Covid testing in Cozumel

[cvchief]

As far as why it took so long for it to be a requirement? It had nothing to do with IT, it was a Biden admin thing. It was announced during his transition, to be a requirement IIRC a couple of days after he took office.

That's what assuming gets you. It was a Pres Trump thing. He was opening flights to some more countries at the same time CDC was requiring testing to take effect after he was gone. Pres Biden just said they weren't gonna open those countries, but kept the Pres Trump CDC brain poke requirement.

Trump to lift some Covid travel restrictions, a move Biden quickly rejects

 

[cvchief]

You're completely changing the game, pretending that you are protecting against a state intelligence operation or something. It started with someone faking a QR code. There are QR code scanning libraries already created, no need to re-invent the wheel. The airline only needs to ensure they send the request to the real IP for Costamed not some spoof embedded in the fake QR. Costamed needs not be involved at all in this operation. You wouldn't be trying to protect against someone hacking Costamed's side and planting fake test results. No integration necessary. But again, what makes you think the hospitals and clinics aren't reporting to a Mexican government agency?

Exactly! I swear you must be a rarity among software developers, or I only ever work with the difficult ones.

It seems to me as simple at scan the QR which has the website, not the IP embedded. If it goes to google.com, go get the info. g00gle.com, 6oogle.com, etc etc, just error out. Just use my own dns lookup. As the airline, get the approved lab list with their result websites, IF QR points to site in list, THEN load results. IF no, the error.

If the lab IP gets hacked in the DNS look up, or the lab website is compromised, I can engage in that favorite IT thing of "Its not our system, its theirs, so call them."

I know nothing about being a software developer. I do, however, know they are wrong when I want this:

And they want to build this, that I see STILL won't do what I need:

 

[Manatee Diver]

The airline only needs to ensure they send the request to the real IP for Costamed not some spoof embedded in the fake QR. Costamed needs not be involved at all in this operation. You wouldn't be trying to protect against someone hacking Costamed's side and planting fake test results. No integration necessary. But again, what makes you think the hospitals and clinics aren't reporting to a Mexican government agency?

They would need to be involved, if they make a change in their system, which does happen particularly when you are dealing with multiple providers. Attempting to implement something like this without their cooperation will be a nightmare speaking from experience. And regardless you are making the assumption that any airline would take the time to do this unless it were legally required, it isn't.

I am sure that some data is going to Mexican government agencies at each level, but more than likely it is a summary positive vs negative and biographical data of each. And probably the detailed information of people that tested positive are sent to the local municipal government to ensure that they are quarantining. If they are keeping a central database of everyone that tested negative that would be a huge privacy risk.

 

[Manatee Diver]

That's what assuming gets you. It was a Pres Trump thing. He was opening flights to some more countries at the same time CDC was requiring testing to take effect after he was gone. Pres Biden just said they weren't gonna open those countries, but kept the Pres Trump CDC brain poke requirement.

Trump to lift some Covid travel restrictions, a move Biden quickly rejects

So it is like the Spanish American War taxes, we ended the war and kept the taxes.

 

[dmaziuk]

You have no clue what I was talking about with regards to DNS.

I do, actually. Where I got my degree, "not public Internet" started with your own cables and everyone connected to everyone else by IP address (and they still do).

 

[cvchief]

Did someone mention information security?

I think right now you could brute force your way into test results with random hex code at the end of the results webpage. Give you all my test info, full name and DOB. You just need to hit the correct link.

 

[ReefHound]

They would need to be involved, if they make a change in their system, which does happen particularly when you are dealing with multiple providers. Attempting to implement something like this without their cooperation will be a nightmare speaking from experience. And regardless you are making the assumption that any airline would take the time to do this unless it were legally required, it isn't.

I am sure that some data is going to Mexican government agencies at each level, but more than likely it is a summary positive vs negative and biographical data of each. And probably the detailed information of people that tested positive are sent to the local municipal government to ensure that they are quarantining. If they are keeping a central database of everyone that tested negative that would be a huge privacy risk.

Dude, you are making this too complicated. If their own QR code points to them and they change their system, EVERYTHING fails. You brought up the point that someone could create a QR code that pointed to a different site that looked like the real site and I'm simply saying they the airline could use their own DNS to resolve the QR code. Everything else in the process would be the same, which is what is being used for authentic tests results currently.

If the CIA wants to run an operation to have their agents show a negative test without ever taking a test, I'm sure they could do so. We are talking about the average tourist here and comparing the opportunity for fraud with paper vaccinated cards with no electronic verification at all. You previously conceded that the test results would be much harder to fake than the cards and that was all the original point made. Unless you are backtracking on that there is no need to continue this.

What exactly do you know about Mexico and it's concerns over individual privacy?

 

[ReefHound]

I do, actually. Where I got my degree, "not public Internet" started with your own cables and everyone connected to everyone else by IP address (and they still do).

DNS regards the outgoing request. That's what I was talking about. Not a secure VPN between airline and testing facility. Like a phone call, simply making sure the "telephone book" is correct and the number they list for Juan's Clinic is really the number to Juan's Clinic.

 

[Manatee Diver]

You brought up the point that someone could create a QR code that pointed to a different site that looked like the real site and I'm simply saying they the airline could use their own DNS to resolve the QR code.

Except you can't, unless you do secure zone transfers for specific domains, and only resolve those domains. Which would take months to setup.

Sure you could probably bodge something together, but that bodge would quickly break down and people would ignore it, as the local stations will just work to get things done. I've seen this happen many many times.

You previously conceded that the test results would be much harder to fake than the cards and that was all the original point made. Unless you are backtracking on that there is no need to continue this.

And both are much gnashing of teeth about nothing.

What exactly do you know about Mexico and it's concerns over individual privacy?

Mexico actually has the right of privacy in their constitution so I would think they care more about it than the States.

 

[cvchief]

DNS regards the outgoing request. That's what I was talking about. Not a secure VPN between airline and testing facility. Like a phone call, simply making sure the "telephone book" is correct and the number they list for Juan's Clinic is really the number to Juan's Clinic.

So while I am always right, I don't always know why. Doesn't the QR code use the ACTUAL domain name, like say Hospital en Cozumel | Grupo Médico Costamed rather than 167.71.171.183 so that any DNS issues would be contained to the airline and its DNS server? So the white list could have the actual domain names rather than worrying up IP?