shc-extractor VS health-cards

Hahaha. That’s blatantly false. There are many open source GitHub repos for projects that allow you to scan the QR codes and there’s nothing of the sort in them. Here is one of many. Try it yourself. https://github.com/obrassard/shc-extractor

The app is fairly irrelevant - all they get is info that’s in the QR code - and that’s not secret, you can extract that info yourself: shc-extractor (You can’t use this to verify that a QR code isn’t just made up by a random individual, that’s what you need the official app for.)

The Ontario scanner app checks the signature to verify its authenticity, and shows a big yellow "warning" symbol and a "There is a problem" message. You can see what this looks like if you try scanning the QR code here.

The article says that 12 people downloaded the wrong QR Code. That's it. It's possible to extract data from the QR Codes (which are just encoded SHC records) using this: https://github.com/obrassard/shc-extractor

There's even some pre-built software to help you do it.

You'll get the string shc:/ followed by a long sequence of numbers. The encoding is described here if you're curious. The code library used to extract the information is here if you want to read exactly what your QR code says.

It's not. It is encoded based on a specification that anyone can look at. You can scan the code to get the shc string. Then use this tool to extract the information from it.

See: https://github.com/obrassard/shc-extractor

Details on the SMARThealth standard can be found at this link

If BC, Alberta, and Saskatchewan can convince the feds however, then eventually Saskatchewan. Bonus: in Saskatchewan, you can get a vaxport based on open source technologies (that being the SMART Health Card) that can be scanned by someone in Quebec for example without little to no trouble (because they too use said open source technologies).

More info: https://github.com/smart-on-fhir/health-cards/blob/main/docs/index.md

To be fair, the QR code from California's, Hawaii's and New York's (Excelsior Plus only) digital vaccine cards is conformant to the SMART Health Card QR code specifications (https://github.com/smart-on-fhir/health-cards/blob/main/docs/index.md) and thus can be added to Google Pay and Apple Pay.

I went and skimmed the documentation on their github. The smart health cards are just JSON packets that you can customize in the app. Here you can actually find a Python Notebook that shows you how to create your own QR code and then extract PII out of it, honestly a cool piece of tech. I have complete trust that the QR code itself will only provide the data that you willingly choose to include. That's not really my concern though.

More of the detail on the design and security/privacy choices is here https://github.com/smart-on-fhir/health-cards/blob/main/docs...

The SHC prefix here indicates a SMART health card, which is an open standard used to encode various types of health information, focused mainly on COVID-19 vaccinations for now. It has a technical spec on GitHub, which is fairly long, but I'll quickly hit the highlights:

Whether they're meant to or not, I couldn't say. However, I decoded mine, out of curiosity. It isn't an HTTP[S] URL, so you can't just follow it (which may be why others had trouble reading it). It's an shc:/ URL, encoding the data directly. Here's one project related to those, for additional information.

The state is issuing the QR codes. They are leveraging the Smart Health Card software. https://smarthealth.cards/ Technical information here: https://github.com/smart-on-fhir/health-cards/blob/main/docs/index.md