Lachance said the one weakness with the system is that while VaxiCode Verif doesn't save data, it wouldn't be hard for someone - like an unscrupulous club bouncer or business owner - to make another application that does and use it to scan patrons' QR codes.īut it would be difficult for an app like that to be distributed widely, he said. Lapalme said one thing he likes about the VaxiCode application is that it shows users all the information stored in their QR codes, which he believes could assuage privacy concerns. It might make things more complicated if Quebecers want their QR codes to be validated in other countries (that) don't have the specific Quebec app, he said. Lapalme said his biggest concern is that the cryptographic keys used to validate the QR codes are only located on the application and not online, which is a feature that is part of the SMART standard.
He said even if users allow the app to update automatically, there doesn't seem to be any files on the software that would allow the app to begin accessing location data. The app doesn't do anything really suspicious, he said in an interview Wednesday. That protects privacy, Lachance said, because no data is sent to the government or app-maker Akinox during the scanning process.įelix Lapalme, an iOS developer at Montreal tech company Transit, said he downloaded the application and looked at the files inside.
The cryptographic signature in each QR code is validated within the VaxiCode Verif app - without the need to connect to an external server or centralized database.
That reader could scan a QR code uploaded to the VaxiCode application or to a paper version of the code, or to a photograph or PDF of the code. VaxiCode Verif is a reader application that scans data contained in the QR code, including a cryptographic signature to verify the code's authenticity.
Quebec residents are encouraged to download VaxiCode and upload their QR code into it.
Android versions are expected to be released later in the week. On Wednesday, Quebec released the applications that will be used to power its vaccine passport system on Apple devices: VaxiCode Verif for businesses, and VaxiCode for patrons. That proof is in the form of QR codes distributed to vaccinated residents by the Health Ministry. 1, Quebec residents will need to show proof of vaccination to visit businesses the provincial government deems non-essential, such as bars, clubs and restaurants. The technology is based around a quick response (QR) code containing a person's name, date of birth and information about the vaccinations they have received. That standard, known as the SMART Health Card, is also being used for vaccine passports in New York state, Louisiana and California. Instead, he was pleasantly surprised to see the government adopt an international standard that he described as unquestionably much better than anything (the government) could have come up with internally. I was very skeptical when I first heard of the government's intentions around this kind of technology - it could have gone wrong in so many ways, Lachance said. Lachance and another tech expert interviewed by The Canadian Press say the applications do what they claim to do and are not capable of secretly gathering user data. But after he took a look at the smartphone applications that became available for download Wednesday, he said Quebec's system should be the model for other provinces.