Security concerns raised about third-party proof of vaccine apps
A technology and cyber security expert is warning Albertans about third party apps that offer COVID-19 vaccination and rapid testing verification.
It comes after users complained of one Calgary-made app not working and others showed they were able to upload false information to the app, but were verified anyway.
The app is call PORTpass and it's recommended by the Calgary Sports and Entertainment Corporation (CSEC) -- the group that owns the Flames, Stampeders, Roughnecks and Hitmen -- to provide proof of vaccination upon entry to its sporting events.
Hours before the Flames' first preseason game at the Saddledome on Sunday, PORTpass announced it was experiencing technical difficulties and told fans to bring paper copies of their vaccination record to the game instead.
"It's great that entrepreneurs want to help out, but we heard tales of a bunch of people who tried to use PORTpass and couldn't get into the hockey game," said Tom Keenan, a cyber security expert with the University of Calgary.
Beyond the frustration for users on Sunday, Keenan says apps such as PORTpass also pose security and privacy concerns, too.
"The reality is you're giving up information to a total stranger and that information could come back to haunt you as identity theft," Keenan said.
VACCINE RECORD CAN BE MANIPULATED: APP USER
Conrad Yeung is a web developer in Calgary and downloaded PORTpass to see how the app worked. He said he made a fake vaccination record on the app using a different name and was verified by PORTpass.
"The first picture I uploaded was Rob Schneider in the poster of 'Deuce Bigalow: Male Gigalo' and I was like 'they accepted that? Cool, let's use that'," he said.
"Then they asked for my driver's licence and I uploaded a random photo from the internet and that got verified, so I immediately knew there was probably something sketchy going on with the app," said Yeung, who posted a Twitter thread about his experience with PORTpass.
Yeung's profile stopped working on the PORTpass app Sunday evening, around the time the company reported it was dealing with technical difficulties.
The CEO of PORTpass agreed to do an interview with CTV News on Monday afternoon, but cancelled shortly after.
In a statement issued late Monday afternoon, the company says it has taken measures to "significantly increase the system's resources to meet the ongoing demand and ensure functionality for all users, all the time."
"PORTpass would like to reaffirm the commitment to security that has been central to it’s operations since Day 1 and address the recent claims on social media falsely claiming to have had unrestricted access to the system’s database," it read.
"The statements made are unequivocally untrue and PORTpass will be working with local authorities to take action against this malicious misinformation, and the submission of fraudulent documents. Documents uploaded for proof of vaccination and test results go through both manual review and machine learning analysis, and are securely used with Amazon Web Services.
"As a further demonstration of the commitment to security and transparency, PORTpass is taking steps to implement additional layers of security including steps toward SOC 2 compliance and working with a third party on a security audit. During this time of uncertainty, PORTpass continues to live by it’s mandate to provide a seamless way for local businesses to continue to serve their communities."
Keenan, the cyber security expert, was also able to be verified by PORTpass, despite not providing his own driver's licence when signing up for the app.
"There's a lot of information on your driver's licence, your passport. So instead I gave them my United States Library of Congress card and guess what? It took it. So, they're not really looking at what's going on there," Keenan said.
"We've got to get the (QR code) soon and I think the reality is that government-issued and supported apps are going to be the way to go," he added.
The Alberta Government is working on its own QR code for proof of vaccination, but there is no timeline on when it will be available to the public.
"Work is underway to provide proof of vaccination with an Alberta-verified QR code soon. We are monitoring the experiences of other provinces and privacy and security concerns are being taken into consideration," reads a statement from Alberta Health.
CSEC said it is aware of the security and privacy concerns raised by PORTpass users and is working with the company. A spokesperson for CSEC said more information would be available to fans in the next day or two.
CTVNews.ca Top Stories
Quebec man who threatened Trudeau, Legault online sentenced to 20 months in jail
A Quebec man who pleaded guilty to threatening Prime Minister Justin Trudeau and Premier François Legault has been sentenced to 20 months in jail.
Russia puts Ukrainian President Zelenskyy on its wanted list
Russia has put Ukrainian President Volodymyr Zelenskyy on its wanted list, Russian state media reported Saturday, citing the interior ministry’s database.
Two killed after collision with truck on Hwy. 417 near Limoges, Ont.
Ontario Provincial Police say two people were killed after a car and a transport truck collided in the westbound lanes of Highway 417 near Limoges, Ont. on Tuesday afternoon.
A Chinese driver is praised for helping reduce casualties in a highway collapse that killed 48
A Chinese truck driver was praised in local media Saturday for parking his vehicle across a highway and preventing more cars from tumbling down a slope after a section of the road in the country's mountainous south collapsed and killed at least 48 people.
Canadian doctor concerned new weight-loss drug Wegovy may be used inappropriately
As Wegovy becomes available to Canadians starting Monday, a medical expert is cautioning patients wanting to use the drug to lose weight that no medication is a ''magic bullet,' and the new medication is meant particularly for people who meet certain criteria related to obesity and weight.
Britney Spears 'home and safe' after paramedics responded to an incident at the Chateau Marmont, source tells CNN
A source close to singer Britney Spears tells CNN that the pop star is 'home and safe' after she had a 'major fight' with her boyfriend on Wednesday night at the Chateau Marmont in West Hollywood.
Grandparents killed in wrong-way crash on Hwy. 401 identified
A 60-year-old man and a 55-year-old woman killed in a wrong-way crash on Highway 401 earlier this week have been identified by the Consulate General of India in Toronto.
Premier Legault reiterates that McGill pro-Palestinian camp must be dismantled
Quebec Premier François Legault reiterated that the pro-Palestinian encampment at McGill University must be dismantled while police remain 'on the lookout for new developments.'
Houston braces for flooding to worsen in wake of storms
High waters flooded neighborhoods around Houston on Saturday following heavy rains that have already resulted in crews rescuing hundreds of people from homes, rooftops and roads engulfed in murky water.