Subject: Re: [Manycouches] [EXT] Re: What others are doing

From: Alexandre Petrescu <[email-masked]>
Date: Tue, 2 Nov 2021 14:04:36 +0100

Le 31/10/2021 à 17:14, Alexandre Petrescu a écrit :
[...]
> https://www.clearme.com/healthpass/
> 
>>  Error 1020 Ray ID: 6a6e12b148997539 • 2021-10-31 15:56:22 UTC
>> Access denied
>> What happened?
>>
>> This website is using a security service to protect itself from online 
>> attacks.
>>
>> Cloudflare Ray ID: 6a6e12b148997539 • Your IP: [err, my IPv4 address] 
>> • Performance & security by Cloudflare

Someone in the list enlightened me.

The CLEAR URL is visible from USA.  This 'CLEAR' is a private 
organisation effort.  If one is in USA then one can go to that URL, fill 
in some forms, and get a verifiable code.

If one is not in the USA that URL seems to not work.

This is not a desirable situation, obviously, and alternatives are 
possible, as illustrated by EU PC able to browse Australian MyHealthApp 
site.

Alex

> 
> 
> 
> 
> 
> 
> 
> 
>>
>> On Fri, Oct 29, 2021 at 02:03:52PM +0200, Alexandre Petrescu wrote:
>>> I learn now from two different people in two distinct states in USA 
>>> about
>>> this USA COVID Vaccination Record Card, which is a paper printed and 
>>> filled
>>> by hand, no stamp no signature.
>>>
>>> I think maybe only California has this QR Code that Toerless mentioned.
>>>
>>> I think this situation makes it very very different from Europe.
>>>
>>> Alex
>>>
>>> Le 29/10/2021 à 11:26, Alexandre Petrescu a écrit :
>>>>
>>>>
>>>> Le 29/10/2021 à 10:22, Alexandre Petrescu a écrit :
>>>>>
>>>>>
>>>>> Le 27/10/2021 à 23:49, Jay Daley a écrit :
>>>>>>
>>>>>>
>>>>>>> On 28/10/2021, at 8:54 AM, Brian E Carpenter
>>>>>>> <[email-masked]> wrote:
>>>>>>>
>>>>>>> On 27-Oct-21 18:34, Vittorio Bertola wrote:
>>>>>>>>> Il 26/10/2021 21:42 Brian E Carpenter
>>>>>>>>> <[email-masked]> ha scritto:
>>>>>>>>>
>>>>>>>>> Assuming these are public keys, that seems
>>>>>>>>> ridiculous. We should care, because if the IETF ever
>>>>>>>>> held meetings under
>>>>>>>>> such conditions, we'd definitely want to be able to scan and
>>>>>>>>> verify any correctly signed cert from anywhere.
>>>>>>>> But you can do that - you can just use the free official
>>>>>>>> validation app,
>>>>>>>
>>>>>>> That answer works on a national basis. The IETF would need a
>>>>>>> global validation app.
>>>>>>
>>>>>> Outside of special areas like Schengen, people travelling into a
>>>>>> country will be required to prove vaccination status in order to
>>>>>> enter the country, so all the IETF will need is national
>>>>>> validation for those that have not travelled internationally.
>>>>>
>>>>> I think there might be a misunderstanding.  Maybe the
>>>>> misunderstanding is not intentional, which is a happy case.
>>>>>
>>>>> If one wants to follow the local legislation to organise an IETF
>>>>> in-500person meeting in an EU country then one should consider a few
>>>>>   things.
>>>>>
>>>>> In some countries, e.g. where I live, the local legislation is under
>>>>>   heavy debate.  Currently the laws are frozen and we live ok, but for
>>>>>   March 2022 it is an unknown.  For example, we dont know how this QR
>>>>> Code verification will be performed (or not performed at all) in
>>>>> March 2022. We know there is verification until Nov. 15th, and the
>>>>> discussion is whether to prolong until February, or until July, and
>>>>> how.   One might expect the prolongation to happen and, in that case,
>>>>> a plan for IETF in-500person meeting in March 2022 can be good.  It
>>>>> might be that no. It might be that the chhecks of this QR code is
>>>>> changed somehow - I dont know how - and it might affect how to plan
>>>>> for a meeting in March.  And, I dont know which EU country one
>>>>> considers for March 2022.
>>>>>
>>>>> Second - this 'vaccination status'- is not well formulated.  It is
>>>>> not as simple as saying yes/no vaccinated can be allowed to the
>>>>> meeting site.  Because, the local legislation means that there are 3
>>>>> conditions of being checked ok.  The result of these 3 conditions
>>>>> issues green or red color on the app.  Only one of the conditions is
>>>>> 'vaccination', and that 'vaccination' status has currently a 'full'
>>>>> or a 'partial' value, together with the brand of vaccine.  In the
>>>>> future, depending on choices, that might get a 3rd value (booster,
>>>>> etc.)  The other two conditions have nothing to do with vaccination.
>>>>> One of these other two conditions is whether a person has contracted
>>>>> the virus and has developped natural antibodies (it is also called a
>>>>> 'certificat de rétablissement' in French and seems to be better than
>>>>> vaccination in some ways).  This is not 'vaccination'.  The other of
>>>>> these 3 conditions is whether the person was tested negatively PCR in
>>>>> the last 72 hours. This has nothing to do with vaccination either.
>>>>> BEcause of these 3 conditions one cant talk about a 'vaccination'
>>>>> status in Europe, but rather, maybe, a covid-related protection
>>>>> status; this can be abbreviated in short as a red/green condition of
>>>>> the app on smartphone, which is indeed a two value, but it is not
>>>>> 'vaccination' and it is not the law.
>>>>>
>>>>> But, this is an EU situation, a local legislation.  It is not a wole
>>>>>   world legislation.
>>>>>
>>>>> BEcause of that, one should be very careful when assuming safety at a
>>>>>   meeting where people come from various countries, because these
>>>>> covid-related statuses might vary from country to country.  For
>>>>> example, it might be that an USA person coming to Europe and being
>>>>> told that that place is full of people whose 'vaccination status' is
>>>>> ok is feeling safe.  But when given details and told that that
>>>>> 'vaccination status' might mean having contracted the virus and
>>>>> having developped natural anti-bodies (but not being vaccinated),
>>>>> then that person might feel a different kind of safety: more or
>>>>> less.
>>>>>
>>>>> For that reason, one might ask whether the values of the
>>>>> covid-related status as reported by the QR code verifier apps
>>>>> correspond between the USA and Europe, and between other countries
>>>>> and Europe.
>>>>>
>>>>> Are the 3 conditions (vaccinated 1/2, 2/2 | natural antibodies | PCR
>>>>>   test) of the EU cert having precise equivalents in USA and in other
>>>>>   countries?  Or no?  How to develop equivalencies?
>>>>
>>>> BEsides, if one looks at a certificate of PCR testing (such a
>>>> certificate is input into the covid-related cert, as one of the 3
>>>> conditions) one should know that the result of a PCR test is not just a
>>>> binary value; it's not as simple as saying 'I am negative'.  The result
>>>> of a PCR test has several values, including 'light traces of'.
>>>> Moreover, a test that leads to acceptation to visit some places is
>>>> actually a battery of 2 tests separated by 1 week of isolation.
>>>>
>>>> Of course, one can ignore that, or one can consider it.
>>>>
>>>> Alex
>>>>
>>>>>
>>>>> Alex
>>>>>
>>>>>>
>>>>>> Jay
>>>>>>
>>>>>>> I am a bit surprised that the WHO has not produced a global
>>>>>>> cert format and a global validation method, and until they
>>>>>>> do (or the IETF joins IATA and can use the airline system),
>>>>>>> I'm not quite
>>>>>>> sure how we could avoid manual inspection of certificates and
>>>>>>> photo ID.
>>>>>>>
>>>>>>>> which however will just tell you whether the person is
>>>>>>>> vaccinated, recovered or tested negative, without
>>>>>>>> telling you which of the three, for privacy reasons.
>>>>>>>> What you can't do is
>>>>>>>> to come up with your own, different requirements (e.g.
>>>>>>>> vaccination only), unless you ask people to show you the
>>>>>>>> details in their certificate to check them by hand, and they
>>>>>>>> accept voluntarily. You would still have to verify whether
>>>>>>>> that's possible in the country where you are, as there are
>>>>>>>> contexts in which it is illegal for someone to ask someone else
>>>>>>>> whether they are vaccinated or not (e.g. employers with
>>>>>>>> employees).
>>>>>>>
>>>>>>> Whether the privacy regime in a particular country allows the
>>>>>>> IETF to check whatever we decide we need to check will became a
>>>>>>> new site selection criterion, I suppose. Personally I have no
>>>>>>> problem whatever in revealing my vaccination status to anyone who
>>>>>>> asks.
>>>>>>>
>>>>>>> Brian
>>>>>>>
>>>>>>>> By the way, there are rumours on Twitter that at least one of
>>>>>>>> the national private keys has been leaked already...
>>>>>>>
>>>>>>> _______________________________________________ Manycouches
>>>>>>> mailing list [email-masked]
>>>>>>> https://www.ietf.org/mailman/listinfo/manycouches
>>>>>>>
>>>>>>
>>>>>
>>>>> _______________________________________________ Manycouches mailing
>>>>> list [email-masked]
>>>>> https://www.ietf.org/mailman/listinfo/manycouches
>>>>
>>>> _______________________________________________
>>>> Manycouches mailing list
>>>> [email-masked]
>>>> https://www.ietf.org/mailman/listinfo/manycouches
>>>
>>> _______________________________________________
>>> Manycouches mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/manycouches
>>
> 
> _______________________________________________
> Manycouches mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/manycouches

---

From: Behcet Sarikaya <[email-masked]>
Date: Tue, 2 Nov 2021 09:34:07 -0500

> possible, as illustrated by EU PC able to browse Australian MyHealthApp
I have clear pass. It is free and good and seems to easy to use.

Behcet

---

From: Alexandre Petrescu <[email-masked]>
Date: Tue, 2 Nov 2021 15:40:17 +0100

Le 02/11/2021 à 15:34, Behcet Sarikaya a écrit :
> 
> 
> On Tue, Nov 2, 2021 at 8:04 AM Alexandre Petrescu 
> <[email-masked] <mailto:[email-masked]>> wrote:
> 
> 
> 
>     <https://www.clearme.com/healthpass/>
>      >

YEs, I agree it is ok for you, but works only for people in USA.

If we have a meeting here in Europe, a verifier can not check 'CLEAR', 
because the URL can not be browsed from Europe.

Alex

>      >>>>>>> <[email-masked]
>     <mailto:[email-masked]>> wrote:
>      >>>>>>>
>      >>>>>>>>> <[email-masked]
>     <mailto:[email-masked]>> ha scritto:
>      >>>>>>>>>
>      >>>>>>> mailing list [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/manycouches>
>      >>>>>>>
>      >>>>>>
>      >>>>>
>     mailing
>      >>>>> list [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/manycouches>
>      >>>>
>      >>>> [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/manycouches>
>      >>>
>      >>> [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/manycouches>
>      >>
>      >
>      > [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/manycouches>
> 
>     [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/manycouches>
>