Certificate time uses clientside date validation about nl-covid19-coronacheck-app-ios HOT 6 CLOSED

Sure, but the QR code won’t be accepted by the scanner app.

from nl-covid19-coronacheck-app-ios.

Apologies for closing the issue, feel free to respond and I can explain further :)

from nl-covid19-coronacheck-app-ios.

Good to know this is not really a problem, still might be better to use server time for validation.

from nl-covid19-coronacheck-app-ios.

One of the premises of the app is to use your QR offline. We do not want to do any network calls when displaying the QR:

• Privacy, we do not track where and when you show the QR
• Location, you might have a very poor network in a remote venue (i.e. Lowlands)

What we will do in a future / next version:

• try to detect clock skew when doing any network calls to the CoronaCheck backend.
• display a warning.

There will be loopholes. It is hard to detect clock skew if you are offline. (start the app, retrieve the config, change your clock, show the qr)

from nl-covid19-coronacheck-app-ios.

An implementation like this allows for syncing the time once (upon first usage for example) and continuing to check for local time zone changes.

https://github.com/instacart/TrueTime.swift

from nl-covid19-coronacheck-app-ios.

Sine the original issue (the fact that you can forward in time and make the qr visible) is intended behaviour, I'll close the issue for now. As mentioned above: the validation is done on the date inside the QR, which is digitally signed.

from nl-covid19-coronacheck-app-ios.