Rapid Tests: Don't assume that the appointment of a test is accurate

jeyemwey commented 3 years ago

Avoid duplicates

[x] Bug is not mentioned in the FAQ
[ ] Bug affects both Android and iOS, for specific issues / questions that apply only to one operating system, please raise them in the respective repositories:
- Android repository -- see below
- iOS repository -- unable to test
[ ] Bug is not already reported in another issue -- see below

Technical details

Device name: Google Pixel 4a
iOS/Android version: Android 11
App version: 2.2.1

Describe the bug

The rapid test integration assumes that the timestamp of the test is accurate (see e.g. Anbindung der Partnersysteme) and only has one timestamp. This creates problems if the test center is congested (and the actual time is later than the appointment) or the testcenter uses the appointment dates only for load balancing and does not care when you come in.

The second point can be an attack vector: If you come in earlier than your appointment, CWA will attest that you have a valid test for longer time since the relative time component calculates now() - t_appointment.

Steps to reproduce the issue

Book a test appointment for a rapid test far in the future (e.g. tomorrow) and receive a confirmation email for the booking.
Add the rapid test to CWA (tested on Android).
Go to the test center and check-in with your confirmation email. Try not to have a conversation that you should only be here tomorrow.
Take the test and wait until the result shows up in CWA.
The timer will say "Ergebnis liegt vor SEIT -H:-m:-s. Ausgestellt $date_of_actual_appointment".

I booked an appointment for 2021-06-05 on 2021-06-04, but already went to the test center today at 17:00. These are my results:

Screenshot of the CWA welcome view and test results view visualizing the issue

Expected behaviour

I would expect that the timestamp of the actual examination is used on the result screen. It is further unclear to me, why it seams to post the correct date in the welcome view, Date of adding the test to the app, maybe?

Possible Fix

Either record the time when the test center tells CWA the final results and display that info to the user.
Or add the actual examination time to the result set which is relayed by the backend. The test center (in my case at least) got the examination date correct in the results PDF which they sent me.

Additional context

The appointment date is also used in the URL/QR Code as the timestamp property.

https://github.com/corona-warn-app/cwa-quick-test-backend/issues/82 and https://github.com/corona-warn-app/cwa-quick-test-backend/issues/94 are connected, maybe?

Internal Tracking-ID: EXPOSUREAPP-7972

Ein-Tim commented 3 years ago

The implementation under iOS is different, but it has the same security flaw.
I would definitely connect this to https://github.com/corona-warn-app/cwa-quick-test-backend/issues/94, which, if this is not only shown in the portal but also in the app, would solve this problem here. Maybe you'd like to ask there the question how they will implement this & wether it's planned to show the "real" time of the test in the app.

heinezen commented 3 years ago

Hello @jeyemwey

This should have been fixed in CWA 2.3. We'll close the issue here.

Corona-Warn-App Open Source Team

jeyemwey commented 3 years ago

Hi, thank you for the heads up and have a good week!

Ein-Tim commented 3 years ago

@heinezen Are you sure this has been fixed? @vaubaehn was still able to get a negative countdown in https://github.com/corona-warn-app/cwa-app-android/issues/3557#issuecomment-877307785 (@vaubaehn - sorry for interrupting your Friday evening here - but could you confirm that you are using version 2.3 or higher?) by changing the system time, so the problem with negative numbers doesn't seem to be fixed. Could you elaborate how exactly this was fixed and provide the PRs fixing this?

In the meantime I'd like to ask you to reopen this issue.

vaubaehn commented 3 years ago

Hi @Ein-Tim

(@vaubaehn - sorry for interrupting your Friday evening here - but could you confirm that you are using version 2.3 or higher?)

I'm on 2.4.3.

You too have a nice evening, and a nice week-end to everyone!

vaubaehn commented 3 years ago

@Ein-Tim btw: the issue here are actually 2 issues: negativ counter and https://github.com/corona-warn-app/cwa-quicktest-onboarding/issues/24. However, neither have been fixed yet.

heinezen commented 3 years ago

@vaubaehn @Ein-Tim

I'll check back to see if there are things that we did not take into account.

Corona-Warn-App Open Source Team

Ein-Tim commented 2 years ago

@dsarkar Is there an update available here?

mtwalli commented 2 years ago

The counter has been removed completely , this issue should be closed

mtwalli commented 2 years ago

Currently Negative Rapid antigen test result display only the date

Ein-Tim commented 2 years ago

Hey @jeyemwey, please see https://github.com/corona-warn-app/cwa-documentation/issues/630#issuecomment-1204993398. Would you like to close this issue now?

jeyemwey commented 2 years ago

Good for me! I thought the issue was resolved when the swab time was introduced about a year ago, but I will close this now anyways. Thanks for your help and time!

corona-warn-app / cwa-documentation