insurance premiums.
| threeseed wrote:
| And yet obesity whilst being a problem for decades has
| not caused an epidemic of obese people.
|
| Why is that ? Because obesity is not contagious and most
| people don't make decisions about what they eat and their
| activity levels based on choices other people make.
| dvt wrote:
| > And yet obesity whilst being a problem for decades has
| not caused an epidemic of obese people.
|
| Really? Over _40%_ of US adults being obese[1] is not an
| epidemic?
|
| [1] https://www.cdc.gov/obesity/data/adult.html
| Scharkenberg wrote:
| That's not what contagious means.
| dvt wrote:
| Wrong:
| https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5124998/
| (also see footnote 1).
| _dain_ wrote:
| no but it's aesthetically disgusting
| threeseed wrote:
| Please post photos of yourself.
|
| Would help us to put in context what aesthetic perfection
| looks like.
| _dain_ wrote:
| only if you post evidence of your possessing qualia (I
| have severe doubts)
| vetinari wrote:
| While I agree with you in principle, in this specific case
| smokers have an advantage; it is harder for them to get covid.
| So here it is not exactly motivating to stop smoking.
| jml78 wrote:
| That was the case with alpha but delta viral load blew that
| out of the water.
| dzhiurgis wrote:
| Offline first seems such an oversight from contact tracing
| perspective.
|
| Also NFC tags could've been better solution, but probably
| would've sent too much Bill Gates vibes.
| jsiepkes wrote:
| > we found all hard-coded Public keys were using RSA 512
|
| > Next, the data was hashed using a custom hashing algorithm
| developed by lachongtech.
|
| Yeahhhh.....soooo.......
| questiondev wrote:
| does not surprise me, in the future there will only be two
| governments in the world, polarization will become the norm. each
| party will think they are right. it will be an umbrella me echo
| chamber. but it will only exist online. it will manifest in real
| life but people who dare or who are brave enough to understand
| someone outside of their comfort zone will quickly realize that
| we are not 1's and 0's within a machine.
| pier25 wrote:
| Here in Mexico the gov issued vaccination certificates always
| have errors.
|
| People have resorted to downloading the PDF and "hacking it"
| (editing it in Acrobat).
|
| Nobody ever actually checks whether the certificate is valid or
| not.
| galaxyLogic wrote:
| I think most people who are smart enough to fake the
| certificate are smart enough to get vaccinated.
|
| What do you win by using a fake certificate vs. getting
| protected by the vaccine?
| golemiprague wrote:
| I know many educated and smart people who are anti vaccine,
| including doctors, some of them got fake certificates and
| that is in a modern western country. Nobody is checking it
| properly, they just see the green colour and let you in,
| nobody even compare the name to some ID. So the benefit is to
| get into places they couldn't get into without the vaccine.
| pawelmurias wrote:
| You can sell fake ones to retards who are scared of the
| vaccine. Some might be stupid enough to pay good money for
| it.
| airesearcher wrote:
| Physical Covid certificates are also not secure at all.
|
| They are easy to copy or fake.
|
| Any scheme which simply puts a cryptographic number on a some
| Physical card - or behind a regular QR is not secure. A simple
| photocopy will work just as well as the original. Not to mention
| Photoshop.
|
| But there is actually a new way to make physical things - like
| printed Covid vaccination cards - provably unique and authentic.
|
| Much more powerful than holograms and also much more secure,
| unclonable and authenticatable.
|
| Take a look at Blocktag (blocktag dot com) - Next gen QR codes
| that anyone can print, yet cannot be counterfeited. And of course
| linked to blockchain and ready for physical NFTs too.
| heinrich5991 wrote:
| The QR codes in Germany include your name and a digital
| signature. You can photocopy them, but the photocopy doesn't
| work for another person (if the venues would actually ask for
| your ID).
| slownews45 wrote:
| Short version if they get taken down:
|
| The validation apps used a 512 bit RSA public key.
|
| They used a factoring app and spend $200 on amazon to factor the
| private key from the public key.
|
| They were then able to generate the COVID passes.
|
| This is for the Honai Police Dept.
| differentView wrote:
| >This is for the Honai Police Dept.
|
| *Hanoi
| akomtu wrote:
| Why would anyone use RSA when we have X25519?
| stonewareslord wrote:
| The real question is why use 512 bit RSA when you can use
| 2048+?
| Spooky23 wrote:
| My guess is Vietnam's spec was to achieve the same level of
| integrity as a paper document (ie. Minimal) and optimize
| for cheap/poor quality cameras.
|
| Longer keylengths make it difficult to deliver sufficient
| payload in a QR. not sure about EU, but the SMART health
| passes that are the emerging standard use ES256 signatures.
|
| The lack of global leadership for interoperable standards
| early on made this more difficult. You had the EU, Israel,
| US states and others who were ahead of the curve, but that
| approach had limits that were reached.
|
| Now in the US we also have the issue of dealing with states
| with wacky political stances. States like California, New
| York and Louisiana, combined with private sector leaders
| like Walmart and Epic made SMART the defacto US standard,
| and other countries are recognizing them.
| mastax wrote:
| So it can fit on a reasonably sized QR code probably.
| est31 wrote:
| Key size determines number of bytes the signature takes up,
| which is one of the determinants of the complexity of a QR
| code. I suppose if you don't know what you are doing, and
| want to reduce QR code complexity, you lower the key size.
|
| To turn up speculation to 100, this might also be a third
| world issue, because here in the west we have high quality
| smartphones with good cameras, but the smartphone cameras
| there might not be as good, so they might be challenged
| reading QR codes. 8 years ago I built a thing that had
| customized links accessible via QR codes, but my buddy's
| cheap phone couldn't read them due to issues with the
| camera resolution. A lot has happened in 8 years in terms
| of progress, but they still put crappy cameras into cheaper
| phones, and this might still pose a problem for reading
| complex QR codes.
| dundarious wrote:
| Take a look at QR image in the post. I haven't seen a QR
| code in the first world that carries more data,
| especially not a printed one. It's doubtful they're
| optimizing for poor cameras or printers any more than is
| done in the first world, and to be clear, in the first
| world we still have to optimize for poor cameras and
| printers.
|
| Decreasing the message size while improving security
| would obviously be ideal and most likely quite
| achievable, but there are plenty of wealthy
| municipalities in the US who don't exactly cover
| themselves in honor in similar situations.
|
| While I'm not at all saying it's illegitimate to
| speculate on wealth disparities as a cause, in this case
| I think it's lazy to call this a "third world issue",
| even with speculation up to 100.
| somerandomqaguy wrote:
| Take your pick: Needs to be certified FIPS-140-<n>? Or
| backwards comparability with really old infrastructure that
| no one really understands? Or it was just conveniently at the
| top of the list of ciphers to pick?
| tehjoker wrote:
| lmao we use pieces of paper with no safeguards, even with a
| cryptographic break Hanoi is leagues ahead of us
| t0bia_s wrote:
| It is easier to find someone who give you just papers and flush
| your dose out. But anyway... Proof of anything based on digital
| ID is pointless and should be abandoned as soon as possible.
| bigodbiel wrote:
| Security theatre, like washing streets with chlorine solution
___________________________________________________________________
(page generated 2021-11-26 23:01 UTC)