I have two vaccination passports. My Québécois one, where I got all my vaccines, and my European one,
which simply converts my Québécois passport. Both are legal, I'm vaccinated,
however what I just showed you is not really my vaccination passport (I am not
stupid)… I edited it. If you tried to be clever and scanned it,
you stumbled upon something else. Besides, do you know how to read a QR
code? How do they really work? That's what we're talking about today,
and we will go so far as to look into what kind of information is stored in these health
or vaccination passports (what's stored in mine at least)… And surprisingly,
health passports don't contain the same information depending on the country you're in.
A Quick Response code (that's what QR stands for) is like a traditional
barcode, but on steroids. In both cases, QR codes and bar codes are used to store
information (letters, numbers, characters) in a form that is readable by
a computer. That is to say in its computer language which only contains 0s and 1s, aka
binary. In a QR code, all that is black represents a 1, and anything white
represents a 0. So if we translated it to 0s and in 1s, it would look like this. Of course, all these
0s and 1s in a row mean something. For example if we have 01010011; I'll use a table of
correspondence to see what it corresponds to… And it turns out that… that code represents a capital S.
But a QR code is not read from left to right and from top to bottom as we would read it.
It reads in a really disjointed way. I'll show you how to read a QR code before
we get back to health passports, you'll see it will be helpful. After that, you should be able
to read a QR code without a phone… but you probably won't want to!
When you scan a QR code, the app will first look for the 3 squares in the corners.
This allows it to distinguish the top from the bottom and the right from the left. This is why there aren't
4 squares; otherwise it would no longer be able to recognize which way the QR code should be read. There
are also a horizontal and a vertical line where one out of two squares is black. These two dotted
lines are used to calibrate the software which reads the QR code and showcase the square size.
Here is an empty QR code. Now that the reader knows how to orient it
thanks to the three squares and that it knows what size are the squares, it may begin to
read the information inside. It starts by reading these two squares here and there,
which indicate what is called the error correction levels. “Oh no, I spilled my coffee and now
part of my QR code is no longer readable, what can I do?" Despite the stain, if you scan it,
you will still be able to read it. That is because the code incorporates techniques that
allow you to find information, even when it has become illegible or has been torn.
Look at your own health passport, but in my French health passport, in this area, I have 2
black squares like this. It means that I can lose up to 25% of my code and it will still be
readable. This is what the error correction level represents: the amount of information
that you can lose in a QR code while still being able to read it. In my Québécois passport,
only one of the two squares (the bottom one) is filled.
In this case I have 30% redundancy. There are 4 levels of correction rate,
from 7% to 30%. You can play with your QR codes, and try to hide some of the information
and see until how far you will still be able to scan it. You will see that it varies enormously
depending on the two small squares you have in your QR code and which indicate the level of
correction of this one. And this correction level also explains why we can place a logo
right in the middle of a QR code like this. We benefit from the super capacity of the QR code to “regenerate”
to cover it up, to customize it with a logo. We also have the
4 pixels at the bottom right that indicate whether our QR code contains only numbers, or
numbers and letters, etc… So here for example, I went for the alphanumeric system but
I could have chosen something else. So far in the QR code version that I picked,
everything I colored in is there to explain to the machine how to read the message.
Then we have all this space here (which isn't yet colored in) to actually record
some information. And the space that's in blue here serves to make information redundant.
That's the correction level we were talking about. I won't go too deep into information redundancy,
but it is not a simple copy of all the information into another location.
It's smarter than that and to sum it up, it's based on mathematical operations, additions,
multiplications, polynomials. And that is really another world of which you will find
further details in the corresponding ISO standard. Good luck. What interests us the most for now
is the information itself, this section of the code. And that's what we're going to try to
read. Here too, as for the rest of the QR code, it doesn't just read from left to right
and up and down. It's different. How does it work? In the example I took,
you'd read this in blocks of 8 small squares where each block represents a character. We have the 1st,
the 2nd, the 3rd, the 4th, the 5th, etc. And inside the blocks, you wouldn't always read
it left to right or top to bottom either. I redrew some blocks a little bigger here
to show you what it looks like. We start here... then there… then there… then there… then there. And that's how we
read one of our little squares, square #1. We continue reading in this direction… and
we come back down when we get to the other side. Once you get here, you start over following exactly
the same logic as in the first column. So we're going to read the information like this,
cut into blocks of 8 squares. This way of reading would obviously be hellish for us.
But for a machine, it makes no difference. Next, you'd just translate each
block. For example, if I read this block. I start with a 0 here. Then I have a 1.
010011. And if I refer to my trusty table of correspondence… it’s still a capital S.
I've just decoded the first character of my QR code. All that's left is to decode everything
else within each block. Now, what I just did is right, but I omitted a whole section
in the reading of a QR code which complicates the whole thing. In fact, if we created the QR
code as I have explained to you so far, we would end up with a succession of black
or white blocks, and it's hard for the machine to figure out whether there are 5 or 6 squares
in a row that are black or that are white. Because in a real QR code, there is no
netting like there is here. So it can be hard for the machine
to be able to distinguish how many squares are in there. So we need a
method that allows the QR code to be well distributed. And we do that with masks. That is to say, we will take
our QR code, and for all the boxes that are targeted by the mask that I am applying right now,
meaning the boxes underneath, we will have to invert their color. I'm showing you
one type of mask, but there are many other different masks and the QR code generator
will choose the one that leads to the best code readability. In order to know which mask is used
in our case, we can refer to another part of the code whose existence I had hidden from you until
just now (ooh la la). So with the mask that I just showed you, the code — noooooo
that wasn't it! I did it wrong! This is why computers are the ones to do it…
Well, ignore my mistake. The mask that I have used matches these 3 boxes here with
2 black ones and 1 white in the middle. Same thing here: 2 black dots with 1 white in the middle. To summarize:
in order to decode a QR code by eye, we as humans we don't need the squares in
the corners, we won't read them. We won't read these lines that give us the
size of the squares either, as we can clearly make that out ourselves. And we don't care about
the whole error management part either. Therefore we will focus mainly on this. First,
we identify what the mask is (with these 3 boxes here). Then, we apply our mask onto the QR
code. This tells us whether it's numbers, letters, or characters that are encoded.
Then we isolate each of the blocks. We read each of the blocks in the right order. And finally,
we go through our correspondence table to see what it corresponds to. And badabim badaboum,
it's decoded! We get some text or a link or a series of figures, in short: we have information
that is readable by humans. Of course this applies to the easiest QR codes,
we haven't covered everything there is to know about QR codes in 4 minutes, ok? For
any riddle lovers out there, I'll give you one that's simple and short to decode by hand…
of course, I removed the squares from the corners and the error management part, so that your phone
won't be able to decode it. You'll really have to do it by hand. All that you need is
in the video and you have some small details in the description. If you find the answer,
congratulations, you are the only ones to have access to this! Well, now that we know how to decode a QR code, we
can decode our health passports. The principle is the same up until the last step: that of
the correspondence table. If you try to decode your health passport with the same table
as me, you're going to have a series of something like 400 characters: BW21%+26… And it continues
for 400 characters… This is because for health passes, the transition from 0s and 1s to something
intelligible for us is a bit more complex. But it can be done, as long as
we have the right algorithms that reproduce each step we talked about. Personally, I won't
try to do it by hand. That's a pass. And since the specs of health passports are freely available, with the right
code, you can read your own pass. So here's my European health pass. If you don't mind,
I am hiding a lot of information for safety purposes, but there is nothing too crazy
in there. There is the number of the dose linked to this pass, the vaccine manufacturer, the type (if it's
an RNA vaccine for example), the date on which I received the injection, the country where I received it,
a unique identifier number, the type of vaccine (which company and which version it was),
the name of the organization that produced the QR code, the number of doses received, and the disease targeted
(in this case, COVID-19). And then, my last name, first name, the version number and my date of birth. That's all.
Contrary to my Québécois passport which contains… a little more information. Especially,
the information of all my doses and not just the last dose I received, as in my
European passport. As well as the batch number of each of my vaccines. So we couldn't decode our
health pass by hand but at least we know how it's made. That's not bad.
We were talking about tampering at the start of the video. Obviously I have to talk about it. Just because
we can read the information in the passports doesn't mean that we can reproduce one. It goes one way and
not the other, it is an asymmetrical process. In fact, what we cannot see here is that
there is a part of the QR code which is used to “sign” the document, i.e. to ensure that this document
has been issued by such and such an institution. And this signature has something very subtle
because it depends on the information that is contained in the code. So that means we can't
just copy-paste the part that secures the pass from one, and then apply it to
another. That's why the only known and reported way to create a fake health pass,
is to generate a real pass but with false information. What I did when I told you
I showed my “fake” health pass is that I just pasted another QR code on top of my actual one.
It can't even be scanned with a health passport scanner. It's really level 0 in
tampering what I did, it doesn't work. In conclusion, a classic QR code is just
a way of writing text, numbers, characters. So a “fake QR code”...
it's a bit of nonsense. It isn't the support which is false, it is the information which is
inside. Take a book about the Earth being flat: it's not the book that's false, it's the
information that is in it. Therefore if it's just text in there,
there is no validity limit for a QR code. It will still work in 10 years because
in 10 years, what you wrote there is still written. The letters in a book
don't perish; same thing for a QR code. What can change on the other hand,
is that the QR code leads to a website that no longer exists, sure. Or that the standards
of reading QR codes change.
But this shouldn't be a problem for you since you now know how to read a QR code by hand…
Right? For once, I will do promote my own stuff and tell you about my second channel
which is called Sci+. On there I talk about popularizing science on the internet,
whether in writing, orally or on video; I have a small bias towards video obviously, as you
can imagine. But I'm talking about how to communicate about science and I show a little bit of the
behind the scenes on how things are done here on Scilabus. There is another cool thing on that channel.
I made a series of about thirty videos that help researchers and scientists to talk
to the media. So if you are ever concerned, it is free to watch. Check it out, I hope that
you'll find it interesting. Don't hesitate to join us over on Sci+ to talk about science communication
on the internet. Thanks for following this video. I invite you to subscribe,
or follow me on social media. And see you next time, bye!