Serious privacy, security concerns raised about Portpass vaccine verification app
CBC
Private proof-of-vaccination app Portpass may be easy to manipulate with fake vaccine records and may not securely protect users' personal information, experts say.
The Calgary-based company has said it has more than 500,000 users across Canada registered for its app, which is touted as a way to store and share vaccine records and COVID-19 test results.
Conrad Yeung, a local web developer, said he was curious about the app after reading an article about it. But shortly after downloading the app, he noticed an issue.
"It asked me to upload my photo ID … I uploaded literally a random photo of a mayoral candidate here in Calgary just to see if the app would let me," he said. "It let me upload a random photo for my driver's licence. And then I was like, you know what? There's probably something sketchy here so I'm just going to upload fake stuff and see what happens."
Yeung made a fake vaccination record with an actor's name and the app verified it as legitimate.
That prompted the web developer to take a closer look. He noticed the website does not appear to validate security certificates and has a backend that can easily be accessed by members of the public — making its data potentially vulnerable to hackers.
He also noticed some details that seem to refute statements on the app's website.