New York about to prohibit QR-code requirements

Congratulations to EFF for being consistently wrong about nearly everything relating to the ongoing pandemic that has killed nearly six million people so far. Is the coronavirus a major donor?

Here they are taking a victory lap for having written a 2 page letter supporting NY Assembly bill A07326A, which includes the provision:

§ 2183. Immunity passports. 1. Any covered entity that requires proof of COVID-19 immunization shall permit the use of physical immunity passports. No covered entity may require digital, electronic, or smart-phone-based proof of immunity.

Such paper documents are so trivially forged as to be 100% useless. EFF believes, as does SFDPH, that scribbling your name on someone else's vax card in Comic Sans counts as proof of vaccination. As I said to NBC back in January,

"We won't be safe until venues are able to require SMART Health QR codes and stop accepting paper cards, or photos of cards. And that won't happen until state or local governments mandate that," said Jamie Zawinski, a software developer who also owns a night club, DNA Lounge, in San Francisco. He requires customers to have the QR code or, for now, their paper CDC card.

DNA Lounge not only requires people to display the QR code, but it also scans the code using a smartphone app to verify that the codes are authentic -- making the club one of the few businesses anywhere in the U.S. to take that extra step.

But hey, as per longstanding EFF tradition, it's too little too late. (I assume the Latin version of that is on their coat of arms.)

We now live in a world where you will never again be asked to provide proof of vaccination, or ever be required to take even the most basic precautions to protect someone other than yourself.


Previously, previously, previously, previously, previously.

Tags: , , , , , ,

7 Responses:

  1. andy says:

    Sorry if this is a stupid question, I haven't really been following how all of this went in the US, but why can't people bring printouts of their QR codes with them? That's what you had to do in a bunch of European countries, if you didn't have or want to use a smartphone. Although most if not all places did go the same way the US went and nobody seems to require proof of vaccination for anything anymore, AFAICT.

    • jwz says:

      There are lots of things that someone could do, but when this legislation says "physical immunity passport" they mean a hand-written piece of paper with no security features of any kind. But it does have a CDC logo on it. There's a logo.

  2. jrl says:

    My take on the EFF's position is that they can't support the current infrastructure (using QR codes) because it might leak private info. It isn't proven to satisfy their privacy requirements.

    The fact that paper documentation is almost worthless as a way to prove a vaccination record isn't really doesn't seem to be their concern. Their support of printed cards with markings in ink has nothing to do with confidence that those cards mean anything, and everything to do with their confidence that those cards don't violate their ephemeral sense of privacy.

    Their advocacy is narrow minded. That's infuriating to me (and others). I despair that they are unable to take pragmatic positions.

    • jwz says:

      Some fanatics believe there should be no limits on speech, even if that enables nazis. Some fanatics believe there should be no limits on privacy, even if that kills millions of people. Some fanatics have the privilege to think this is all just some kind of intellectual game and not life or death on a massive scale.

      Fuck -- and I can't emphasize this enough -- that.

    • cmt says:

      Any proof of vaccination (or whatever) needs to be linked to it's owner - you, the person - and the most obvious way to do that would be via (name, date of birth), so you're always "leaking" that information. (Also, you'd link that (name, date of birth) against some kind of ID, which links back to you via the photo on that - I know which jurisdiction we're talking about, and some things over there... I just don't get it). What you gain by using QR codes (paper or smartphone, the medium doesn't matter) is the signature over "the information you want to prove" (e.g. "John Doe, born 1901-02-03, has received vaccination 3 out of a series of 3 on date 2022-03-04") linking it back to the issuing authority (the CDC, the vaccinating organization, whatever); and that's a huge win over "authority by logo" on some paper card, the photo of a paper card or a PDF with a logo. Yes, the EFF totally did not get it, their issue sounds like "old men with pens who lost out on the internet".

    • CSL3 says:

      As much as I love the EFF's mission and respect their history, they can't claim to be about "privacy" anymore now they've gone all in on the privacy-averse Signal and privacy-averse/environment-killing Ponzi scheme that is "Web3".

  • Previously