A proof-of-vaccination mobile application previously recommended by the Calgary Flames is under fire over allegations it exposed hundreds of thousands of users&#8217; personal data. 
A new CBC report <a href="https://www.cbc.ca/news/canada/calgary/portpass-privacy-breach-1.6191749">alleges</a> Portpass, which claims to have 650,000 users in Canada, has exposed the personal information of those who had signed up for the service by failing to encrypt the back-end of its website.

Tuesday&#8217;s CBC report warns that driver&#8217;s licenses, passports, email addresses, phone numbers, and birthdays submitted to Portpass can &#8220;easily be viewed&#8221; in plain text by accessing the unsecured database.
The Flames&#8217; <a href="https://www.nhl.com/flames/fans/vaccination-policy">vaccination policy</a> webpage, which previously described Portpass as the &#8220;preferred and fastest&#8221; method of verifying a patron&#8217;s vaccination status prior to entering the Scotiabank Saddledome, remained unchanged for two days after <a href="https://www.cbc.ca/news/canada/calgary/portpass-security-concerns-1.6190403">a previous CBC report</a> by Sarah Rieger on Sunday raised concerns about Portpass&#8217;s reliability and the security of the data the app collects from its users. The Flames updated the webpage Tuesday afternoon.
Proof of vaccination is currently required to attend all CSEC events, including Calgary Flames hockey games at the Saddledome and Calgary Stampeders football games at McMahon Stadium.
The Flames announced their endorsement of the Portpass application on Sept. 22, touting the company&#8217;s &#8220;made-in-Calgary&#8221; roots and claiming the app &#8220;provides a solution for safely and securely sharing vaccine health status for access requirements while protecting user-health privacy and data security at the highest level.&#8221;
Flames vice president of communications Peter Hanlon told FlamesNation Tuesday morning the organization is &#8220;aware of the concerns that were raised regarding the app&#8221; and is &#8220;working with the developer to validate.&#8221;
&#8220;We will be able to provide more information to our fans in the next day or two,&#8221; Hanlon added.
Portpass <a href="https://portpass.ca/for-users/">claims</a> its app confirms the validity of its users&#8217; profiles using an artificial intelligence system and that it uses blockchain to &#8220;fully encrypt&#8221; all data. The app also offers a QR code for verification purposes.
Calgary-based software developer Conrad Yeung posted <a href="https://twitter.com/yeungc/status/1442198861859090433">a Twitter thread</a> on Sept. 26 detailing privacy and security issues he said he noticed in the Portpass application.
Yeung said he successfully created a fully verified profile on the app using the biographical data of actor Rob Schneider and an edited Alberta government immunization record card showing &#8220;proof&#8221; of him having received two shots of a nonexistent &#8220;Deuce Bigalow&#8221; vaccine.
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
Yes, I used Rob Scheider for testing the app.
But that&#39;s not the juicy part.
The juicy part is the photo attached to this tweet 👇
Both doses are verified by the app by their &quot;AI Blockchain tech and medical pros.&quot;
I wonder who these medical pros are 🤔
/2 <a href="https://t.co/HDNLdxvC7D">pic.twitter.com/HDNLdxvC7D</a>
&mdash; Conrad Yeung (@yeungc) <a href="https://twitter.com/yeungc/status/1442198865629749248?ref_src=twsrc%5Etfw">September 26, 2021</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
During a phone conversation with FlamesNation Monday evening, Yeung reiterated his concerns about the Portpass application&#8217;s security and said it is &#8220;absolutely not&#8221; effective for verifying vaccination status.
&#8220;If something so ridiculous like that got verified, who&#8217;s actually verifying the data on the back-end? Is it actually, for example, AI and blockchain, like they said that they&#8217;re using? Because, you know, I work in the industry,&#8221; Yeung told FlamesNation. &#8220;Blockchain doesn&#8217;t work in the way that they&#8217;re describing it as.&#8221;
Yeung said he noticed Portpass&#8217; website<a href="https://twitter.com/yeungc/status/1442198902988435467"> does not require</a> browsers to validate SSL security certificates. He also told FlamesNation he was able to easily access Portpass&#8217; back-end directory, &#8220;just like that,&#8221; and expressed concerns about the potential vulnerability of user data.
&#8220;Why is the Calgary Sports and Entertainment Corporation promoting something so primitive &amp; scammy?&#8221; Yeung <a href="https://twitter.com/yeungc/status/1442198912387874819">tweeted</a> on Sept. 26. &#8220;This app is the easiest way for people who want to skirt the system to&#8230; well&#8230; basically bypass the system.&#8221;
CSEC&#8217;s endorsement of the Portpass system remained in its original form on the Flames&#8217; official website <a href="https://twitter.com/sarahcrgr/status/1442920089343250432">as of 9:45 a.m. MT</a> on Tuesday morning. All information recommending Portpass was removed from the Flames&#8217; website by 12:30 p.m. MT. on Sept. 28 and was replaced by a message encouraging fans who have signed up for the service to prepare alternate forms of ID and proof of vaccination.
<figure id="attachment_86441" aria-describedby="caption-attachment-86441" style="width: 1024px" class="wp-caption aligncenter"><img loading="lazy" decoding="async" class="size-large wp-image-86441" src="https://flamesnation.ca/wp-content/uploads/sites/2/2021/09/Screen-Shot-2021-09-27-at-10.25.57-PM-1024x473.png" alt="" width="1024" height="473" srcset="https://publish.flamesnation.ca/wp-content/uploads/sites/2/2021/09/Screen-Shot-2021-09-27-at-10.25.57-PM-1024x473.png 1024w, https://publish.flamesnation.ca/wp-content/uploads/sites/2/2021/09/Screen-Shot-2021-09-27-at-10.25.57-PM-300x139.png 300w, https://publish.flamesnation.ca/wp-content/uploads/sites/2/2021/09/Screen-Shot-2021-09-27-at-10.25.57-PM-768x355.png 768w, https://publish.flamesnation.ca/wp-content/uploads/sites/2/2021/09/Screen-Shot-2021-09-27-at-10.25.57-PM-1536x710.png 1536w, https://publish.flamesnation.ca/wp-content/uploads/sites/2/2021/09/Screen-Shot-2021-09-27-at-10.25.57-PM-2048x946.png 2048w" sizes="(max-width: 1024px) 100vw, 1024px" /><figcaption id="caption-attachment-86441" class="wp-caption-text">Screenshot of nhl.com/flames/fans/vaccinationpolicy captured at 10:26 p.m. MT on Sept. 27, 2021.</figcaption></figure>
FlamesNation spoke to more than a half-dozen people who attempted to use Portpass while attending Sunday&#8217;s Flames preseason game against the Edmonton Oilers at the Saddledome.
&#8220;I tried to use it,&#8221; said Steven Poffenroth. &#8220;I had it all set up and working three days prior but the app has since glitched and no longer shows my status. I have a screenshot of my &#8216;My Pass&#8217; saying I am verified and vaxxed but now it says I am &#8216;not verified.&#8217;
&#8220;I have no idea what&#8217;s going on with the app,&#8221; Poffenroth added.
Prior to the start of Sunday&#8217;s game, Portpass <a href="https://twitter.com/portpasscanada/status/1442266448458498050">posted a statement</a> on its official Twitter account warning users of &#8220;technical difficulties&#8221; and asking fans to bring a piece of paper carrying proof of immunization to the Saddledome.
&#8220;Everything showed up as &#8216;unverified &#8211; unverified,&#8217; [I] couldn&#8217;t even see my own picture on the profile,&#8221; said Jack Warren. &#8220;The only reason I downloaded it was to go to games at the Saddledome. I had never even heard of the app until the Flames/CSEC posted about it.&#8221;
&#8220;I had downloaded it, as requested by the Flames. Submitted my vaccine info photos as well as my driver&#8217;s licence,&#8221; said James Johnson. &#8220;Checked it three hours before game time and it wasn&#8217;t working.
&#8220;The Flames (CSEC) said to use it, so, naturally, I thought it was safe,&#8221; Johnson added.
The Alberta government has yet to release a mobile application to prove vaccination status; its system for providing downloadable immunization record cards <a href="https://www.cbc.ca/news/canada/calgary/portpass-security-concerns-1.6190403">has been criticized</a> by security experts for lacking QR code integration and allegedly enabling forgeries through its use of unlocked PDF files. The government <a href="https://calgary.ctvnews.ca/looking-for-a-vaccine-card-in-alberta-you-won-t-need-a-myhealth-records-account-after-all-1.5591547">has stated</a> QR code verification for vaccine status is coming &#8220;in the following weeks.&#8221;
Portpass has not responded to FlamesNation&#8216;s requests for comment as of the time of publication.

A proof-of-vaccination mobile application previously recommended by the Calgary Flames is under fire over allegations it exposed hundreds of thousands of users' personal data. 

A new CBC report <a href="https://www.cbc.ca/news/canada/calgary/portpass-privacy-breach-1.6191749">alleges</a> Portpass, which claims to have 650,000 users in Canada, has exposed the personal information of those who had signed up for the service by failing to encrypt the back-end of its website.



Tuesday's CBC report warns that driver's licenses, passports, email addresses, phone numbers, and birthdays submitted to Portpass can "easily be viewed" in plain text by accessing the unsecured database.

The Flames' <a href="https://www.nhl.com/flames/fans/vaccination-policy">vaccination policy</a> webpage, which previously described Portpass as the "preferred and fastest" method of verifying a patron's vaccination status prior to entering the Scotiabank Saddledome, remained unchanged for two days after <a href="https://www.cbc.ca/news/canada/calgary/portpass-security-concerns-1.6190403">a previous CBC report</a> by Sarah Rieger on Sunday raised concerns about Portpass's reliability and the security of the data the app collects from its users. The Flames updated the webpage Tuesday afternoon.

Proof of vaccination is currently required to attend all CSEC events, including Calgary Flames hockey games at the Saddledome and Calgary Stampeders football games at McMahon Stadium.

The Flames announced their endorsement of the Portpass application on Sept. 22, touting the company's "made-in-Calgary" roots and claiming the app "provides a solution for safely and securely sharing vaccine health status for access requirements while protecting user-health privacy and data security at the highest level."

Flames vice president of communications Peter Hanlon told FlamesNation Tuesday morning the organization is "aware of the concerns that were raised regarding the app" and is "working with the developer to validate."

"We will be able to provide more information to our fans in the next day or two," Hanlon added.

Portpass <a href="https://portpass.ca/for-users/">claims</a> its app confirms the validity of its users' profiles using an artificial intelligence system and that it uses blockchain to "fully encrypt" all data. The app also offers a QR code for verification purposes.

Calgary-based software developer Conrad Yeung posted <a href="https://twitter.com/yeungc/status/1442198861859090433">a Twitter thread</a> on Sept. 26 detailing privacy and security issues he said he noticed in the Portpass application.

Yeung said he successfully created a fully verified profile on the app using the biographical data of actor Rob Schneider and an edited Alberta government immunization record card showing "proof" of him having received two shots of a nonexistent "Deuce Bigalow" vaccine.

https://twitter.com/yeungc/status/1442198865629749248

During a phone conversation with FlamesNation Monday evening, Yeung reiterated his concerns about the Portpass application's security and said it is "absolutely not" effective for verifying vaccination status.

"If something so ridiculous like that got verified, who's actually verifying the data on the back-end? Is it actually, for example, AI and blockchain, like they said that they're using? Because, you know, I work in the industry," Yeung told FlamesNation. "Blockchain doesn't work in the way that they're describing it as."

Yeung said he noticed Portpass' website<a href="https://twitter.com/yeungc/status/1442198902988435467"> does not require</a> browsers to validate SSL security certificates. He also told FlamesNation he was able to easily access Portpass' back-end directory, "just like that," and expressed concerns about the potential vulnerability of user data.

"Why is the Calgary Sports and Entertainment Corporation promoting something so primitive &amp; scammy?" Yeung <a href="https://twitter.com/yeungc/status/1442198912387874819">tweeted</a> on Sept. 26. "This app is the easiest way for people who want to skirt the system to... well... basically bypass the system."

CSEC's endorsement of the Portpass system remained in its original form on the Flames' official website <a href="https://twitter.com/sarahcrgr/status/1442920089343250432">as of 9:45 a.m. MT</a> on Tuesday morning. All information recommending Portpass was removed from the Flames' website by 12:30 p.m. MT. on Sept. 28 and was replaced by a message encouraging fans who have signed up for the service to prepare alternate forms of ID and proof of vaccination.

[caption id="attachment_86441" align="aligncenter" width="1024"]<img class="size-large wp-image-86441" src="https://flamesnation.ca/wp-content/uploads/sites/2/2021/09/Screen-Shot-2021-09-27-at-10.25.57-PM-1024x473.png" alt="" width="1024" height="473" /> Screenshot of nhl.com/flames/fans/vaccinationpolicy captured at 10:26 p.m. MT on Sept. 27, 2021.[/caption]

FlamesNation spoke to more than a half-dozen people who attempted to use Portpass while attending Sunday's Flames preseason game against the Edmonton Oilers at the Saddledome.

"I tried to use it," said Steven Poffenroth. "I had it all set up and working three days prior but the app has since glitched and no longer shows my status. I have a screenshot of my 'My Pass' saying I am verified and vaxxed but now it says I am 'not verified.'

"I have no idea what's going on with the app," Poffenroth added.

Prior to the start of Sunday's game, Portpass <a href="https://twitter.com/portpasscanada/status/1442266448458498050">posted a statement</a> on its official Twitter account warning users of "technical difficulties" and asking fans to bring a piece of paper carrying proof of immunization to the Saddledome.

"Everything showed up as 'unverified - unverified,' [I] couldn't even see my own picture on the profile," said Jack Warren. "The only reason I downloaded it was to go to games at the Saddledome. I had never even heard of the app until the Flames/CSEC posted about it."

"I had downloaded it, as requested by the Flames. Submitted my vaccine info photos as well as my driver's licence," said James Johnson. "Checked it three hours before game time and it wasn't working.

"The Flames (CSEC) said to use it, so, naturally, I thought it was safe," Johnson added.

The Alberta government has yet to release a mobile application to prove vaccination status; its system for providing downloadable immunization record cards <a href="https://www.cbc.ca/news/canada/calgary/portpass-security-concerns-1.6190403">has been criticized</a> by security experts for lacking QR code integration and allegedly enabling forgeries through its use of unlocked PDF files. The government <a href="https://calgary.ctvnews.ca/looking-for-a-vaccine-card-in-alberta-you-won-t-need-a-myhealth-records-account-after-all-1.5591547">has stated</a> QR code verification for vaccine status is coming "in the following weeks."

Portpass has not responded to FlamesNation's requests for comment as of the time of publication.

Calgary Flames-endorsed proof-of-vaccination app criticized for lack of security, reliability

Flames Game Day 66: A gigantic road trip begins in Toronto (5:30pm MT)

FlamesNation Mailbag: A pivotal week begins for the Flames

Recap: Wranglers shutout in goaltending battle against the Canucks

Calgary Flames goaltender Daniel Vladar (80) and goaltender Dustin Wolf (32) celebrate after a shootout victory over the Minnesota Wild at Scotiabank Saddledome

Recent articles from Mike Gould

Breaking News