TAC Vérif (com.ingroupe.verify.anticovid)

About

Android and iOS application developed by IN Groupe (Imprimerie Nationale) allowing users to check the validity of French Covid-19 vaccination and test 2D-DOC QRCodes.

Application code and UI heavily copied from IN Verify (com.ingroupe.mobile.instant)

Build parameters

Transport Operator mode

Screenshots

Activation

Transport Operator mode can be activated by scanning a QRCode document with the application, which once decoded contains a JWT, with the following minimal payload:

{
  "exp": 9999999999,
  "realm_access": {
     "roles": [
        "ROLE_TACV_CONTROL_OT"
     ]
  },
  "siren": "1234567890"
}

Signature algorithm: RS256

The hard part is signing the JWT with the appropriate private key, but there are plenty of other ways to get past all of this security theater.

Analytics

Every ~4h the application sends analytics to a central server:

POST /api/client/configuration/synchronisation

[
    "2021-08-08T15:22:17.856|true|||TACV_2DDOC_ANDROID_LITE|000000000||||2D-DOC_L1||",
    "2021-08-08T15:23:32.532|true|||TACV_DCC_ANDROID_LITE|000000000||||DCC_VACCINATION||"
]

Format: [DATE_TIME_SCAN]|[IS_VALID_SCAN]|[SCANNED_DOCUMENT_FLAGS]||[SCAN_MODE]|[USER_SIREN]||||[SCANNED_DOCUMENT_TYPE]|[EXCEPTION_MESSAGE]|

APKs

3.3.2

3.3.0

3.2.9

3.2.8

3.2.6

3.2.5

3.2.2

3.2.0

3.0.0

2.6.0

2.5.0

2.4.2

2.4.0

2.3.2

2.3.1

2.3.0

2.2.2

2.2.1

2.2.0

2.0.0

1.11.1

1.11.0

1.10.0

1.9.1

1.9.0

1.8.2

1.8.0

1.7.0

1.6.2

1.6.1

1.6

1.5.3

1.5.2

1.5.1

1.5

1.4.2

1.4

1.3

1.1