Earlier this week, Quebec launched the companion iOS apps for its vaccine passport system — VaxiCode for patrons, and VaxiCode Verif for businesses. An Android app is expected to be released soon.
Starting September 1, Quebec residents will need to show proof of vaccination to visit businesses deemed non-essential by the provincial government, such as bars, clubs, gyms, and restaurants. That proof comes in the form of a QR code distributed to vaccinated residents by the Health Department.
On Tuesday, Quebec’s Digital Transformation Minister, Éric Caire, said that the proof of vaccination QR codes “cannot be falsified, modified or copied”.
One software programmer took Caire’s words as a challenge, and proceeded to trick the VaxiCode app into accepting falsified proof of vaccination for a fictitious person using external software in a matter of six hours — reports CBC News.
On Thursday, a group of hackers was also able to exploit the system and obtain the proof of vaccination QR codes (and, by extension, the personal information they contain) of Premier François Legault, Mayor Valérie Plante, Quebec Health Minister Christian Dubé, provincial opposition leaders Dominique Anglade and Gabriel Nadeau-Dubois, and Digital Transformation Minister Éric Caire himself.
Despite multiple breaches, however, Caire insists the system “remains secure”.
My last name, my first name, my sex, my date of birth are not really difficult to find, they are public. And I took a picture of myself getting vaccinated and I said what type of vaccine I was getting, so the date and the type of vaccine was also public information.
Is a system really secure if it’s bested by your average computer programmer?
“We will discuss it with the health minister, we will weigh the inconveniences and if we have to make obtaining the QR code more complex, well, we will do it,” assured Caire.
“But what I’m saying is, this [added] complexity, it will also be there for people that would want to get it for legitimate reasons. And that would possibly mean limiting the use of the QR code, and that’s not what we want.”
Quebec’s vaccine passport apps are simple, effective, and ready to roll out, for which they have been heavily praised. And while Caire brings up a valid point in saying that making the system more complex will ultimately make things more complicated for residents and businesses alike, sweeping security vulnerabilities under the rug isn’t the answer either.
“I ask that you announce a plan to fix this worrisome security breach,” wrote Québec Solidaire spokesperson Gabriel Nadeau-Dubois in a letter to Quebec Premier François Legault. “Otherwise, suspending the vaccine passport until a long-term solution is found will need to be considered.”
