search

corona-warn-app / cwa-wishlist

Central repository to collect community feature requests and improvements. The CWA development ends on May 31, 2023. You still can warn other users until April 30, 2023. More information:
https://coronawarn.app/en/faq/#ramp_down
Apache License 2.0
105 stars 14 forks source link

Improve User and Certvalidation with Userphoto #708

Open strey opened 2 years ago

strey commented 2 years ago

Feature description

When presenting a certificate the app should be able to show also a photo of the user, so the person who validates the certificate can easily check, that the presented certificate is related to the person presenting the certificate. Currently the person who checks the certificate needs to take a look into an official ID with (often outdated) photo AND needs to verify the certificate with an app. My personal experience is that this does not happen in the vast majority of cases.

The idea is, that the CWA gets an option to take a "selfie" picture in a "passport photo app" style. This picture can be stored on the device. This photo needs to be verified once. This could happen at the time, when a new vaccination certificate is issued for this user. The person who issues the new certificate verifies that the photo in the app shows the same person which is getting the new vaccination certificate. The app shows a hash of that photo and that hash is included into the new vaccination certificate. When that new certificate is imported into the CWA app, the app can easily check if the stored and presented picture has the same hash as mentioned in the last vaccination certificate.

Problem and motivation

The current process (showing certificate in app plus photo ID) is most times not fulfilled, most times only the certificate is shown and the person who should check does not ask for a photo ID. Showing Cert AND photo gives no room for mistakes and makes the process safer and faster. To make this process even more reliable the covpass check app should get a feature update as well.

Is this something you're interested in working on

Happy to discuss this idea, but I don´t have any programmer skills :)

Internal Tracking ID: EXPOSUREAPP-11178

Ein-Tim commented 2 years ago

Related issues:

@strey Thanks for the Suggestion. I recommend you take a look at the issues linked to above and decide if your request is the same as one of the issues above.

Please also see @dsarkar's comment in https://github.com/corona-warn-app/cwa-wishlist/issues/704 which says:

However, this will probably raise a lot of concerns regarding data privacy.

And @dsarkar's comment in https://github.com/corona-warn-app/cwa-wishlist/issues/459

However, as already pointed out in the comments above, at this stage it is clear that such an integration of tracing functionalities and personal identification in the same app will not pass the audits of the Google/Apple stores. Furthermore, the acceptance and trustworthiness of this app relies specifically on data protection and preserving privacy (and others, e.g. open-source code, ... ).

Ein-Tim commented 2 years ago

Should this issue be closed in favor of https://github.com/corona-warn-app/cwa-wishlist/issues/459?

strey commented 2 years ago

I don´t think that my request is comparable to both ideas. First: No data/photo should be shared with anyone else, as suggested in #459 Second: Taking a picture and have the option to show it in the app is nothing that helps, to ensure that the person on the photo is the same person the cert is issued to. My suggestion is to add an additional level of trustworthiness to the photo shown with the cert.

larswmh commented 2 years ago

Thanks for your suggestion @strey. We have created an internal ticket and will raise this topic internally. Internal Tracking ID: EXPOSUREAPP-11178

Corona-Warn-App Open Source Team