Subject: Re: [Manycouches] What others are doing

From: Alexandre Petrescu <[email-masked]>
Date: Fri, 8 Oct 2021 15:10:34 +0200

ISO is looking at how standards help achieve sustainable dev't goals.

About IETF, it might be something like a particular protocol for lower 
energy expenditure, like in 6lo WG.

Yet, it does not seem to be talking about how standards _development_ 
processes might consider reduction of gas emissions by involving more 
remote participation over the Internet.

Alex

Le 30/09/2021 à 16:36, Behcet Sarikaya a écrit :
>
>
> On Thu, Sep 30, 2021 at 8:25 AM Alexandre Petrescu 
> <[email-masked] <mailto:[email-masked]>> 
> wrote:
>
>
>     Le 29/09/2021 à 17:05, Behcet Sarikaya a écrit :
>>     Hi all,
>>
>>
>>     On Tue, Sep 28, 2021 at 9:09 AM Alexandre Petrescu
>>     <[email-masked]
>>     <mailto:[email-masked]>> wrote:
>>
>>         These are covid conditions from a recent announcement of a
>>         small in-person meeting plan in Brussels, January 18th,
>>         2022.  The meeting is a 'brokerage' event in which maybe 50
>>         people (judging by the hotel size, capacity is not
>>         stipulated) are expected to meet, or to present in front of a
>>         small group, and form groups inching towards various larger
>>         goals.
>>
>>>         The two-day conference is planned as an in-person event in
>>>         Hotel [] Brussels. The venue is set up to be COVID-19
>>>         compliant according to current Belgium legislation. The
>>>         rules currently stipulate that it is mandatory that you are
>>>         either fully vaccinated, recently tested negative or that
>>>         you have proof of recovery from COVID-19.
>>>
>>>         If, however, due to unforeseen changes in the COVID-19
>>>         pandemic or changes in Belgium legislation, we are forced to
>>>         move the event fully online, then we will place a
>>>         notification on the website, and will inform the persons
>>>         that have already registered for the event.
>>>
>>
>>         The respective hotel also has covid measures like this:
>>
>>>         Additional health and safety measures
>>>         Security equipment
>>>
>>>             Staff follow security protocols established by local
>>>         authorities
>>>             Shared accessories (menus, magazines, pens, paper) have
>>>         been removed
>>>             Hydroalcoholic gel in accommodation and frequented rooms
>>>             Checking the health status of clients
>>>             First aid kit available
>>>
>>>         Physical distancing
>>>
>>>             Contactless check-in and check-out
>>>             Cashless payment available
>>>             Compliance with physical distancing rules
>>>             Physical barriers or screens placed between staff and
>>>         customers in areas where needed
>>>
>>>         Cleaning and disinfection
>>>
>>>             Use of cleaning products effective against the coronavirus
>>>             Towels, bed linen and clothes washed as recommended by
>>>         local authorities
>>>             Accommodation disinfected after each stay
>>>             Accommodation closed after cleaning
>>>             The cleaning in the establishment is carried out by
>>>         professional cleaning companies
>>>             Guests can refuse the cleaning service of the
>>>         accommodation during their stay
>>>
>>>         Food and Beverage Safety
>>>
>>>             Physical distancing in dining areas
>>>             Meal delivery possible in the accommodation
>>>             Plates, cutlery, glasses and other crockery items are
>>>         disinfected
>>
>>
>>
>>     Regarding hotels in Covid time, I stayed in a hotel last week 2
>>     nights the first time since February 2020.
>>     It was not a 4-5 star, not a Hilton/Hyatt type of hotel, just 2-3
>>     star Marriott type of hotel in Texas.
>>     We also had free buffet breakfast.
>>     My observation is that hotels learned how to deal with Covid,
>>     even cheaper ones. They protect their front office personnel
>>     properly, I have not seen many room cleaning
>>     people around much, they quickly finish their job and then
>>     disappear. At the breakfast room people seated themselves inline
>>     with social distancing rules of 6 feet/2m. On their own, no sign
>>     or policing. They had hand sanitizers all over common areas.
>>     Also most of the hotel customers had their masks on. Again, no
>>     sign, no policing, actually in Texas you can not mandate masks,
>>     but people had them anyway.
>>
>>     Overall I was surprised and also quite happy with my experience.
>>     I recommend it (take it or leave it).
>
>
>     Thanks for the description.  It is similar to a hotel I had to
>     visit in summer in France for a covid-related reason.  It looked
>     covid-related great and the cancellation conditions were very
>     advantageous.
>
>     However, people did not refrain from taking the elevator at a
>     smaller inter-distance.
>
>     And, in all description I could not see anything related to
>     aeration, or ventilation, its verticality, etc.
>
>     I wonder whether you saw some signs about aeration or ventilation
>
>
> No
>
>     or air quality detectors
>
>
> These things are done overall not building based to my knowledge in 
> US. So I can check air quality rating (of my area, my city) from my 
> smart phone.
>
> Behcet
>
>     ?  Or whether these aspects were described in the papers that try
>     to reassure the user?
>
>
> No idea.
>
>     Alex
>
>
>>
>>     Behcet
>>
>>         I can give separately my critique of it.
>>
>>         Alex
>>
>>         Le 23/08/2021 à 18:54, Alexandre Petrescu a écrit :
>>>
>>>         ISO continues to hold online meetings, rather than
>>>         in-person, to the
>>>         end of November, 2021.
>>>
>>>         At the same time, ISO allows requests for small trials of
>>>         experimenting
>>>         'hybrid' ("The [ISO] Committee also agreed to continue
>>>         allowing requests
>>>         for exceptions to hold hybrid meetings to be submitted for
>>>         consideration
>>>         [...]. This allows for piloting and testing the guidance on
>>>         hybrid
>>>         meetings under development by the ISO/TMB and the IEC/SMB.").
>>>
>>>         Alex
>>>
>>>         Le 06/08/2021 à 13:09, Alexandre Petrescu a écrit :
>>>>
>>>>         Le 05/08/2021 à 21:48, Stephen Farrell a écrit :
>>>>>
>>>>>         I'm going to the pub since it's Thursday, but will be
>>>>>         outdoors:-)
>>>>
>>>>
>>>>         Thursday and more, enjoy the freedom of going to pub with
>>>>         just money
>>>>         in the pocket, and no need of QR Code ('quick response
>>>>         code' in
>>>>         English).
>>>>
>>>>         Apparently September will start to be different there too,
>>>>         as there
>>>>         seem to be discussions about needing to use 'passes' there
>>>>         as well
>>>>         (in UK).
>>>>
>>>>         Here (France), starting next Monday I will have to carry my
>>>>         QR Code
>>>>         when going to pub (out- or indoors) so that others can scan
>>>>         it with
>>>>         an app called 'TousAntiCovid Verif' (open source) to allow
>>>>         me in.
>>>>         That app is free to download but only people of a certain
>>>>         category
>>>>         who are listed in a new law are allowed to use it.
>>>>         'TousAntiCovid
>>>>         Verif' depends on the Internet.  Again I wonder about
>>>>         things and the
>>>>         Internet.
>>>>
>>>>         Alex
>>>>
>>>>>
>>>>>         Cheers, S.
>>>>>
>>>>>         On 05/08/2021 16:47, Vittorio Bertola wrote:
>>>>>>         Hi all,
>>>>>>
>>>>>>         I thought it could be interesting to see what others in our
>>>>>>         industry are doing. The Linux Foundation is resuming
>>>>>>         in-person
>>>>>>         meetings starting next month, under the following policy:
>>>>>>
>>>>>>         https://linuxfoundation.org/blog/vaccines-masks-for-safe-in-person-events-read-about-all-on-site-safety-protocols/
>>>>>>         <https://linuxfoundation.org/blog/vaccines-masks-for-safe-in-person-events-read-about-all-on-site-safety-protocols/>
>>>>>>
>>>>>>
>>>>>>         https://linuxfoundation.org/blog/vaccines-masks-for-safe-in-person-events-read-about-all-on-site-safety-protocols/?_hsmi=146576114&_hsenc=p2ANqtz--u6QTWbcO99M4jexp73_w7HwcuWT8cxMSjKz6EQN4gNgEAOq6G_Q-ZzpndonGlKSJARIIkXjNErxlp_8x32DPE634zDUf3oEkVuC-Ofutm6iQP6RA
>>>>>>         <https://linuxfoundation.org/blog/vaccines-masks-for-safe-in-person-events-read-about-all-on-site-safety-protocols/?_hsmi=146576114&_hsenc=p2ANqtz--u6QTWbcO99M4jexp73_w7HwcuWT8cxMSjKz6EQN4gNgEAOq6G_Q-ZzpndonGlKSJARIIkXjNErxlp_8x32DPE634zDUf3oEkVuC-Ofutm6iQP6RA>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>         (basically: vaccination, masks and distancing required,
>>>>>>         daily temperature checks but no testing).
>>>>>>
>>>>>>         The Open Source Summit, while mostly having attendees
>>>>>>         from North
>>>>>>          America only, is a 2000+ people event - it will be
>>>>>>         interesting
>>>>>>         to see how many show up in person this time under these
>>>>>>         conditions.
>>>>>>
>>>>>>         Ciao,
>>>>>>
>>>>>>         -- 
>>>>>>
>>>>>>         Vittorio Bertola | Head of Policy & Innovation,
>>>>>>         Open-Xchange [email-masked]
>>>>>>         <mailto:[email-masked]>
>>>>>>         mailto:[email-masked]
>>>>>>         <mailto:[email-masked]> Office @ Via
>>>>>>         Treviso 12,
>>>>>>         10144 Torino, Italy
>>>>>>
>>>>>>
>>>>>>         _______________________________________________ Manycouches
>>>>>>         mailing list [email-masked]
>>>>>>         <mailto:[email-masked]>
>>>>>>         https://www.ietf.org/mailman/listinfo/manycouches
>>>>>>         <https://www.ietf.org/mailman/listinfo/manycouches>
>>>>>>
>>>>>
>>>>>         _______________________________________________
>>>>>         Manycouches mailing
>>>>>         list [email-masked] <mailto:[email-masked]>
>>>>>         https://www.ietf.org/mailman/listinfo/manycouches
>>>>>         <https://www.ietf.org/mailman/listinfo/manycouches>
>>>>
>>>>         _______________________________________________ Manycouches
>>>>         mailing
>>>>         list [email-masked] <mailto:[email-masked]>
>>>>         https://www.ietf.org/mailman/listinfo/manycouches
>>>>         <https://www.ietf.org/mailman/listinfo/manycouches>
>>>>
>>>
>>>         _______________________________________________
>>>         Manycouches mailing list
>>>         [email-masked] <mailto:[email-masked]>
>>>         https://www.ietf.org/mailman/listinfo/manycouches
>>>         <https://www.ietf.org/mailman/listinfo/manycouches>
>>         _______________________________________________
>>         Manycouches mailing list
>>         [email-masked] <mailto:[email-masked]>
>>         https://www.ietf.org/mailman/listinfo/manycouches
>>         <https://www.ietf.org/mailman/listinfo/manycouches>
>>

Subject: World Standards Day Promotion - 14 October
From: Jennifer Collins <[email-masked]>
To: <[email-masked]>
Date: Wed, 6 Oct 2021 19:27:07 +0200

ISO Documents

ISO/TC 204

ISO/TC 204 "Intelligent transport systems"

Dear Committee Members,

2021 marks the start of a multi-year campaign to increase understanding of how international standards contribute to achieving the Sustainable Development Goals (SDGs).

The focus of the campaign is standards for SDGs - while the theme is "Shared vision for a better world", as this is what we aim to achieve and reinforce throughout the campaign.

Our objective is that by 2030, international standards are recognized as an integral part of the success of the SDGs. Every year, IEC, ISO and ITU will offer new elements to keep the campaign fresh and engaging.

Let’s prepare, share and participate!

We are please to announce a dedicated website WorldStandrdsDay.orgwhere you will find an excitingpackage of resources to support you in your preparation and help you joining us on the campaign and to celebrate World Standards Day.

Prepare

A set of resources you can use and adapt will help you spread your messages about World Standards Day:

The toolkit explaining the World Standards Day campaign

The WSD visual identity guide to know how to use the visual identity

Visual resources (Zoom background, email signature, and more) to use on your website, conferences, etc

Social media templates to engage your community and spread your key messages

Share

A social feed to bring the community together will display the most interesting and relevant posts about WSD. This includes Twitter, facebook, Instagram, Linkedin, Tik Tok

Participate

Show you activities

This is the place where you can give visibility to your activities

We encourage you to share your activities this form so that you can feature on the website.

Join the discussion

A panel discussion you can join on 14th October

World Standards Day is a fantastic opportunity to raise awareness about standards and their benefits for all.

If you have any request about World Standards Day, please contact: [email-masked]

We are looking forward to read you on social media and see your activities!

Best regards,

Jennifer Collins

Committee manager support team of ISO/TC 204

This email has been sent by Jennifer Collins from ISO Documents. Do not reply to this message but instead contact directly the sender.

---

From: Lars Eggert <[email-masked]>
Date: Mon, 25 Oct 2021 20:41:12 +0300

This is what the Linux Foundation will require at their Member Summit: https://events.linuxfoundation.org/lf-member-summit/attend/health-and-safety/

Thanks,
Lars

---

From: Toerless Eckert <[email-masked]>
Date: Mon, 25 Oct 2021 20:02:03 +0200

Thanks, Lars

a) My comfort level goes up when i do see good numbers on my CO2 meter (<= 600 ppm),
the more important the smaller the room. I wonder why they do not think about
that tool. They use them in schools in several countries to know if/when
the circulation does not work well enough.

b) Given how i intend to travel internationally, i wonder if people here already
have experiences wih the CLEAR app being helpful in airports or elsewhere ?
(given how there is no other "continent-wide" mechanism in the USA as there is
 in the EU)..

Cheers
    Toerless

> [email-masked]

-- 
---
[email-masked]

---

From: Bob Hinden <[email-masked]>
Date: Mon, 25 Oct 2021 11:20:39 -0700

Lars,

> On Oct 25, 2021, at 10:41 AM, Lars Eggert <[email-masked]> wrote:
> 
> Signed PGP part

Thanks for sharing.  Seems like a good approach to me for face to face meetings.

Bob

---

From: Michael Richardson <[email-masked]>
Date: Mon, 25 Oct 2021 14:54:58 -0400

Bob Hinden <[email-masked]> wrote:
    >> Signed PGP part This is what the Linux Foundation will require at
    >> their Member Summit:
    >> https://events.linuxfoundation.org/lf-member-summit/attend/health-and-safety/

    > Thanks for sharing.  Seems like a good approach to me for face to face

Has the US changed it's view on mixed doses yet?

---

From: John C Klensin <[email-masked]>
Date: Mon, 25 Oct 2021 15:43:36 -0400

--On Monday, October 25, 2021 14:54 -0400 Michael Richardson
<[email-masked]> wrote:

>>     On Oct 25, 2021, at 10:41 AM, Lars Eggert
>> <[email-masked]> wrote:     >>
>> This is what the Linux Foundation will
>> require at their Member Summit:

> Has the US changed it's view on mixed doses yet?

Don't know what you think the view was (little advice until very
recently), but current advice is that, for boosters, mixing is
ok (and that, if first dose was Janssen / J&J), might actually
be preferred).

  john

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 26 Oct 2021 08:54:19 +1300

Thanks. Mainly, this looks very sensible.

However, IMHO, Option 1 under "VACCINE VERIFICATION OPTIONS", their recommended option, is unacceptably US-centric for the IETF population. The IETF could certainly support CLEAR but certainly can't make it our recommended option.

Option 2 under "VACCINE VERIFICATION OPTIONS" shows up what I think will soon emerge as a major issue. In particular, systems that I'm aware of rely on a QR code, which for some quaint reason they *disallow* for verifying a digital certificate. Why there isn't a single format defined by WHO beats me.

(Somebody who understands the EU system might care to comment. I and various other people have been arguing that the NZ government should copy the EU system, but we're still waiting to see the final version of the NZ digital vax cert.)

Regards
    Brian

---

From: "Charles Eckel (eckelcu)" <[email-masked]>
Date: Mon, 25 Oct 2021 20:10:34 +0000

I attended another Linux Foundation event at the end of September. The rules were the same and all went very well. 
The venue was very large for the number of on-site participants, which made social distancing easy. The only exception were a few popular sessions that were scheduled in relatively small rooms. Under normal conditions, there was plenty of space, but I would have been much more comfortable if there had been more. 

I attended another conference last week that handled this situation better by reducing the number of chairs in each session and capping the attendance in the room. Volunteers monitored this and everyone complied with the rules.

At both conferences, the ventilation in some rooms was better than in others. Toerless’s idea of using CO2 meters in each room could help with this.

Cheers,
Charles

> On Oct 25, 2021, at 2:20 PM, Bob Hinden <[email-masked]> wrote:
> 
> Lars,
>

---

From: "Carlos M. Martinez" <[email-masked]>
Date: Mon, 25 Oct 2021 17:23:50 -0300

Hi all,

I work for LACNIC (https://www.lacnic.net if you are curious). We had a hybrid conference a week ago, with two in-person sites. The main site was in Montevideo, Uruguay and the "hub" (as we called it) was in Argentina, a few km south of Buenos Aires.

In the hope that this provides a useful data point these were our requirements for in-person attendance:

- EITHER fully vaccinated ("fully": 14 or more days since your 2nd dose) OR a negative PCR test less than 72 hours old.

   - We had only one participant who went the PCR route, out of 140-ish attendees.

- Vaccines accepted were all those approved by the local authorities in the respective countries. That is, we took for valid both the Argentina-approved and the Uruguay-approved vaccines as valid. They mostly overlap except for two exceptions. The idea was that if you managed to cross the border, we would accept your vaccines as valid if they were valid at the origin.

- We did NOT require attendants to upload their vaccination proof. We checked at the door every day. When we scale this model up this may need to change.

- Temperature check at the door for all.

- All food was pre-packaged. No buffets were available.

- Venue-wide mask mandate, except while speaking at the podium. The first available seating was set at 5m from the podium and marked appropriately)

regards,

Carlos

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 26 Oct 2021 11:17:13 +1300

I've just become aware of this:
https://www.iata.org/en/programs/passenger/travel-pass/
This could become the de facto solution for international travel.
Whether it will generalise beyond that is unknown to me.

Regards
    Brian

---

From: Ben Campbell <[email-masked]>
Date: Mon, 25 Oct 2021 18:16:44 -0500

> On Oct 25, 2021, at 2:43 PM, John C Klensin <[email-masked]> wrote:
> 
> 
> 

According to the WSJ today, The US just updated vaccination guidance for international travel. 

One of the provisions is that any people with any combination of 2 shots from 2-shot vaccines “approved or authorized” by the FDA or “listed for emergency list” by the WHO will be considered “fully vaccinated” for purposes of international travel.

Ben.

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Tue, 26 Oct 2021 06:03:41 +0000

Brian,

As you asked, I have spent some hours in June to decode any EU "Digital Green Certificate" (DGC) with some technical explanations at https://ehealth.vyncke.org but this is only about the technicalities.

1/ of course, the check should include an identity check as well to match it with the physical owner of this DGC, which can be printed on paper, or in a specific mobile app
2/ there is no need for Internet connectivity to check such a QR-code as the scanning app has the list of trust anchors and the revoked certs (the latter is a small privacy issue of course)
3/ I know that there is a process for US citizens (and probably others) to get their own DGC
4/ all of the above based on open source by the EU

5/ obviously, I am an engineer and neither a medical expert nor a lawyer

6/ of course, since I made this page public, I am getting a daily email asking "how can I revert the process and create a fake DGC" ?

-éric

On 25/10/2021, 21:58, "Manycouches on behalf of Brian E Carpenter" <[email-masked] on behalf of [email-masked]> wrote:

...%<....%<.......;

    Regards
        Brian

---

From: Alexandre Petrescu <[email-masked]>
Date: Tue, 26 Oct 2021 10:43:11 +0200

> I attended another Linux Foundation event at the end of September. The rules were the same and all went very well.

All went very well, ok.

But has the virus propagated or not?

Alex

---

From: Vittorio Bertola <[email-masked]>
Date: Tue, 26 Oct 2021 11:13:29 +0200 (CEST)

> Il 25/10/2021 21:54 Brian E Carpenter <[email-masked]> ha scritto:
> 

Éric has already explained the system - I will just add that each European country released a free digital pass verification app which is interoperable EU-wide (also including nearby countries e.g. Switzerland), so in practice, anyone anywhere in the world that wishes to validate European passes just needs to download one of those apps and use it to check the QR code on the pass, plus check that the name on the pass matches the person's passport.

On the other hand, pass verification apps (all AFAIK - definitely the Italian one) do not immediately show any detail about your status - they just show your name and that you are currently ok, without any information on whether you're ok because of a vaccination or because you are unvaccinated but just tested negative, nor any indication of when your status will expire, or when you were vaccinated if you were, or which vaccine you got. All these details are not shown by the verification app, but they are supplied in the paper version of the pass or in the extended details screen in the person's digital pass app, which the person would have to show you voluntarily. 

As an alternative, you could ask (like the Linux Foundation does) for a vaccination certificate by your local health authority, but that, in Europe, would possibly mean hundreds of different authorities releasing pieces of paper in hundreds of different formats and in 27 languages.

Bottom line: for Europeans, if the rule is "vaccinated or recovered or recently tested" it can be reliably checked in ten seconds, while if the rule is "vaccinated only" then it's a much harder check and much more open to mistakes or even cheating, though one could write a specific mobile app that decodes the QR code and then checks the JSON to look for vaccination details specifically. (AFAIK such an app exists, it is used by border police, but it is not made available to the public because of the above privacy concerns; also, I read that any "unauthorized" apps would not get access to the key database to check the signatures, though I don't know if this is true.)

-- 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: "Charles Eckel (eckelcu)" <[email-masked]>
Date: Tue, 26 Oct 2021 15:42:13 +0000

> But has the virus propagated or not?

To the best of my knowledge, there was nothing during the event and nothing tied to it in the two weeks following the conference.

Cheers,
Charles

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 27 Oct 2021 08:42:00 +1300

Thanks Éric and Vittorio. One comment below:

On 26-Oct-21 22:13, Vittorio Bertola wrote:
> On the other hand, pass verification apps (all AFAIK - definitely the Italian one) do not immediately show any detail about your status - they just show your name and that you are currently ok, without any information 
on whether you're ok because of a vaccination or because you are unvaccinated but just tested negative, nor any indication of when your status will expire, or when you were vaccinated if you were, or which vaccine you got. All these details are not shown by the verification app, but they are 
supplied in the paper version of the pass or in the extended details screen in the person's digital pass app, which the person would have to show you voluntarily.
> 
> As an alternative, you could ask (like the Linux Foundation does) for a 
vaccination certificate by your local health authority, but that, in Europe, would possibly mean hundreds of different authorities releasing pieces of paper in hundreds of different formats and in 27 languages.
> 
> Bottom line: for Europeans, if the rule is "vaccinated or recovered or recently tested" it can be reliably checked in ten seconds, while if the rule is "vaccinated only" then it's a much harder check and much more open to mistakes or even cheating, though one could write a specific mobile app that decodes the QR code and then checks the JSON to look for vaccination details specifically. (AFAIK such an app exists, it is used by border police, but it is not made available to the public because of the above 
privacy concerns; also, I read that any "unauthorized" apps would not get 
access to the key database to check the signatures, though I don't know if this is true.)

Assuming these are public keys, that seems ridiculous. We should care, because if the IETF ever held meetings under such conditions, we'd definitely want to be able to scan and verify any correctly signed cert from anywhere.

    Brian

---

From: Vittorio Bertola <[email-masked]>
Date: Wed, 27 Oct 2021 07:34:05 +0200 (CEST)

> Il 26/10/2021 21:42 Brian E Carpenter <[email-masked]> ha scritto:
> 

But you can do that - you can just use the free official validation app, which however will just tell you whether the person is vaccinated, recovered or tested negative, without telling you which of the three, for privacy reasons. What you can't do is to come up with your own, different requirements (e.g. vaccination only), unless you ask people to show you the details in their certificate to check them by hand, and they accept voluntarily. You would still have to verify whether that's possible in the country where you are, as there are contexts in which it is illegal for someone to ask someone else whether they are vaccinated or not (e.g. employers with employees). 

By the way, there are rumours on Twitter that at least one of the national private keys has been leaked already...

---

From: Alexandre Petrescu <[email-masked]>
Date: Wed, 27 Oct 2021 13:00:17 +0200

Le 27/10/2021 à 07:34, Vittorio Bertola a écrit :
> 
> 
>> Il 26/10/2021 21:42 Brian E Carpenter
>> <[email-masked]> ha scritto:
>> 
>> Assuming these are public keys, that seems ridiculous. We should 
>> care, because if the IETF ever held meetings under such
>> conditions, we'd definitely want to be able to scan and verify any
>> correctly signed cert from anywhere.
> 
> But you can do that - you can just use the free official validation 
> app, which however will just tell you whether the person is 
> vaccinated, recovered or tested negative, without telling you which 
> of the three, for privacy reasons. What you can't do is to come up 
> with your own, different requirements (e.g. vaccination only),
> unless you ask people to show you the details in their certificate to
> check them by hand, and they accept voluntarily. You would still have
> to verify whether that's possible in the country where you are, as
> there are contexts in which it is illegal for someone to ask someone
> else whether they are vaccinated or not (e.g. employers with
> employees).
> 
> By the way, there are rumours on Twitter that at least one of the 
> national private keys has been leaked already...

Additionally, a few networks of creators of fake certs have been
disbanded by law enforcement, recently.

But more than that, the whole trust the people seem to put on these
certs is way off mark.  I have a square printed qr code in my pocket; I
could give it to anyone to use; I could photocopy 1000 and distribute
flyers of it, because it is impersonal (the identification card is
forbidden to be checked).  That is one of the main problems with it.

Hopefully, admitting entrance at a fair based on this little square is
understood well enough.

Alex

---

From: Alexandre Petrescu <[email-masked]>
Date: Wed, 27 Oct 2021 13:32:14 +0200

Le 26/10/2021 à 11:13, Vittorio Bertola a écrit :
>> (Somebody who understands the EU system might care to comment. I 
>> and various other people have been arguing that the NZ government 
>> should copy the EU system, but we're still waiting to see the final
>> version of the NZ digital vax cert.)
> 
> Éric has already explained the system - I will just add that each 
> European country released a free digital pass verification app which
>  is interoperable EU-wide (also including nearby countries e.g. 
> Switzerland), so in practice,

If one wants to practice, in France the app of showing the cert is
called TousAntiCovid and the app to verify it (presumably used by a
person who wants to verify) is called TousAntiCovid Verif.  This latter
displays a screen at the beginning warning that if one is not a verifier
then one should not use it - so if one just wants to try it one is
already subject to some legislation.

There is some development open source at EU level, but what is actually
used (TousAntiCovid, TousAntiCovid Verif) is not open source and it
costs a lot of money even though the cost is not on the end user.

> anyone anywhere in the world that wishes to validate European passes
> just needs to download one of those apps and use it to check the QR
> code on the pass, plus check that the name on the pass matches the
> person's passport.
> 
> On the other hand, pass verification apps (all AFAIK - definitely the
> Italian one) do not immediately show any detail about your status

_That_ app does not tell details, but the details are there visible in
the QR code.  Another app like the one on vyncke (URL visible on IPv6)
does show all the details in the QR code.  The format of the QR code is
publicly documented.  The values of the fields vary, though, and there
is no standard for the way to express things.  E.g. some say 'comirnaty'
while others say 'pfizer'.  Besides, the name of the AZ vaccine changed
since.

> - they just show your name and that you are currently ok, without any
> information on whether you're ok because of a vaccination or because
> you are unvaccinated but just tested negative, nor any indication of
> when your status will expire, or when you were vaccinated if you
> were, or which vaccine you got. All these details are not shown by
> the verification app, but they are supplied in the paper version of
> the pass or in the extended details screen in the person's digital
> pass app, which the person would have to show you voluntarily.

Yes, I agree.

But they - the deails visible in the QR code - are also visible in the
QR Code readers and various software that reads it such as this one but
there are more https://ehealth.vyncke.org

A camera of surveillance ('video-protection') can zoom into these QR
codes of someone in the street, it is easy.

Various correlations can be made: at this time this person was healed
because of natural antibodies, so 6 months later remind her/him to vaccine.

The privacy risk is very large.  We should not neglect it's there.

But I think the privacy risk should be counterbalanced by a will to go
out of this pandemics.

Alex

> 
> As an alternative, you could ask (like the Linux Foundation does) for
> a vaccination certificate by your local health authority, but that,
> in Europe, would possibly mean hundreds of different authorities
> releasing pieces of paper in hundreds of different formats and in 27
> languages.
> 
> Bottom line: for Europeans, if the rule is "vaccinated or recovered 
> or recently tested" it can be reliably checked in ten seconds, while
>  if the rule is "vaccinated only" then it's a much harder check and 
> much more open to mistakes or even cheating, though one could write a
> specific mobile app that decodes the QR code and then checks the JSON
> to look for vaccination details specifically. (AFAIK such an app
> exists, it is used by border police, but it is not made available to
> the public because of the above privacy concerns; also, I read that
> any "unauthorized" apps would not get access to the key database to
> check the signatures, though I don't know if this is true.)
>

---

From: "John Levine" <[email-masked]>
Date: 27 Oct 2021 14:36:03 -0400

It appears that Vittorio Bertola  <[email-masked]> said:
>But you can do that - you can just use the free official validation app, ...
>

Not just on Twitter:

https://github.com/ehn-dcc-development/hcert-spec/issues/103

Presumably this can be fixed by plugging the leak and updating the app
with new keys, but it's one more pain in the patoot to consider.

R's,
John

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 28 Oct 2021 08:54:37 +1300

On 27-Oct-21 18:34, Vittorio Bertola wrote:
> But you can do that - you can just use the free official validation app, 

That answer works on a national basis. The IETF would need a global validation app. I am a bit surprised that the WHO has not produced a global cert format and a global validation method, and until they do (or the IETF joins IATA and can use the airline system), I'm not quite sure how we could avoid manual inspection of certificates and photo ID.

> which however will just tell you whether the person is vaccinated, recovered or tested negative, without telling you which of the three, for privacy reasons. What you can't do is to come up with your own, different requirements (e.g. vaccination only), unless you ask people to show you the details in their certificate to check them by hand, and they accept voluntarily. You would still have to verify whether that's possible in the country where you are, as there are contexts in which it is illegal for someone to ask someone else whether they are vaccinated or not (e.g. employers with employees).

Whether the privacy regime in a particular country allows the IETF to check whatever we decide we need to check will became a new site selection criterion, I suppose. Personally I have no problem whatever in revealing my vaccination status to anyone who asks.

    Brian

---

From: Jay Daley <[email-masked]>
Date: Thu, 28 Oct 2021 10:49:26 +1300

> On 28/10/2021, at 8:54 AM, Brian E Carpenter <[email-masked]> wrote:
> 
> That answer works on a national basis. The IETF would need a global validation app.

Outside of special areas like Schengen, people travelling into a country will be required to prove vaccination status in order to enter the country, so all the IETF will need is national validation for those that have not travelled internationally.

Jay

> I am a bit surprised that the WHO has not produced a global cert format and a global validation method, and until they do (or the IETF joins IATA and can use the airline system), I'm not quite sure how we could avoid manual inspection of certificates and photo ID.
> 

-- 
Jay Daley
IETF Executive Director
[email-masked]

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 28 Oct 2021 11:49:15 +1300

> Outside of special areas like Schengen, people travelling into a country will be required to prove vaccination status in order to enter the country, so all the IETF will need is national validation…

What if we decide that the national restrictions are insufficient, or alternatively if some local requirement for large meetings is stricter than the border control?

I fear that there's no easy out here.

     Brian

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 28 Oct 2021 00:53:49 +0200

Btw:

Does anyone know applications for android that allow me privately to 
validate a QR vaccination code ? I was trying to find one for my
California certificate QR code but could not find it. Likewise for
european ones would be of interest to me.

Not only asking for curiosity, but also because i can't believe how
it would be that difficult to build apps that simply are pre-loaded
with the trust anchors and encoding templates of all those different
QR providers.

I fear thart there may be a lot of money in this, which is why it
may be difficult to find such tools ? aka: apps scanning QR code
being sold for silly money to whoever needs to use them for the job ?

Cheers
    Toerless

-- 
---
[email-masked]

---

From: "John Levine" <[email-masked]>
Date: 27 Oct 2021 21:05:01 -0400

>european ones would be of interest to me.

I have the validation app for the New York Excelsior Pass which is
also supposed to handle compatible Smart Health cards. The app
presumably checks the signature against an internal set of signers,
since they are quite clear that nobody but the person using the
validation app knows what it's checked and what it said about them.

It's called NYS Excelsior Pass Scanner, available in
app stores everywhere.

R's,
John

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 28 Oct 2021 05:13:39 +0200

Hah, thanks John, Michael

searching with the word "verifier" found me this one:

https://thecommonsproject.org/smart-health-card-verifier

Seem to have likely the mayority of issues west of the atlantic:
https://www.commontrustnetwork.org/verifier-list

Doesn't list Ontario though.

Did work on my CA QR code that i had printed and laminated (who trusts smart phones).

Now a similar thing for east of the atlantic would be nice.

Cheers
    Toerless

-- 
---
[email-masked]

---

From: "John R Levine" <[email-masked]>
Date: 27 Oct 2021 23:47:33 -0400

> Did work on my CA QR code that i had printed and laminated (who trusts smart phones).

Not surprising, Ontario says they use Smart codes.

New York originally used their own format but now have a "pass plus" that 
is a Smart code.

The commons project app recognizes the plus version of my record, but not 
the original, as I would have expected.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 28 Oct 2021 11:05:15 +0200

Le 28/10/2021 à 00:53, Toerless Eckert a écrit :
> validate a QR vaccination code ?

There is one in France called "TousAntiCovid Verif" - it checks the
local certs of local people.  Its GUI asks to make sure one is a
verifier before using it.

What is the app called in Germany?

> I was trying to find one for my California certificate QR code but 
> could not find it. Likewise for european ones would be of interest to
> me.

I think Eric's site (https://ehealth.vyncke.org/index.php visible on
IPv6 too) talks about SMART Health Cards too, in addition to the
Europeans; these SMART Health Cards were originated in Boston, MA, which
is a city in USA.  Presumably Americans all use a unique format SMART
Health Cards, hence the Californians too; but USA-wide use is a
supposition from my part, I should ask someone.

> Not only asking for curiosity,

Does your California card say 'SMART Health Card', maybe in fine print?

Does the card feature a photograph of you?

> but also because i can't believe how it would be that difficult to 
> build apps that simply are pre-loaded with the trust anchors and 
> encoding templates of all those different QR providers.

But web browsers already do that.  They have a local 'store' in which
they store certs of CAs.

> I fear thart there may be a lot of money in this, which is why it may
> be difficult to find such tools ?

Yes.

Comparisons can be made.

There is, since some years, a similar situation with CAs for automobile
networks.  Lots of money in it, lots of interest.  The result is that
there is no common PKI for automobiles.  The situation is so different
than the PKI for the Internet, where the trust is established.

One can wonder how to make these QR code trust work worldwide?  What
were the ingredients that made the unique Internet PKI get deployed, and
how can we apply these ingredients to health networks too?

> aka: apps scanning QR code being sold for silly money to whoever 
> needs to use them for the job ?

Well said, with irony.

Alex

> Cheers Toerless
>>>>> Assuming these are public keys, that seems ridiculous. We 
>>>>> should care, because if the IETF ever held meetings under 
>>>>> such conditions, we'd definitely want to be able to scan and
>>>>>  verify any correctly signed cert from anywhere.
>> Outside of special areas like Schengen, people travelling into a 
>> country will be required to prove vaccination status in order to 
>> enter the country, so all the IETF will need is national validation
>> for those that have not travelled internationally.
>> 
>> Jay
>> 
>>> I am a bit surprised that the WHO has not produced a global cert
>>>  format and a global validation method, and until they do (or the
>>>  IETF joins IATA and can use the airline system), I'm not quite 
>>> sure how we could avoid manual inspection of certificates and 
>>> photo ID.
>>> 
>>>> which however will just tell you whether the person is 
>>>> vaccinated, recovered or tested negative, without telling you 
>>>> which of the three, for privacy reasons. What you can't do is 
>>>> to come up with your own, different requirements (e.g. 
>>>> vaccination only), unless you ask people to show you the 
>>>> details in their certificate to check them by hand, and they 
>>>> accept voluntarily. You would still have to verify whether 
>>>> that's possible in the country where you are, as there are 
>>>> contexts in which it is illegal for someone to ask someone else
>>>> whether they are vaccinated or not (e.g. employers with 
>>>> employees).
>>> 
>>> Whether the privacy regime in a particular country allows the 
>>> IETF to check whatever we decide we need to check will became a 
>>> new site selection criterion, I suppose. Personally I have no 
>>> problem whatever in revealing my vaccination status to anyone who
>>> asks.
>>> 
>>> Brian
>>> 
>>>> By the way, there are rumours on Twitter that at least one of 
>>>> the national private keys has been leaked already...
>>> 
>> -- Jay Daley IETF Executive Director [email-masked]
>> 
>> _______________________________________________ Manycouches mailing
>> list [email-masked]

---

From: Vittorio Bertola <[email-masked]>
Date: Thu, 28 Oct 2021 12:05:22 +0200 (CEST)

Apologies, multiple replies in a single posting.

> Il 27/10/2021 13:00 Alexandre Petrescu <[email-masked]> ha scritto:
> 
> forbidden to be checked). 

This depends on the country. In Italy, any private party running an activity where the pass is mandatory is explicitly authorized by the law to ask for an ID card and check that it matches the pass, and to refuse entry if the person refuses to show it; they are also required to spot any blatant issues, such as a male person with a pass on a female name, or a young person with a pass for a 70-yr-old person, or they will be fined up to 1000€. In [certain parts of] Switzerland, asking for an ID card is mandatory - everybody is required by law to show it together with the pass when entering bars, restaurants etc., and people just line up with the phone in one hand and the ID/passport in the other.

> Il 27/10/2021 21:54 Brian E Carpenter <[email-masked]> ha scritto:
> 

I don't think we are going to see any global standard in the short term. More or less, everyone is happy with using their local app to check passes for the locals (e.g. all Europeans in Europe) and examine non-locals by hand. Also, not all countries adopted open formats and those who did, like the EU, often still control the distribution of signing keys so that you cannot write your own app. 

Moreover, there are differences in rules from country to country so you would need a relatively complex, globally standard ontology so that your valid pass from country A can be automatically re-evaluated to determine if it is also valid in country B.

Perhaps a globally respected digital SDO could launch efforts to define such standards or at least to document the formats in a single place, though ;-)

> Il 27/10/2021 23:49 Jay Daley <[email-masked]> ha scritto:
> 

This is only correct if the IETF's policy is the same as the hosting country's policy. I think it would be a reasonable thing to do as long as the hosting country's policy is reasonable, which could be part of your evaluations. But good luck getting the community to agree on which policies can be considered reasonable.

Also, most countries accept unvaccinated people if they have a negative test less than 48 to 72-hour-old. This means that after a few hours or days their status will change, so you cannot rely on the check made at the border. Depending on the country, you could actually be required by law to check everyone again every time they enter the premises (at least once a day), as a legal condition for running an event.

> Il 28/10/2021 05:13 Toerless Eckert <[email-masked]> ha scritto:
> 

The Italian one is called VerificaC19:

https://play.google.com/store/apps/details?id=it.ministerodellasalute.verificaC19&hl=it&gl=US

It can read all EU/EEA passes and possibly (they said it would, but I haven't confirmed this) also the UK ones.

---

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 28 Oct 2021 13:16:35 +0200

Le 28/10/2021 à 12:05, Vittorio Bertola a écrit :
>> Il 27/10/2021 13:00 Alexandre Petrescu 
>> <[email-masked]> ha scritto:
>> 
>> certs is way off mark.  I have a square printed qr code in my 
>> pocket; I could give it to anyone to use; I could photocopy 1000 
>> and distribute flyers of it, because it is impersonal (the 
>> identification card is forbidden to be checked).
> 
> This depends on the country. In Italy, any private party running an 
> activity where the pass is mandatory is explicitly authorized by the 
> law to ask for an ID card and check that it matches the pass, and to 
> refuse entry if the person refuses to show it; they are also required
> to spot any blatant issues, such as a male person with a pass on a
> female name, or a young person with a pass for a 70-yr-old person, or
> they will be fined up to 1000€. In [certain parts of] Switzerland,
> asking for an ID card is mandatory - everybody is required by law to
> show it together with the pass when entering bars, restaurants etc.,
> and people just line up with the phone in one hand and the
> ID/passport in the other.

It is interesting to know how much power is delegated to verifiers of
covid-relatd QR codes in various countries.

Indeed blatant issues can be checked, and even more of them, in what
could be considered to be a smart way: check whether the same person is
present two times simultaneously at a place, or at very remote places.

Moreover, since this verification power is given to many - each bar or
cinema owner, and more - it can be that many others are considering
themselves attributed the same right to verify; e.g. the nightmare of
insurance agents conditioning the assignment of a license by the
verification of a covid-related status or, worse, a bank and a loan, an
employer and a job, etc.

There are also many cases where those who are supposed to verify simply
reject the principle that they should verify.  For example, a bar I
tried to visit recently displayed a fake QR code on its door stating
'The Medical Secret does Exist' ('le secret médical existe', fr.)  The
medical secret is a sort of sanctuary protecting people since long time.
  For my part I did not  step into that bar, but it was there and many
people entered.

(it should be known to those who have not yet gone through these
covid-related QR codes that there are two types: the QR codes of people
and the QR codes of places; the QR codes of people are told often in our
  discussions here; the QR codes of places are those displayed by a bar
at its entrance and being scanned by the visitor - the privacy schemes
are different)

These refusing to verify QR codes are somehow 'outlaws', they risk
paying fines, or forced closure of business outright.  But these laws
themselves are being under very close scrutiny from people, because
these covid-related laws do not represent consensus.  They are laws made
under emergency situations; the quick process of making these laws is
largely facilitated by... the electronic means like Word processing,
quick emails and instant telecommunications.  It is at that point that
one would wonder whether the technologies we work on are being used good
or less good.  It is great to consult the DNA signature of a virus over
the Internet, or to tele-work to stop the spread, but it is less great
to make non-consesual laws over the quick Internet, just because one can.

These issues and many others related, are currently being under
consideration at highest levels of democracy making, where I live
(Sénat, fr.)  They look whether to pursue with this QR code checking
until July 2022 (initially planned only until November 15th, 2021) , or
not, and if yes - how to do it better.

I suspect in every country the precise regulations (member state laws)
of checking these QR codes are being changing as we speak, and will
probably be different in March 2022 than now.

Thus, in a sense, the very proposals of organising parts of IETF
meetings in-500person to 'abide to local laws' is a little bit a
non-sense.  The laws are evolving faster than IETF can organise a
meeting abiding to local laws.  It's a loop.

Alex

> 
> 
>> Il 27/10/2021 21:54 Brian E Carpenter
>> That answer works on a national basis. The IETF would need a
>> global validation app. I am a bit surprised that the WHO has not
>> produced a global cert format and a global validation method, and
>> until they do (or the IETF joins IATA and can use the airline
>> system), I'm not quite sure how we could avoid manual inspection of
>> certificates and photo ID.
> 
> I don't think we are going to see any global standard in the short 
> term. More or less, everyone is happy with using their local app to 
> check passes for the locals (e.g. all Europeans in Europe) and 
> examine non-locals by hand. Also, not all countries adopted open 
> formats and those who did, like the EU, often still control the 
> distribution of signing keys so that you cannot write your own app.
> 
> Moreover, there are differences in rules from country to country so 
> you would need a relatively complex, globally standard ontology so 
> that your valid pass from country A can be automatically
> re-evaluated to determine if it is also valid in country B.
> 
> Perhaps a globally respected digital SDO could launch efforts to 
> define such standards or at least to document the formats in a
> single place, though ;-)
> 
> 
>> enter the country, so all the IETF will need is national
>> validation for those that have not travelled internationally.
> 
> This is only correct if the IETF's policy is the same as the hosting 
> country's policy. I think it would be a reasonable thing to do as 
> long as the hosting country's policy is reasonable, which could be 
> part of your evaluations. But good luck getting the community to 
> agree on which policies can be considered reasonable.
> 
> Also, most countries accept unvaccinated people if they have a 
> negative test less than 48 to 72-hour-old. This means that after a 
> few hours or days their status will change, so you cannot rely on
> the check made at the border. Depending on the country, you could 
> actually be required by law to check everyone again every time they 
> enter the premises (at least once a day), as a legal condition for 
> running an event.
> 
> 
It can read all EU/EEA passes and possibly (they said it would, but
> I haven't confirmed this) also the UK ones.
>

---

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 28 Oct 2021 13:40:12 +0200

[...]
> https://play.google.com/store/apps/details?id=it.ministerodellasalute.verificaC19&hl=it&gl=US

In Netherlands there seem to be this CoronaCheck scanner:
https://coronacheck.nl/en/scanner

Alex

---

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 28 Oct 2021 13:42:57 +0200

an interesting verifier in Austria:

https://dgc.a-sit.at/ehn/

Le 28/10/2021 à 13:40, Alexandre Petrescu a écrit :
>> It can read all EU/EEA passes and possibly (they said it would, but I 
>> haven't confirmed this) also the UK ones.
>>

---

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 28 Oct 2021 13:58:56 +0200

Le 27/10/2021 à 21:54, Brian E Carpenter a écrit :
>>> conditions, we'd definitely want to be able to scan and verify 
>>> any correctly signed cert from anywhere.
>> 

I agree IETF would need a global validation app.

> format and a global validation method, and until they do (or the IETF
> joins IATA and can use the airline system), I'm not quite sure how we
> could avoid manual inspection of certificates and photo ID.

I think the cert format to explain covid status is agreed somehow in 
European countries.   An introduction to its use is there 
https://ec.europa.eu/commission/presscorner/detail/en/QANDA_21_2781

The cert format is there (I was pointed to it by Eric's site): 
https://github.com/ehn-dcc-development/hcert-spec/blob/main/hcert_spec.md

I suspect it is a different cert format than each other country in the 
world.

The format of the certificates is one thing.  It could be agreed among 
many countries, at a common organisational level.  Maybe ITU could make 
people agree on a covid-related format of certificates.

However, there is a bigger difficulty.

The cert format is impacted by the way in which these certs are 
verified.  The mechanism to realize this verification has a few 
characteristics that we never faced before: the number of certs, and the 
number of simultaneous checks.  These two numbers are so big that 
technically it is hard to think about a single worldwide solution.  Even 
the biggest PKI (the Internet PKI) does not deal with that big numbers.

For Europe they chose not to go with the deployed Internet PKI.  They 
could have done it: each smartphone has the web CAs already builtin. 
But for some reason unknown to me they decided to build a dedicated PKI. 
This PKI relies on a very small core of servers.  It is roughly 
described there:
https://github.com/eu-digital-green-certificates/dgc-overview/blob/main/guides/certificate-governance.md
(github is not visible on IPv6).

It is interesting to note how the way that URL document describes things 
is very much in an RFC way.  It has Terminology section and 'MUST's and 
so on.  However, it is not done at IETF.  I can not help wondering _why_ 
they have not done it at IETF?

(the name 'green certificate' together with others such as 'blue certs' 
and more, were earlier names of these covid-related certs).

>> which however will just tell you whether the person is vaccinated, 
>> recovered or tested negative, without telling you which of the 
>> three, for privacy reasons. What you can't do is to come up with 
>> your own, different requirements (e.g. vaccination only), unless 
>> you ask people to show you the details in their certificate to 
>> check them by hand, and they accept voluntarily. You would still 
>> have to verify whether that's possible in the country where you 
>> are, as there are contexts in which it is illegal for someone to 
>> ask someone else whether they are vaccinated or not (e.g.
>> employers with employees).
> 
> Whether the privacy regime in a particular country allows the IETF
> to check whatever we decide we need to check will became a new site 
> selection criterion, I suppose. Personally I have no problem
> whatever in revealing my vaccination status to anyone who asks.

YEs, me too.

Alex

---

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 28 Oct 2021 14:17:28 +0200

> define such standards or at least to document the formats in a

Maybe ITU.

Or maybe a health-related digital std organisation.  There is this HL7
(Health Level 7, which means it is at app layer of ISO) that is more in
USA I think.

One should not hurry in to one of those, but first build a list of the
opportunities.

Because in recent few years a few formats and standards for
health-related aspects (prior to and during covid) have appeared,
suggested to populations, and are being replaced.  Google had such a
repository of health data which got scrapped, locally we had DMP which
disappears these days, and there might be more.  It is a very much
moving ground.

Alex

---

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 28 Oct 2021 14:55:54 +0200

talking to myself sorry...

[...]
> characteristics that we never faced before: the number of certs, and 
> the number of simultaneous checks.

It would be great to know whether the current verifier apps need a live
Internet connection when checking.  Or maybe they can check based on a
locally-stored component.

To test that, I tried the verifier app TousAntiCovid Verif on a
cellular-less tablet with its WiFi off.  It worked - it checked, so it
seems the verification can work offline.

That ability to work offline might be a good thing or a bad thing.

It is a good thing in that there would be no queues formed at the
entrance of a restaurant in case  of loss of Internet that day, or no
coverage of some sort, or a wifi glitch.

It is a bad thing in that the process of updating the secrets, or
recovery following an impersonation attack on the CA, might not work or
might not even exist.  Such a recovery process (e.g. protocol OCSP)
needs Internet connection.

When trying this kind of thing (exercice the verifier app TousAntiCovid
Verif), one should be aware that one is already tresspassing laws which
designates the verifiers to be a particular kind of  person.  Ideally,
the laws should have an exception for those who simply want to make it
better.

Alex

   These two numbers are so big that
> technically it is hard to think about a single worldwide solution. 
> Even the biggest PKI (the Internet PKI) does not deal with that big 
> numbers.
> 
> For Europe they chose not to go with the deployed Internet PKI.
> They could have done it: each smartphone has the web CAs already
> builtin. But for some reason unknown to me they decided to build a
> dedicated PKI. This PKI relies on a very small core of servers.  It
> is roughly described there: 
> It is interesting to note how the way that URL document describes 
> things is very much in an RFC way.  It has Terminology section and 
> 'MUST's and so on.  However, it is not done at IETF.  I can not help 
> wondering _why_ they have not done it at IETF?
> 
> (the name 'green certificate' together with others such as 'blue 
> certs' and more, were earlier names of these covid-related certs).
> 
>>> which of the three, for privacy reasons. What you can't do is to 
>>> come up with your own, different requirements (e.g. vaccination 
>>> only), unless you ask people to show you the details in their 
>>> certificate to check them by hand, and they accept voluntarily. 
>>> You would still have to verify whether that's possible in the 
>>> country where you are, as there are contexts in which it is 
>>> illegal for someone to ask someone else whether they are 
>>> vaccinated or not (e.g. employers with employees).
>> 
>>  to check whatever we decide we need to check will became a new
>> site selection criterion, I suppose. Personally I have no problem

---

From: "John Levine" <[email-masked]>
Date: 28 Oct 2021 13:03:49 -0400

>locally-stored component.

The Smart QR codes include a JWS digital signature that is verified offline.

Description here:

https://spec.smarthealth.cards/

Source code here:

https://github.com/smart-on-fhir

R's,
John

---

From: Fred Baker <[email-masked]>
Date: Thu, 28 Oct 2021 10:56:20 -0700

Sent using a machine that autocorrects in interesting ways...

> On Oct 25, 2021, at 11:55 AM, Michael Richardson <[email-masked]> wrote:
> 

Yes, if you’re coming from somewhere else.

https://www.channelnewsasia.com/world/us-will-accept-mixed-doses-covid-19-vaccines-international-travelers-2248421

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 28 Oct 2021 20:14:27 +0200

It's not about mixed doses alone, it about
immigration officers accepting CDC and WHO emergency authorizations.

But of course there are all type of other bodies creating
requirements for vaccinations to do things once you are inside
the USA. States, sports events etc. Those have so far all been
built against only CDC emergency authorized / approved vaccines,
but not WHO.

I would assume that problem will likely not be handled as strictly
as it could be, but i am sure friends from europe that already
booked concerts in the USA for next year will certainly want
to get a lot more precise answers as to whether or not
they'd be rejected trying to enter a stadium with a europen
vaccination certificate for Astra Zenica or not.

Oh, the bureaucracies! 

Cheers
    Toerless

-- 
---
[email-masked]

---

From: "John Levine" <[email-masked]>
Date: 28 Oct 2021 18:56:14 -0000

According to Fred Baker  <[email-masked]>:
>-=-=-=-=-=-

Also for boosters, anyone eligible for a booster can get any vaccine:

https://www.cdc.gov/media/releases/2021/p1021-covid-booster.html

-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 28 Oct 2021 22:13:39 +0200

> https://www.cdc.gov/media/releases/2021/p1021-covid-booster.html

I think CDC is in USA and that 'any' vaccine for booster (3rd dose) 
means that one could get a Moderna even if the first 2 doses were Pfizer 
and vice-versa.  There is a 3rd vaccine name in that CDC URL but I dont 
know whether it is AZ or J&J (astrazeneca, johnson and johnson).

In Europe that 'any' vaccine for a 3rd dose has been recently decided to 
be only Pfizer or Moderna, after a brief period of hesitation where 
Pfizer seemed to be the only preferred.  In Europe there are 4 vaccines 
possible (AZ, Pfizer, J&J, Moderna) but only Moderna or Pfizer as 3rd 
dose.  That 3rd dose can be after any initial doses.

This is a very complex logic to implement in a verifier app, but it is 
not impossible.

I would say also that this little EU/US complication is nothing compared 
to other countries like, let's say, Vietnam.  It seems to me that in 
Vietnam many more vaccines are possible at least in the first 2 doses: 
the US/EU ones, and then the Chinese, Russian (Sputnik, first ever), 
Cuban and Vietnamien vaccine.

In the first place we should get an idea about what the Vietnamese 
authorities think it is the right thing for a 3rd dose; then compare 
that 'right' with the other 'right' beliefs.

Alex

---

From: Alexandre Petrescu <[email-masked]>
Date: Fri, 29 Oct 2021 09:57:16 +0200

Le 28/10/2021 à 19:03, John Levine a écrit :
>> It would be great to know whether the current verifier apps need a
>> live Internet connection when checking.  Or maybe they can check
>> based on a locally-stored component.
> 

Do you know if all covid-vaccinated people in USA have this SMART Health
Card?  Or only some people?

I am asking because I am told by some people in USA that what they have
is a paper 'Vaccination Record Card' which shows the 3 doses, their
brand name and time, and the person name and birth date.  It's a printed
table and filled with handwritten notes.  This 'Vaccination Record Card'
is not electronically signed.  There is no SSN (Social Security Number)
either.

Maybe all vaccinated people in USA have both this paper card and the
SMART version which itself includes a paper version.  Or maybe not.

In Europe all covid-related vaccinated people are issues a 'Digital
COVID Certificate' which is a pdf on a smartphone app, containing a QR
Code, and it can also be printed.  In some EU countries, there is a
similar paper card like the USA 'Vaccination Record Card' but it is used
only for other non-covid vaccines.

Alex

> R's, John

---

From: Alexandre Petrescu <[email-masked]>
Date: Fri, 29 Oct 2021 10:22:38 +0200

Le 27/10/2021 à 23:49, Jay Daley a écrit :
>>>> should care, because if the IETF ever held meetings under such

I think there might be a misunderstanding.  Maybe the misunderstanding 
is not intentional, which is a happy case.

If one wants to follow the local legislation to organise an IETF 
in-500person meeting in an EU country then one should consider a few things.

In some countries, e.g. where I live, the local legislation is under 
heavy debate.  Currently the laws are frozen and we live ok, but for 
March 2022 it is an unknown.  For example, we dont know how this QR Code 
verification will be performed (or not performed at all) in March 2022. 
  We know there is verification until Nov. 15th, and the discussion is 
whether to prolong until February, or until July, and how.   One might 
expect the prolongation to happen and, in that case, a plan for IETF 
in-500person meeting in March 2022 can be good.  It might be that no. 
It might be that the chhecks of this QR code is changed somehow - I dont 
know how - and it might affect how to plan for a meeting in March.  And, 
I dont know which EU country one considers for March 2022.

Second - this 'vaccination status'- is not well formulated.  It is not 
as simple as saying yes/no vaccinated can be allowed to the meeting 
site.  Because, the local legislation means that there are 3 conditions 
of being checked ok.  The result of these 3 conditions issues green or 
red color on the app.  Only one of the conditions is 'vaccination', and 
that 'vaccination' status has currently a 'full' or a 'partial' value, 
together with the brand of vaccine.  In the future, depending on 
choices, that might get a 3rd value (booster, etc.)  The other two 
conditions have nothing to do with vaccination.  One of these other two 
conditions is whether a person has contracted the virus and has 
developped natural antibodies (it is also called a 'certificat de 
rétablissement' in French and seems to be better than vaccination in 
some ways).  This is not 'vaccination'.  The other of these 3 conditions 
is whether the person was tested negatively PCR in the last 72 hours. 
This has nothing to do with vaccination either.  BEcause of these 3 
conditions one cant talk about a 'vaccination' status in Europe, but 
rather, maybe, a covid-related protection status; this can be 
abbreviated in short as a red/green condition of the app on smartphone, 
which is indeed a two value, but it is not 'vaccination' and it is not 
the law.

But, this is an EU situation, a local legislation.  It is not a wole 
world legislation.

BEcause of that, one should be very careful when assuming safety at a 
meeting where people come from various countries, because these 
covid-related statuses might vary from country to country.  For example, 
it might be that an USA person coming to Europe and being told that that 
place is full of people whose 'vaccination status' is ok is feeling 
safe.  But when given details and told that that 'vaccination status' 
might mean having contracted the virus and having developped natural 
anti-bodies (but not being vaccinated), then that person might feel a 
different kind of safety: more or less.

For that reason, one might ask whether the values of the covid-related 
status as reported by the QR code verifier apps correspond between the 
USA and Europe, and between other countries and Europe.

Are the 3 conditions (vaccinated 1/2, 2/2 | natural antibodies | PCR 
test) of the EU cert having precise equivalents in USA and in other 
countries?  Or no?  How to develop equivalencies?

Alex

>> IETF joins IATA and can use the airline system), I'm not quite sure
>> how we could avoid manual inspection of certificates and photo ID.
>>

---

From: Alexandre Petrescu <[email-masked]>
Date: Fri, 29 Oct 2021 10:24:29 +0200

>> for those that have not travelled internationally.

Again, simply put this is simply not true.

If I want to travel to USA from Europe the first thing I am being asked 
is a PCR test, not vaccination status.

Alex

> in-500person meeting in March 2022 can be good.  It might be that no. It 
> might be that the chhecks of this QR code is changed somehow - I dont

---

From: Alexandre Petrescu <[email-masked]>
Date: Fri, 29 Oct 2021 11:26:59 +0200

Le 29/10/2021 à 10:22, Alexandre Petrescu a écrit :
>>> global validation app.
> I think there might be a misunderstanding.  Maybe the
> misunderstanding is not intentional, which is a happy case.
> 
>  March 2022 it is an unknown.  For example, we dont know how this QR
> Code verification will be performed (or not performed at all) in
> March 2022. We know there is verification until Nov. 15th, and the
> discussion is whether to prolong until February, or until July, and
> how.   One might expect the prolongation to happen and, in that case,
> a plan for IETF in-500person meeting in March 2022 can be good.  It
> might be that no. It might be that the chhecks of this QR code is
> changed somehow - I dont know how - and it might affect how to plan
> for a meeting in March.  And, I dont know which EU country one
> considers for March 2022.
> 
> Second - this 'vaccination status'- is not well formulated.  It is
> not as simple as saying yes/no vaccinated can be allowed to the
> meeting site.  Because, the local legislation means that there are 3
> conditions of being checked ok.  The result of these 3 conditions
> issues green or red color on the app.  Only one of the conditions is
> 'vaccination', and that 'vaccination' status has currently a 'full'
> or a 'partial' value, together with the brand of vaccine.  In the
> future, depending on choices, that might get a 3rd value (booster,
> etc.)  The other two conditions have nothing to do with vaccination.
> One of these other two conditions is whether a person has contracted
> the virus and has developped natural antibodies (it is also called a
> 'certificat de rétablissement' in French and seems to be better than
> vaccination in some ways).  This is not 'vaccination'.  The other of
> these 3 conditions is whether the person was tested negatively PCR in
> the last 72 hours. This has nothing to do with vaccination either.
> BEcause of these 3 conditions one cant talk about a 'vaccination'
> status in Europe, but rather, maybe, a covid-related protection
> status; this can be abbreviated in short as a red/green condition of
> the app on smartphone, which is indeed a two value, but it is not
> 'vaccination' and it is not the law.
> 
> covid-related statuses might vary from country to country.  For
> example, it might be that an USA person coming to Europe and being
> told that that place is full of people whose 'vaccination status' is
> ok is feeling safe.  But when given details and told that that
> 'vaccination status' might mean having contracted the virus and
> having developped natural anti-bodies (but not being vaccinated),
> then that person might feel a different kind of safety: more or
> less.
> 
> For that reason, one might ask whether the values of the
> covid-related status as reported by the QR code verifier apps
> correspond between the USA and Europe, and between other countries
> and Europe.
> 

BEsides, if one looks at a certificate of PCR testing (such a
certificate is input into the covid-related cert, as one of the 3
conditions) one should know that the result of a PCR test is not just a
binary value; it's not as simple as saying 'I am negative'.  The result
of a PCR test has several values, including 'light traces of'.
Moreover, a test that leads to acceptation to visit some places is
actually a battery of 2 tests separated by 1 week of isolation.

Of course, one can ignore that, or one can consider it.

Alex

---

From: Alexandre Petrescu <[email-masked]>
Date: Fri, 29 Oct 2021 14:03:52 +0200

I learn now from two different people in two distinct states in USA 
about this USA COVID Vaccination Record Card, which is a paper printed 
and filled by hand, no stamp no signature.

I think maybe only California has this QR Code that Toerless mentioned.

I think this situation makes it very very different from Europe.

Alex

Le 29/10/2021 à 11:26, Alexandre Petrescu a écrit :
>>>>>> care, because if the IETF ever held meetings under
>>>>> app,
>>>>> three, for privacy reasons. What you can't do is

---

From: Toerless Eckert <[email-masked]>
Date: Fri, 29 Oct 2021 14:17:43 +0200

More interestingly to me is the question if a US/CA vax cert QR code is
even accepted in europe. Otherwise one is left with exactly irreplaceable
paper you got when getting vaxinated. REverse direction likewise
(EU vax cert QR card acceptability in NA).

On Fri, Oct 29, 2021 at 02:03:52PM +0200, Alexandre Petrescu wrote:
> I learn now from two different people in two distinct states in USA about
> this USA COVID Vaccination Record Card, which is a paper printed and filled
> by hand, no stamp no signature.
> 
> > > > > > > Assuming these are public keys, that seems
> > > > > > > ridiculous. We should care, because if the IETF ever
> > > > > > > held meetings under
> > > > > I am a bit surprised that the WHO has not produced a global
> > > > > cert format and a global validation method, and until they
> > > > > do (or the IETF joins IATA and can use the airline system),
> > > > > I'm not quite
> > > > > > vaccinated, recovered or tested negative, without
> > > > > > telling you which of the three, for privacy reasons.
> > > > > > What you can't do is

-- 
---
[email-masked]

---

From: Alexandre Petrescu <[email-masked]>
Date: Fri, 29 Oct 2021 14:50:08 +0200

Le 29/10/2021 à 14:17, Toerless Eckert a écrit :
> More interestingly to me is the question if a US/CA vax cert QR code 
> is even accepted in europe.

Tell me what is a US/CA vax cert QR code and I will tell you whether it
is accepted in Europe.

If you worry about privacy when trying to share your own US/CA vax cert
QR code with me, then there are a few ways out of this:

- I propose that in exchange of your QR code I send you by email my
   European Certificate QR code, so we have a same-level privacy.  Remark
   that when doing so I will share with you more than just my vax status:
   you will also know whether or not I had been infected in the past, or
   whether I tested PCR recently, and my birthdate.

- you can try to scan your own US/CA vax cert QR code with Eric's app at
   https://ehealth.vyncke.org/index.php  ERic is an AD, and he guarantees
   he does not store the contents, so we better trust him, and also
   because we know him.  In addition to Eric's verifier which is
   conformant to EU standards there is also this Austrian verifier also
   conformant to EU, but they dont guarantee they dont store:
   https://dgc.a-sit.at/ehn/ I have tried both these verifiers with my
   own QR Codes and they display correctly.

That should be enough ways out of it, suffices it to try.

> Otherwise one is left with exactly irreplaceable paper you got when 
> getting vaxinated. REverse direction likewise (EU vax cert QR card 
> acceptability in NA).

To do that, I would like to ask what is the URL of a verifier in the USA?

If you tell me the URL of a verifier in USA then I will try to scan my
own EU QR Code.

Alex

>> I learn now from two different people in two distinct states in
>> USA about this USA COVID Vaccination Record Card, which is a paper 
>> printed and filled by hand, no stamp no signature.
>> 
>>>>>>>> Assuming these are public keys, that seems ridiculous. 
>>>>>>>> We should care, because if the IETF ever held meetings 
>>>>>>>> under such conditions, we'd definitely want to be able 
>>>>>>>> to scan and verify any correctly signed cert from 
>>>>>>>> anywhere.
>>>>> Outside of special areas like Schengen, people travelling 
>>>>> into a country will be required to prove vaccination status 
>>>>> in order to enter the country, so all the IETF will need is 
>>>>> national validation for those that have not travelled 
>>>>> internationally.
>>>> 
>>>> If one wants to follow the local legislation to organise an 
>>>> IETF in-500person meeting in an EU country then one should 
>>>> consider a few things.
>>>> 
>>>> In some countries, e.g. where I live, the local legislation is 
>>>> under heavy debate.  Currently the laws are frozen and we live 
>>>> ok, but for March 2022 it is an unknown.  For example, we dont 
>>>> know how this QR Code verification will be performed (or not 
>>>> performed at all) in March 2022. We know there is verification 
>>>> until Nov. 15th, and the discussion is whether to prolong
>>>> until February, or until July, and how.   One might expect the 
>>>> prolongation to happen and, in that case, a plan for IETF 
>>>> in-500person meeting in March 2022 can be good.  It might be 
>>>> that no. It might be that the chhecks of this QR code is 
>>>> changed somehow - I dont know how - and it might affect how to 
>>>> plan for a meeting in March.  And, I dont know which EU
>>>> country one considers for March 2022.
>>>> 
>>>> Second - this 'vaccination status'- is not well formulated.
>>>> It is not as simple as saying yes/no vaccinated can be allowed
>>>> to the meeting site.  Because, the local legislation means
>>>> that there are 3 conditions of being checked ok.  The result
>>>> of these 3 conditions issues green or red color on the app.
>>>> Only one of the conditions is 'vaccination', and that
>>>> 'vaccination' status has currently a 'full' or a 'partial'
>>>> value, together with the brand of vaccine.  In the future,
>>>> depending on choices, that might get a 3rd value (booster,
>>>> etc.)  The other two conditions have nothing to do with
>>>> vaccination. One of these other two conditions is whether a
>>>> person has contracted the virus and has developped natural
>>>> antibodies (it is also called a 'certificat de rétablissement'
>>>> in French and seems to be better than vaccination in some
>>>> ways).  This is not 'vaccination'.  The other of these 3
>>>> conditions is whether the person was tested negatively PCR in
>>>> the last 72 hours. This has nothing to do with vaccination
>>>> either. BEcause of these 3 conditions one cant talk about a
>>>> 'vaccination' status in Europe, but rather, maybe, a
>>>> covid-related protection status; this can be abbreviated in
>>>> short as a red/green condition of the app on smartphone, which
>>>> is indeed a two value, but it is not 'vaccination' and it is
>>>> not the law.
>>>> 
>>>> But, this is an EU situation, a local legislation.  It is not
>>>> a wole world legislation.
>>>> 
>>>> BEcause of that, one should be very careful when assuming 
>>>> safety at a meeting where people come from various countries, 
>>>> because these covid-related statuses might vary from country
>>>> to country.  For example, it might be that an USA person coming
>>>> to Europe and being told that that place is full of people
>>>> whose 'vaccination status' is ok is feeling safe.  But when
>>>> given details and told that that 'vaccination status' might
>>>> mean having contracted the virus and having developped natural 
>>>> anti-bodies (but not being vaccinated), then that person might 
>>>> feel a different kind of safety: more or less.
>>>> 
>>>> correspond between the USA and Europe, and between other 
>>>> countries and Europe.
>>>> 
>>>> Are the 3 conditions (vaccinated 1/2, 2/2 | natural antibodies 
>>>> | PCR test) of the EU cert having precise equivalents in USA 
>>>> and in other countries?  Or no?  How to develop equivalencies?
>>> 
>>> conditions) one should know that the result of a PCR test is not
>>> just a binary value; it's not as simple as saying 'I am 
>>> negative'.  The result of a PCR test has several values, 
>>> including 'light traces of'. Moreover, a test that leads to 
>>> acceptation to visit some places is actually a battery of 2
>>> tests separated by 1 week of isolation.
>>> 
>>>>>> I'm not quite sure how we could avoid manual inspection of
>>>>>>> telling you which of the three, for privacy reasons. What
>>>>>>> you can't do is to come up with your own, different 
>>>>>>> requirements (e.g. vaccination only), unless you ask 
>>>>>>> people to show you the details in their certificate to 
>>>>>>> check them by hand, and they accept voluntarily. You 
>>>>>>> would still have to verify whether that's possible in
>>>>>>> the country where you are, as there are contexts in which
>>>>>>> it is illegal for someone to ask someone else whether
>>>>>>> they are vaccinated or not (e.g. employers with
>>>>>>> employees).
>>>>>> 
>>>>>> Whether the privacy regime in a particular country allows 
>>>>>> the IETF to check whatever we decide we need to check will 
>>>>>> became a new site selection criterion, I suppose. 
>>>>>> Personally I have no problem whatever in revealing my 
>>>>>> vaccination status to anyone who asks.
>>>>>> 
>>>>>> Brian
>>>>>> 
>>>>>>> By the way, there are rumours on Twitter that at least 
>>>>>>> one of the national private keys has been leaked 
>>>>>>> already...
>>>>>>

---

From: "John Levine" <[email-masked]>
Date: 29 Oct 2021 13:18:02 -0400

>I think maybe only California has this QR Code that Toerless mentioned.

New York had QR codes before anyone else, and as I have explained, has
recently updated their system to use standard Smart coding. Several
other states, such as Louisiana, also issue Smart codes.

However, very few people actually have the QR codes outside a few areas
where you need them to get into bars and such.

The standard document that everyone in the US has is a paper CDC card
with stamps and stickers to show the shots. I don't understand why
they didn't use the existing WHO yellow card, but we Americans are
always special.

Neither the QR code nor the paper card purport to identify anyone.  All they
say is that this person born on that date got these shots.  If there is a question
whether the person presenting the document is the one in the QR code or the card,
you need to check some form of ID.

Not sure what any of this has to do with IETF meetings, though.

R's,
John

---

From: Fred Baker <[email-masked]>
Date: Fri, 29 Oct 2021 10:27:34 -0700

> On Oct 29, 2021, at 12:57 AM, Alexandre Petrescu <[email-masked]> wrote:
> 

I live in the US, and I don't have such a card. I have a paper document from the store I got my shots at, with all of the security that implies.

---

From: Alexandre Petrescu <[email-masked]>
Date: Fri, 29 Oct 2021 21:42:27 +0200

Le 29/10/2021 à 19:18, John Levine a écrit :
> New York had QR codes before anyone else, and as I have explained,
> has recently updated their system to use standard Smart coding.
> Several other states, such as Louisiana, also issue Smart codes.

The New York initial use of QR codes is of QR codes of people or QR 
codes of places?  Just curious.

> However, very few people actually have the QR codes outside a few
> areas where you need them to get into bars and such.
> 
> The standard document that everyone in the US has is a paper CDC
> card with stamps and stickers to show the shots.

I did not see stamps and stickers on the two CDC US vaccination cards 
that I could see.  But that is not an issue that bothers me, because it 
is a security issue inside another country.

> I don't understand why they didn't use the existing WHO yellow card,
> but we Americans are always special.
> 
> Neither the QR code nor the paper card purport to identify anyone.
> All they say is that this person born on that date got these shots.
> If there is a question whether the person presenting the document is
> the one in the QR code or the card, you need to check some form of
> ID.
> 

It was said that if an in-person meeting is realized then that will have
to be done according to local legislation.  It was also said that the
March meeting might be in Europe.

If a meeting in Europe is organized in March then that will have to use
the EU QR code system which represents local legislaiton in Europe.

But the attendees of that meeting might come from USA where they have a
different QR code system - the SMART Health Card.

Other attendees might come from other non-EU countries where they have 
other QR code systems.

Typically local legislation asks to all such meetings scan QR codes at
the entrance.  It is yes bars and restaurants but also cinemas and other
gatherings.  I suspect local legislation imposes that a gathering like
IETF has to scan all participants.

So, I have a hard time to see a verifier at the entrance of the IETF
meeting in an EU country scanning QR codes of people that come from
outside Europe.  It will simply not scan the SMART Health Card.  Even if 
some dedicated IETF software scans it (e.g. an improved Eric's scanner), 
it has no meaning versus the legislation.

If a USA person comes with a paper card saying US CDC vaccination proof 
then that has no value either.

There are no equivalencies between values.  One cant equate 2 Pfizers 
plus 1 Moderna performed in a SMART Health Card's QR Code to a 'natural 
antibodies present' in an EU Digital Covid Cert's QR Code.  It 
conceptually does not fit.

I dont know how others see that problem.

Alex
PS: the question I asked earlier on whether or not the US CDC vax card 
or the US SMART Health Card has a photo of the bearer is because of the 
following:  in the past here in France there was a problem with 'Carte 
Vitale' card which was hacked on a large scale; part of the solution to 
that was to print the bearer's photo on it - the newest Carte Vitale 
cards here have photos on them; putting the photo of a person on a 
covid-related Cert might help against trafficking a little bit, and ease 
the verification process too; so I thought in other country, maybe USA 
maybe other, they might have already done that.  But it does not seem to 
be the case.  It might take time before photos appear on these certs, if 
at all.

---

From: John C Klensin <[email-masked]>
Date: Fri, 29 Oct 2021 16:23:09 -0400

--On Friday, October 29, 2021 21:42 +0200 Alexandre Petrescu
<[email-masked]> wrote:

>...
> But the attendees of that meeting might come from USA where
> they have a different QR code system - the SMART Health Card.

I understand the US is very confusing, but, as has apparently
not been clear from the comments of others, each state has its
own rules.  SMART Health Cards are in use in some, but not most.
Stickers and stamps are used in some states, but not others.  My
own card does not have a QR code, nor stamps, nor stickers, just
three lines of nearly-illegible scrawling that are, I think,
supposed to show the vaccine type, batch, date, and location
administered.

> Other attendees might come from other non-EU countries where
> they have other QR code systems.

Or, like large parts of the US, none at all.

>...
> outside Europe.  It will simply not scan the SMART Health
> Card.  Even if some dedicated IETF software scans it (e.g. an
> improved Eric's scanner), it has no meaning versus the
> legislation.
 
> If a USA person comes with a paper card saying US CDC
> vaccination proof then that has no value either.

Exactly.   But I would like to understand where you think this
leads?  No f2f meetings in any country that tries to establish a
serious system and then expects others to conform?   Wait for a
WHO system that substantially all countries accept?  Something
else?

> There are no equivalencies between values.  One cant equate 2
> Pfizers plus 1 Moderna performed in a SMART Health Card's QR
> Code to a 'natural antibodies present' in an EU Digital Covid
> Cert's QR Code.  It conceptually does not fit.
> 
> PS: the question I asked earlier on whether or not the US CDC
> vax card or the US SMART Health Card has a photo of the bearer
> is because of the following:  in the past here in France there
> was a problem with 'Carte Vitale' card which was hacked on a
> large scale; part of the solution to that was to print the
> bearer's photo on it - the newest Carte Vitale cards here have
> photos on them; putting the photo of a person on a
> covid-related Cert might help against trafficking a little
> bit, and ease the verification process too; so I thought in
> other country, maybe USA maybe other, they might have already
> done that.  But it does not seem to be the case.  It might
> take time before photos appear on these certs, if at all.

Getting photos on these cards not only requires a whole
additional level of technology but starts to create a real
binding between the card and some person's identity.  My card
has my name on it, but not even my signature.  And remember that
the US does not even have a national identity card system.  

Again, the prospect for an international system that is
recognized by everyone in all countries is, as one might predict
from today's situation, and efforts to fix it.  In practice, if
that is the condition for something important like holding
meetings, I think we are looking at several years if we are
lucky.  And, given the current state of world politics, I'd
expect that, even then, some countries would refuse to play.
Otherwise, we are going to be dependent on bilateral agreements
or maybe clustered multilateral ones at best... and, for the
IETF, whether we are willing to have meetings with participants
from certain countries excluded because of either their
infection levels or their failure to get their vaccination
certification systems recognized by others.  Of course, that
leads to the other question of whether we care more about some
countries than others.

   john

---

From: Fred Baker <[email-masked]>
Date: Fri, 29 Oct 2021 14:06:08 -0700

Thanks. So the accurate statement is that I can get one.

> On Oct 29, 2021, at 1:23 PM, John C Klensin <[email-masked]> wrote:
> 
> 
>

---

From: Fred Baker <[email-masked]>
Date: Fri, 29 Oct 2021 14:13:01 -0700

Thanks. I have done so. 

> On Oct 29, 2021, at 2:06 PM, Fred Baker <[email-masked]> wrote:
>

---

From: "John R Levine" <[email-masked]>
Date: 29 Oct 2021 18:05:01 -0400

On Fri, 29 Oct 2021, Alexandre Petrescu wrote:
> The New York initial use of QR codes is of QR codes of people or QR codes of 
> places?  Just curious.

Neither.  It's a QR code that, as I said before, says this person got 
these vaccines (or tests) on that date.  The person is described by name 
and date of birth.  The NY code also has an expiration date, a year for 
the vaccines and a few days for the tests.  Dunno if other states have 
those.

> I did not see stamps and stickers on the two CDC US vaccination cards that I 
> could see.  But that is not an issue that bothers me, because it is a 
> security issue inside another country.

Mine has stamps and stickers.  Not very sophisticated ones.  They just say 
which batch of which vaccine I got so they didn't have to scribble them 
onto the card by hand.

> different QR code system - the SMART Health Card.

In some states, and nothing at all in other states.

> PS: the question I asked earlier on whether or not the US CDC vax card or the 
> US SMART Health Card has a photo of the bearer

For about the fourth time, no they do not.  They do not purport to 
identify anyone.  I have a copy of my wife's QR code on my phone along
with my own, in case we happen to go somewhere and she doesn't have her 
phone.  That is perfectly OK, because the codes do not purport to identify anyone.

I was planning to go to a meeting in France next month (which of course 
was cancelled) and the French government had a process for overseas 
visitors to get a French vaccine code in the French app.  I expect we will 
see that from other countries that want people to visit.

Regards,

---

From: "Bron Gondwana" <[email-masked]>
Date: Sat, 30 Oct 2021 18:36:50 +1100

> phone.  That is perfectly OK, because the codes do not purport to identify anyone.

Which makes them, for solid authentication of vaccination status, as valuable as "I solemnly swear that I am up to no good^W^W^W^W^Wfully vaccinated".  All you would need to do is flash a copy of anybody vaccinated's QR code and claim that it is your own.

The countermeasure of course to such ideas is "heavy fine for anybody found have used somebody else's code as their own" but that's still pretty much on par with "heavy fine for anybody found to have lied to the question" since it relies on post-facto enforcement rather than being verifiable at the time.

Bron.

--
  Bron Gondwana, CEO, Fastmail Pty Ltd
  [email-masked]

---

From: "Bron Gondwana" <[email-masked]>
Date: Sat, 30 Oct 2021 18:44:21 +1100

> I live in the US, and I don't have such a card. I have a paper document from the store I got my shots at, with all of the security that implies.

I live in Australia so my records are centrally stored by the government in a database which privacy advocates characterise as "super secure and very well implemented"[1].

I also get a shiny PDF and now that I've linked up the goverment app, when I scan QR codes at my favourite beverage establishments, my screen twinkles with very nice watermark-like images and a pleasant green tick.

Bron.

[1] https://privacy.org.au/campaigns/myhr/
--
  Bron Gondwana, CEO, Fastmail Pty Ltd
  [email-masked]

---

From: Alexandre Petrescu <[email-masked]>
Date: Sat, 30 Oct 2021 10:44:17 +0200

Le 30/10/2021 à 09:44, Bron Gondwana a écrit :
>> > On Oct 29, 2021, at 12:57 AM, Alexandre Petrescu 
>> I live in the US, and I don't have such a card. I have a paper 
>> document from the store I got my shots at, with all of the security 
>> that implies.
> 
> I live in Australia so my records are centrally stored by the government 
> in a database which privacy advocates characterise as "super secure and 
> very well implemented"[1].
> 
> I also get a shiny PDF and now that I've linked up the goverment app, 
> when I scan QR codes at my favourite beverage establishments, my screen 
> twinkles with very nice watermark-like images and a pleasant green tick.

Does it tick green only because of vaccination or does it tick green 
also when 'naturally developped antibodies' or 'PCR test negative recent'?

Alex

> <https://privacy.org.au/campaigns/myhr/>
> --

---

From: Alexandre Petrescu <[email-masked]>
Date: Sat, 30 Oct 2021 11:17:48 +0200

Le 29/10/2021 à 22:23, John C Klensin a écrit :
[...]

>> If a USA person comes with a paper card saying US CDC vaccination 
>> proof then that has no value either.
> 
> serious system and then expects others to conform?   Wait for a WHO
> system that substantially all countries accept?  Something else?

Where I think it leads?  It leads to a need to have a common
understanding of being protected which could further be implemented.

Reject country candidates for meeting without system?  No, I dont think
so.  There is a note I did make a few months ago in which I say that not
even this system in EU (Digital EU COVID certificates) is not a system
that fully works - it does not stop the spread.

Besides, EU like all other countries has failed in logic during
vaccination, because of the urgent need to vaccinate and because
vaccination works only if applied to large populations.  Vaccination was
and is still seen as the best possible way forward.  But it still is
true that it is illogic to vaccinate before testing.  A programmer or a
scientist or anybody with logic thinking will not accept that (vaccinate
before testing), even though a doctor or epidemiologist will say that is
the best thing to do.

But that discussion of science-vs-doctors apart, and apart my agreement
to vaccinate myself, there is still a need to understand what it means
to be protected, in a common way.

Vaccination is an answer, but in details, look at the meaning of the QR
codes, and they offer very different answers, some of which include
vaccination, some of which are not vaccination at all.

Wait for a WHO system that all countries accept?  Maybe not wait, but
push for it.  What can IETF do to push for a common format at WHO?  At
WHO or elsewhere?

Something else?  If there is something else that needs to happen is to
have a common understanding of what it means protection.

>> Pfizers plus 1 Moderna performed in a SMART Health Card's QR Code 
>> to a 'natural antibodies present' in an EU Digital Covid Cert's QR 
>> Code.  It conceptually does not fit.
>> 
>> Alex PS: the question I asked earlier on whether or not the US CDC
>>  vax card or the US SMART Health Card has a photo of the bearer is
>>  because of the following:  in the past here in France there was a
>>  problem with 'Carte Vitale' card which was hacked on a large
>> scale; part of the solution to that was to print the bearer's photo
>> on it - the newest Carte Vitale cards here have photos on them;
>> putting the photo of a person on a covid-related Cert might help
>> against trafficking a little bit, and ease the verification process
>> too; so I thought in other country, maybe USA maybe other, they
>> might have already done that.  But it does not seem to be the case.
>> It might take time before photos appear on these certs, if at all.
> 
> Getting photos on these cards not only requires a whole additional 
> level of technology but starts to create a real binding between the 
> card and some person's identity.  My card has my name on it, but not 
> even my signature.  And remember that the US does not even have a 
> national identity card system.

I agree with each point above.

It might be that a photo on a pdf with QR code is not that difficult to
make, or it might be it is too expensive.

It might also be that a photo on that pdf with QR code helps stopping
the spread with 1% chances, which is very little compared to the need.

> Again, the prospect for an international system that is recognized
> by everyone in all countries is, as one might predict from today's 
> situation, and efforts to fix it.  In practice, if that is the 
> condition for something important like holding meetings, I think we 
> are looking at several years if we are lucky.

The above paragraph ^ is an observation, a report, to which I do not
disagree.

I would like to help to shorten that several years time, but I dont know
how.

Forcing to organise meetings without a clear understanding of whether
the virus propagates or not, is not an answer for me personally.

> And, given the current state of world politics, I'd expect that, even
> then, some countries would refuse to play. Otherwise, we are going to
> be dependent on bilateral agreements or maybe clustered multilateral
> ones at best...

These agreements are structures of trust.

We might develop our own IETF structure of trust for IETF in-person
meetings.

> and, for the IETF, whether we are willing to have meetings with 
> participants from certain countries excluded because of either their 
> certification systems recognized by others.

No, there should not be exclusion based on country of origin legislation
for COVID.

If it seems difficult to agree on a common way of what it means
'protection' (when it comes to vaccine brands and no. of doses, or on
natural antibody presence criteria) what might be easier to agree on is
the PCR test results.  That is again something I might sound like a
broken record saying it, but it is a possibility.  These PCR test
results are not simple yes/no answers, but at least they are values on a
single scale, and correspond to a unique agreed characterization of the
danger - the DNA of the virus.  All the other criteria (vaccine brands,
natural antibodies) are on different scales, hence difficult to compare
and agree.

> Of course, that leads to the other question of whether we care more 
> about some countries than others.

That is a question of no sense in a place where what matters is how to
make Internet better in all countries.  Put simply: no, no limitation on
country.

Alex

---

From: Alexandre Petrescu <[email-masked]>
Date: Sat, 30 Oct 2021 11:21:26 +0200

Le 30/10/2021 à 11:17, Alexandre Petrescu a écrit :
> 
> 
> Le 29/10/2021 à 22:23, John C Klensin a écrit : [...]
> 
> Reject country candidates for meeting without system?  No, I dont
> think so.  There is a note I did make a few months ago in which I say
> that not even this system in EU (Digital EU COVID certificates) is
> not a system that fully works - it does not stop the spread.
> 
> vaccination works only if applied to large populations.  Vaccination
> was and is still seen as the best possible way forward.  But it still
> is true that it is illogic to vaccinate before testing.  A programmer
> or a scientist or anybody with logic thinking will not accept that
> (vaccinate before testing), even though a doctor or epidemiologist
> will say that is the best thing to do.
> 
> But that discussion of science-vs-doctors apart, and apart my
> agreement to vaccinate myself, there is still a need to understand
> what it means to be protected, in a common way.
> 
> Vaccination is an answer, but in details, look at the meaning of the
> QR codes, and they offer very different answers, some of which
> include vaccination, some of which are not vaccination at all.
> 
> Wait for a WHO system that all countries accept?  Maybe not wait,
> but push for it.  What can IETF do to push for a common format at
> WHO?  At WHO or elsewhere?
> 
> Something else?  If there is something else that needs to happen is
> to have a common understanding of what it means protection.
> 
>>> to a 'natural antibodies present' in an EU Digital Covid Cert's
>>> QR Code. It conceptually does not fit.
>>> 
>>> Alex PS: the question I asked earlier on whether or not the US
>>> CDC vax card or the US SMART Health Card has a photo of the
>>> bearer is because of the following:  in the past here in France
>>> there was a problem with 'Carte Vitale' card which was hacked on
>>> a large scale; part of the solution to that was to print the
>>> photos on them; putting the photo of a person on a covid-related
>>> Cert might help against trafficking a little bit, and ease the
>>> verification process too; so I thought in other country, maybe
>>> USA maybe other, they might have already done that.  But it does
>>> not seem to be the case. It might take time before photos appear
>>> on these certs, if at all.
>> 
>>  level of technology but starts to create a real binding between
>> the card and some person's identity.  My card has my name on it,
>> but not even my signature.  And remember that the US does not even
>> have a national identity card system.
> 
> It might be that a photo on a pdf with QR code is not that difficult
> to make, or it might be it is too expensive.
> 
> It might also be that a photo on that pdf with QR code helps
> stopping the spread with 1% chances, which is very little compared to
> the need.
> 
> I would like to help to shorten that several years time, but I dont
> know how.
> 
> Forcing to organise meetings without a clear understanding of
> whether the virus propagates or not, is not an answer for me
> personally.
> 
>> And, given the current state of world politics, I'd expect that,
>> even then, some countries would refuse to play. Otherwise, we are
>> going to be dependent on bilateral agreements or maybe clustered
>> multilateral ones at best...
> 
>> participants from certain countries excluded because of either
>> their infection levels or their failure to get their vaccination 
> No, there should not be exclusion based on country of origin
> legislation for COVID.
> 
> 'protection' (when it comes to vaccine brands and no. of doses, or
> on natural antibody presence criteria) what might be easier to agree
> on is the PCR test results.  That is again something I might sound
> like a broken record saying it, but it is a possibility.  These PCR
> test results are not simple yes/no answers, but at least they are
> values on a single scale, and correspond to a unique agreed
> characterization of the danger - the DNA of the virus.  All the other
> criteria (vaccine brands, natural antibodies) are on different
> scales, hence difficult to compare and agree.

Edit, for completeness: even the PCR test results on their unique scales
are not 100% guarantees that the virus is absent from the body.  The
comparison was made to AIDS and other illnesses where it is currently
studied how comes some people re-issue it even after isolation and
multiple negative tests.  It is not a simple 'scientific' thing.

Alex

> That is a question of no sense in a place where what matters is how
> to make Internet better in all countries.  Put simply: no, no
> limitation on country.
> 
> Alex
> 
>> 
>> john
>> 
>

---

From: John C Klensin <[email-masked]>
Date: Sat, 30 Oct 2021 09:12:40 -0400

Thanks for the explanation.  It help a lot.  And, yes, the need
is clear and I hope there is little disagreement about that
around the IETF.  As to what the IETF can do to move WHO (or,
I've now been told, that ITU/WHO/ISO alliance -- not a group
that is known for moving quickly and decisively), my guess is
very little.

best,   
   john

--On Saturday, October 30, 2021 11:17 +0200 Alexandre Petrescu
<[email-masked]> wrote:

>> leads? No f2f meetings in any country that tries to establish
>> a serious system and then expects others to conform?   Wait
>> for a WHO system that substantially all countries accept?
>> Something else?
> 
> agreement
>>> There are no equivalencies between values.  One cant equate
>>> 2  Pfizers plus 1 Moderna performed in a SMART Health Card's
>>> QR Code  to a 'natural antibodies present' in an EU Digital
>>> Covid Cert's QR  Code.  It conceptually does not fit.
>>> 
>>> Alex PS: the question I asked earlier on whether or not the
>>> US CDC vax card or the US SMART Health Card has a photo of
>>>  the bearer is because of the following:  in the past here
>>>  in France there was a problem with 'Carte Vitale' card
>>>  which was hacked on a large scale; part of the solution to
>>> that was to print the bearer's photo on it - the newest
>>> Carte Vitale cards here have photos on them; putting the
>>> photo of a person on a covid-related Cert might help against
>>> trafficking a little bit, and ease the verification process
>>> too; so I thought in other country, maybe USA maybe other,
>>> they might have already done that.  But it does not seem to
>>> be the case. It might take time before photos appear on
>>> these certs, if at all.
>> 
>> binding between the  card and some person's identity.  My
>> card has my name on it, but not  even my signature.  And
>> remember that the US does not even have a  national identity
>> card system.
> 
> stopping
>> recognized by everyone in all countries is, as one might
>> predict from today's  situation, and efforts to fix it.  In
>> practice, if that is the  condition for something important
>> like holding meetings, I think we  are looking at several
>> years if we are lucky.
> 
> whether
>> And, given the current state of world politics, I'd expect
>> that, even then, some countries would refuse to play.
>> Otherwise, we are going to be dependent on bilateral
>> agreements or maybe clustered multilateral ones at best...
> 
>> and, for the IETF, whether we are willing to have meetings
>> with  participants from certain countries excluded because of
>> either their  infection levels or their failure to get their
>> vaccination  certification systems recognized by others.
> 
> legislation
>> Of course, that leads to the other question of whether we
>> care more  about some countries than others.
>

---

From: "John Levine" <[email-masked]>
Date: 30 Oct 2021 12:58:16 -0400

We may be Americans but we are not totally stupid.  On both the app and the printed paper pass it says
"Please have photo ID available when presenting your Pass Plus for verification."

As I may have said once or twice, the pass does not purport to identify anyone.  If you want an ID,
we have forms of ID.  Sometimes people check, sometimes not, nothing new about that.

The linkage between ID and medical records is one way.  If you can demonstrate that you are
person X, you can have access to person X's medical records, but access to the records doesn't
prove you are person X.  There are all sorts of plausible reasons that someone who is not you would
have access to your records.

R's,
John

---

From: Christian Huitema <[email-masked]>
Date: Sat, 30 Oct 2021 17:11:36 -0700

> The countermeasure of course to such ideas is "heavy fine for anybody found have used somebody else's code as their own" but that's still pretty much on par with "heavy fine for anybody found to ha…

That's however a very typical approach in the USA. Swearing that 
something is true when it is not is committing perjury, and that means 
jail, not just fine. Procurers will likely throw in a charge of identity 
theft for good effect. Even if you don't swear anything and merely lie 
to the computer system, you can still be in a heap of trouble, e.g.: 
https://www.kiro7.com/news/trending/former-nba-player-lazar-hayward-arrested-hawaii-accused-submitting-fake-covid-19-docs/XDA6274UJRBPTFJOBV4TBDZBYA/. 
That's a very different approach to say, France, in which the 
administration will never believe you unless you bring a proof in 
triplicate. Having tried both, I like the US approach better.

-- Christian Huitema

---

From: "Bron Gondwana" <[email-masked]>
Date: Sun, 31 Oct 2021 13:05:49 +1100

> also when 'naturally developped antibodies' or 'PCR test negative recent'?

In Dan Andrews' Victoria we Believe In The Science[tm].  At least, some very specific science.  We don't yet believe in mixed vaccines, and we certainly don't believe in immunity obtained any other way than the approved vaccines.

The app only ticks for two doses, both of the same vaccine, from the three approved vaccines on the current list, as entered in your MyHeathRecord.

Ditto for anybody returning from overseas:

https://www.abc.net.au/news/2021-10-27/australians-with-mixed-vaccine-doses-unable-to-travel-home/100566466 

This is old news (4 days old) and the rules are kinda in flux here, but we're still not going to allow tennis players who haven't complied with the vaccine requirements to play in Victoria next year:

https://au.sports.yahoo.com/tennis-2021-fans-fume-australian-open-vaccine-farce-195148561.html

... because it would be unfair for the audience who are forced to be vaccinated to enter if the players were allowed to not be vaccinated.

Bron.

---

From: Alexandre Petrescu <[email-masked]>
Date: Sun, 31 Oct 2021 04:16:15 +0100

Le 30/10/2021 à 18:58, John Levine a écrit :
>>> For about the fourth time, no they do not.  They do not purport 
>>> to identify anyone.  I have a copy of my wife's QR code on my 
>>> phone along with my own, in case we happen to go somewhere and 
>>> she doesn't have her phone.  That is perfectly OK, because the 
>>> codes do not purport to identify anyone.
>> 
>> Which makes them, for solid authentication of vaccination status, 
>> as valuable as "I solemnly swear that I am up to no 
>> good^W^W^W^W^Wfully vaccinated".  All you would need to do is flash
>> a copy of anybody vaccinated's QR code and claim that it is your
>> own.
> 
> We may be Americans but we are not totally stupid.  On both the app 
> and the printed paper pass it says "Please have photo ID available 
> when presenting your Pass Plus for verification."

I noticed the way it is expressed.  I have to clarify myself.

If we agree that what we discuss here is about the problem of how to
organise partially in-person meetings in the usual IETF way of
inclusiveness...

In that sense, the problem is not that much about local security
problems of paperwork, or of protection against badly intended humans
faking papers.  But rather the problem is to identify equivalencies
between two distinct country citizens beliefs of being protected against
this bad virus.

As such, I will gladly convert my own paper QR code to a US
CDC vax record paper.  My name, birthdate and two doses of Pfizer
mentioned on my EU QR code could amount to the entries in the US CDC vax
record paper.  But, I dont have the batch number in my QR code whereas
some CDC US vax cards require it.  That might be a problem worth
considering towards reaching equivalency.  There are solutions because I
could maybe find my vax batch numbers in other vaccination papers, not
in the QR code (lost during QR conversions).

The conversion question could be raised the other way around too: since
this MArch meeting is leaning probably, or not, towards an EU place, the
question would be how to convert a US CDC vax card contents towards an
EU COVID certificate contents, regardless of how secure (or insecure)
these two documents are facing human faking attack.

Another aspect that US participants in an EU meeting should consider is
the following: maybe when they attend a bar meeting in USA they feel a
certain level of safety because they think everyone there in the bar is
vaccinated.  But if they attend a bar meeting in EU they should know
that it is not because all of them have valid QR codes that they are all
vaccinated: some might have PCR tests, or have met the virus a few weeks
ago.  That is also part of the conversion process.

The other aspects, e.g. some CDC US vax cards state 'have photo ID
available' while others no, or that some fake EU COVID certs do
circulate, are not really a problem IMHO.  Our discussion is about
organising IETF partially in-person meetings; I stress I respect the
local decision of the way vax papers and QR codes work - it is their own
sense of how to protect against badly intended humans.  Also, I dont
necessarily believe in a pretended superiority of electronic QR codes vs
papers, I dont carry a smartphone myself, etc.

Alex

> 
> As I may have said once or twice, the pass does not purport to 
> identify anyone.  If you want an ID, we have forms of ID.  Sometimes
>  people check, sometimes not, nothing new about that.
> 
> The linkage between ID and medical records is one way.  If you can 
> demonstrate that you are person X, you can have access to person X's
>  medical records, but access to the records doesn't prove you are 
> person X.  There are all sorts of plausible reasons that someone who
>  is not you would have access to your records.
> 
> R's, John
> 
>

---

From: "John Levine" <[email-masked]>
Date: 30 Oct 2021 23:21:47 -0400

It appears that Christian Huitema  <[email-masked]> said:
>> The countermeasure of course to such ideas is "heavy fine for anybody found have used somebody else's code ...

Hm, QR code with a name and birth date but no photo.

What can we do?

Huge fines?  Death penalty?

Wait ... hold on ... this is wild, this is crazy, but maybe, just maybe, it might work ...

SHOW A PHOTO ID AND SEE IF THE NAME AND DATE MATCH.

(Like it says on the fripping screen under the QR code.)

Sheesh.

R's,
John

---

From: Alexandre Petrescu <[email-masked]>
Date: Sun, 31 Oct 2021 04:24:37 +0100

Le 31/10/2021 à 03:05, Bron Gondwana a écrit :
>>> I also get a shiny PDF and now that I've linked up the goverment
>>> app, when I scan QR codes at my favourite beverage
>>> establishments, my screen twinkles with very nice watermark-like
>>> images and a pleasant green tick.
>> 
>> Does it tick green only because of vaccination or does it tick
>> green also when 'naturally developped antibodies' or 'PCR test
>> negative recent'?
> 
> In Dan Andrews' Victoria we Believe In The Science[tm].  At least,
> some very specific science.  We don't yet believe in mixed vaccines,
> and we certainly don't believe in immunity obtained any other way
> than the approved vaccines.

But, does one believe in tests? :-)  Negative testing - as decided to be
'negative' by a doctor seeing a 4-page long PCR test result - is also
making an EU QR code to blink green in verifier app.

Alex

> 
> The app only ticks for two doses, both of the same vaccine, from the
>  three approved vaccines on the current list, as entered in your 
> MyHeathRecord.
> 
> <https://www.abc.net.au/news/2021-10-27/australians-with-mixed-vaccine-doses-unable-to-travel-home/100566466>
> 
> 
> 
> This is old news (4 days old) and the rules are kinda in flux here,
> but we're still not going to allow tennis players who haven't
> complied with the vaccine requirements to play in Victoria next
> year:
> 
> <https://au.sports.yahoo.com/tennis-2021-fans-fume-australian-open-vaccine-farce-195148561.html>
>
>  ... because it would be unfair for the audience who are forced to be
>  vaccinated to enter if the players were allowed to not be
> vaccinated.
> 
> Bron. -- Bron Gondwana, CEO, Fastmail Pty Ltd [email-masked]
> 
> 
>

---

From: Alexandre Petrescu <[email-masked]>
Date: Sun, 31 Oct 2021 04:29:22 +0100

Le 31/10/2021 à 04:21, John Levine a écrit :
>>> good^W^W^W^W^Wfully vaccinated".  All you would need to do is
>>> flash a copy of anybody vaccinated's QR code
>> and claim that it is your own.
>>> 
>>> The countermeasure of course to such ideas is "heavy fine for
>>> anybody found have used somebody else's code ...
> 

I agree it is a best way to work in certain places.  If I go there I
will abide to that.

But in other places, one should know that such a req to show photo ids
is not appreciated.  Where I live, I happily show my photo ID when
signing a paper check, but many people around me fear that being
required to show a photo ID for other reasons amounts to bad
rememberings that should not even be talked about.

Alex

---

From: Alexandre Petrescu <[email-masked]>
Date: Sun, 31 Oct 2021 17:14:23 +0100

The example given at the Linux Summit seems to be saying that that app 
is CLEAR Health Pass.

The example given at linux summit talks about manual verification of 
other gov't issued passes which are not CLEAR Health Passes.

If this kind of method (manual checking of various passes) is applied 
for an in-person meeting for IETF obviously one would like to know what 
is the algorithm is applied by the manual verifiers.  It is my case, I 
want to know.

Le 29/10/2021 à 14:17, Toerless Eckert a écrit :
> paper you got when getting vaxinated.

I have a supposition  here: it might be they use in practice the photos 
of cards, not the cards themselves.

> REverse direction likewise

That is a very good question that I wonder too.

In the first place I wonder whether people in NA can access the verifier 
URLs of Europe, or are they blocked as I am blocked when I try to access 
the CLEAR web pages from here in Europe.

ALex

https://www.clearme.com/healthpass/

>  Error 1020 Ray ID: 6a6e12b148997539 • 2021-10-31 15:56:22 UTC
> Access denied
> What happened?
> 
> This website is using a security service to protect itself from online attacks.
> 
> Cloudflare Ray ID: 6a6e12b148997539 • Your IP: [err, my IPv4 address] • Performance & security by Cloudflare