search

haxxnz / vaxxed-as-web

6 stars 2 forks source link

Raw QR code data visible via "View details" #9

Closed zendamacf closed 2 years ago

zendamacf commented 2 years ago

Hi, not sure if this is a big deal or not, but the full QR payload is visible when you click "View Details" after scanning the QR code. There is potential for somebody to copy the payload and create their own QR with it.

I know you could just screenshot the QR, but it feels like it might be a little more obvious if somebody were to do that.

noway commented 2 years ago

The CWT is signed with public-key crypto. Changing contents will make the signature invalid. Ministry of Health holds the private key.

zendamacf commented 2 years ago

Sorry, I was meaning using the payload to copy the scanned QR code.

If you don't think it's an issue, feel free to close this 😄

noway commented 2 years ago

@zendamacf I don't see any issue with re-encoding that raw payload into your own QR code. You can even create a vanity QR code with a cute logo in the middle which will scan as a NZ COVID Pass. As long as it pops up as a valid pass in a verifier app, it's all good.

noway commented 2 years ago

On a completely unrelated note, please refrain from sharing valid NZ COVID Passes on social media, because not every venue will be checking IDs and we don't want to let people cheat the system by showing NZ COVID Passes which are not theirs (effectively committing identity theft)