Manitoban Makes Open Software Demo Of Proprietary Vaccine Verification Systems

Cobbled together proof-of-concept vaccination verification system, showing a dot-matrix receipt printer, a webcam for QR code scanning, and an old laptop running the software

[Mark Jenkins] wasn’t impressed with the Covid 19 vaccination verification systems that restaurants in Manitoba are required to use. Patrons must present a QR code, which must be verified by a mobile app available only from Apple or Google. With help from his local hackerspace, he came up with a bash script solution requiring only kilobytes vs the 50 MB of the mobile apps. [Mark] isn’t pleased with the exclusivity of the apps availability and the lack of an open API. His concern isn’t entirely theoretical, either — Google mysteriously pulled their app from the Play Store for over a week.

The interim result, shown in the video below, is a demonstration system called Alexandra. It consists of a receipt printer, a webcam being used as a QR scanner, and a 2005-era laptop running the script. This is merely a proof of concept, as [Mark] clearly notes. There is still some work to be done — for example, the method used to authenticate with the Google server is transient. But eventually [Mark] hopes to have a free software alternative soon, suitable for restaurant owners to use in their establishments.

What kinds of vaccination verifications systems, if any, are used in your part of the world? Is the system open or proprietary? Let us know in the comments below.

31 thoughts on “Manitoban Makes Open Software Demo Of Proprietary Vaccine Verification Systems

    1. I don’t know exactly how it was implemented at the restaurant/venue side in the Netherlands, but I can tell you it was an absolute JOKE. For the brief time it was in place, I saw entire groups of people going into venues with a simple screenshot of somebody else’s QR code.

      1. That’s an issue at the verifier’s side. The QR code contains limited personal information, but enough to do a quick match to an ID:
        – day and month of birth
        – first letter of both first and last name
        The screen with the QR code is also animated (it shows cartoon cyclists, because the Netherlands) so screenshots can be easily distinguished from the real thing.

        1. The chance of even getting infected, remains pretty low. Most infected people self-isolate, or at least limit public contact, once symptoms are obvious. How often have you heard anyone cough or sneeze? The vaccines aren’t a perfect, magic shield either. Sort of a false sense of security. Sort of like seat belts and airbags in cars, won’t prevent accidents, or guaranty you won’t be seriously hurt or die. You gain some protection, but you aren’t free to play with your cell phone, or any other distractions. Even vaccinated, you still run some risk of infection. Wear your mask, which are ‘highly effective’.

          If the QR code can be created, anybody can clone it. There is an app to read it, there will likely be an app to create a fake. It’s a hacker challenge, and with nothing better to do… And, it’s always better to show off your accomplishment, and share. America is in booster shot mode, meaning the app would need to do more soon, to separate the merely vaccinated, from those that got the most recent dose. When Pfizer gets full approval in a few weeks, there will be a new, improved vaccine. Likely including influenza protection as well.

          The segregation is a little scary, as the protected ones are free to travel all over the world. Some will still get infected, and bring back new and exotic variants. If an evasive variant is spawn, it will spread most quickly, among the elite vaccinated, who freely gather, to share their travel adventures with family, friends, and anybody else, who could care less.

          There is an extremely high recovery rate. Being unvaccinated, doesn’t mean perpetually infected, or infected at all. Infection lasts 5-10 days. Natural immunity is just as good as the vaccines, likely better. Vaccination is more about political power and control. They need to prove to the public, that they can make us doing anything they want, whether we need it or not.

        2. And they probably drove there! That is a greater statistical risk with their stupid 6,000lb murder machine. They must really be trying to kill people!

          According to the CDC, Covid death rate for people under 50 – 10 in 100,000. Dying in a car wreck – 12 in 100,000.

  1. In Europe, the EU Digital Covid certificates that are supported by most member states are following an open protocol and reference implementations for verifying such certificates are available on github: .

    Some more general information can be found here: .

    If I’m not mistaken they are trying an implementation of this certificate in Japan as well, but I can’t find the source immediately.

    1. Also, I WISH we had a vaccine pass/carte sanitaire, or whatever else here so stuff would reopen and I could relax knowing that not everyone is about to give me covid. The whiners have no clue how well they have it.

  2. grumble. 50MB app to do the work of a <10kloc C program. i can't stand how everything is written these days. i feel that same frustration that made [Mark] embark on this project!

  3. More of “I always call the other side nazis to justify punching them” and “I always like onerous restrictions or stripping freedoms from people i hate.” Notice how “I” am not in either afflicted group and am strong with hypocrisy.

  4. In Spain this was non-existent. After your COVID shot you get a QR code which is supposedly signed with a cryptographic key, valid within the whole European Union. So I guess verifying that vaccination certificate would have been as simple as validate a signed hash.

    However, what people did was show the PDF to the waiter. And that’s it.

    But none of this matters now, as this system was designed to facilitate international travel. It was never intended to be used as an access pass to a restaurant: in Spain, there have been recent court rules declaring this whole idea illegal.

    And I agree. Why do I have to show any health related information to a waiter? Should I also ask if the cook was ever ill with mono? Has my waiter ever got gonorrhea? Is the cleaning lady HIV+? I demand to know as well!

    1. Of course not! Who would be pro-evolution? The alternative is so much more attractive.

      Evolution is so flawed and boring. We humans, on the other hand, are infallible.

  5. What strikes me as most Orwellian in current times is the social media enabled dissemination of ‘alternative facts’ and bold rejection of evidence in policy formulation

    “The party told you to reject the evidence of your eyes and ears. It was their final, most essential command.”

    1. Today it’s too easy for people to feel self-righteous in their group-think bubble. Not much respect is shown from anyone or from any side of any topic.

      Before the internet, it was harder for people to avoid questions and criticism from their unsolicited opinions. Things were more face to face with less running away.

      Today, if someone respectfully questions an opinion, they’re called a and filtered from the opinion’s bubble or the opinion is filtered from their bubble. Not many platforms for civil discussion.

      Today, no one is humble enough to think they or their chosen champion might be wrong. argumentum ad verecundiam is the majority of what I see.

      Today, two people with different opinions might wield equally true ‘facts’ as weapons. Each side calls the other side’s facts “alternative” or “fake” instead of admitting there’s not enough data to support a strong stance.

      Modern media avoids respectful open discussion. These outrage merchants just shake the bee’s nest for engagement metrics then filter the comments to avoid offending their core audience.

      The absolute worst part is that people know this and STILL they act like it’s someone else’s fault.

      1. I am not going to defend increasing concentration of media ownership globally, to be sure, but I am not convinced that the social media enabled foam of reality bubbles is better or even non inferior.

    1. It’s not. And likewise, this shouldn’t be required by the government. If a restaurant wants proof of vaccination before entry, more power to them. But prohibiting people from eating anywhere, even though it’s not a right, is not a power that we should trust the government with holding.

      TL;DR – If you’re scared of Covid, get vaccinated and stay inside. If you own a business and want to require people to be masked/vaccinated prior to entry, go ahead. But leave everyone else alone.

      1. This isn’t to keep the germy people away from the vaccinated, it’s to let things get closer to normal. A year ago distance was the only solution, masks when distance wasn’t possible. It was impissible to shut things down completely. But now there’s the vaccine. But if the invaccinated go back to normal, the virus spreads, and more imortant,can overload the hospitals.

        Without vaccination, nothing has changed.

        “My body, my choice” isn’t the case if you get really a pandemic. And until you get sick, you may not know that you are more vulnerable.

        And what about my body, my choice? I ‘ve been vaccinated twice, have proof, but it gives me little or no immunity. I almost died two years ago, my protection is by giving up.immunity. Which makes me more vulnerable, and means vaccinations aren’t effective for me.people who refuse to get vscfinated are impacting me, stuck inside for seventeen months, and never getting back to normal, staying inside means I don’t get out walking like I used to.

  6. I knew it wouldn’t take long for the anti-public health crowd to jam this comment section with rubbish. Re the OP, an interesting initial attempt to work around yet another unnecessarily closed system. Good on you.

Comments are closed.