Which vaccine passport app should I use?

Canada’s PORTpass vaccine app made recent headlines when it was discovered that any member of the public could access the user profiles of their 650,000 users. Confirming the doubts of security researchers and privacy advocates everywhere, names, ID photos, email addresses, blood types, phone numbers, and birth dates were left exposed in an app that previously claimed to use AI and blockchain to verify records.

In the UK, vaccine passports or coronavirus tracing apps are not yet mandatory but may soon become the standard used for access large events:

• The EU has introduced the digital COVID certificate, and the UN has created a standardized visible digital seal (VDS).
• Certain Australian and US states are piloting their own local vaccination passports, barring any unvaccinated citizens from gyms, restaurants, mass events, and travel.
• Meanwhile, some private companies have gone as far as to ban their own unvaccinated employees from the office.

Vaccine passport apps have been blasted as an infringement on citizens’ rights, a third-party marketing opportunity, and bad news for the privacy-conscious. Given the immense pressure to put a solution in place quickly, security might not be a top priority to the app developers.

Our two concerns are:

1. How secure is your data with COVID vaccine passport apps?
2. Which vaccine passport apps are the safest to use?

Let’s look at 3 of the most popular vaccine passport apps of 2022.

3 vaccine passport apps to use in 2022

CommonPass: Compares your vaccine records with individual country requirements.

Created by The Commons Project and the World Economic Forum, the CommonPass app is free and does not store or pass any of your data to third parties.

They do not retain your data nor operate from a central repository of health data. The app simply creates a digital version of your vaccination records, inspects it, and compares it with the entry requirements of countries you may want to visit.

CovPass: (EU) Uses encryption.

If you have the EU Digital COVID Certificate, CovPass will digitize it and store it on your smartphone as a QR code.

Three things make CovPass pretty secure in our book. Firstly, your data is only ever stored on your smartphone, so even CovPass employees can’t access it. Secondly, the QR code only uses the minimum requirement of data (your name, birthday, and vaccine status, in accordance with EU regulations). And, finally, your data in the QR code is secured with encryption and requires your signature to access it, so it can’t be forged.

NHS COVID Pass Verifier: (UK) Uses encryption and links to your health clinic.

The NHS app encrypts your data. It not only stores your vaccination certificates but also lets you book GP appointments, lets you access your health records, and gives you advice. To prove who you are, you’ll need to create a username and password to sign in.

A word of warning: Opt out of using facial verification or fingerprints at login (even if the app asks you to do this by default).

It was discovered in September 2021 that the NHS app was storing facial recognition data with iProov. The London-based company has previously held contracts with HM Revenue and Customs and has also been linked with funding from the Conservative Party.

There aren’t many fully integrated vaccine passport apps created yet. And, after reading the privacy policy for popular vaccine app, VeriFLY, we found that they may share your personal information, including your IP address, with third parties and authorities to “comply with legal requirements”. That doesn’t fill us with hope.

How to protect your data online

No matter how secure your COVID passport app is, your data will still be at risk if you let down your guard elsewhere. That's why we recommend that you use a VPN to enhance overall online security.

It's important to remember that a VPN cannot protect you if you're using an unsecure or high-risk application — the risks we've discussed above will still be present. However, a VPN will encrypt your data so that hackers and Wi-Fi spies can't steal your personal information through unsecured connections.

NordVPN will give you an added layer of protection whenever you go online. This is especially useful when you’re using public Wi-Fi, where a compromised router could leave your data exposed to cybercriminals. You can also get the mobile NordVPN app.