Cwa-documentation: Non-functional QR Code on the documentation handed out with the test

[thawn]

Where to find the issue

Edit: Just to clarify, I am referring to the two QR-codes visible in the picture below:

1. The code in the red part near the center-left is functional
2. The code near the bottom-right is non-functional

When I got tested, I got a sheet looking like this:

I will refer to the part containing a lot of red text and boxes as "the red part" and the documentation part containing black text as "the documentation part".

The red part contained a functional QR code, while the documentation part contains a non-functional QR code.
The part with the functional QR-Code stayed in the testing facility, while the part with the non-functional QR-code can be taken home.

Describe the issue

During the test procedure, I saw that there was a QR code on the documentation part which I could take home.
Therefore, I decided to not bother scanning the QR code during the testing procedure but wait till I get home (I was busy filling out forms and did not want to take out my phone in the testing facility).
When I got home, I realized that the QR code on the documentation part did not work because it is just an example.
By that time, I was unable to scan the correct code, because the red part with the correct code stayed in the test facility.

To make matters worse, it says "Scannen Sie diesen Code" - "scan this code". Next to the non-functional code.

Suggested change

Ideally, an identical functional code is printed onto the documentation part as well as the red part that remains at the test site.

Obviously, this means that the documentation part is now individualized for each test

If this is not possible:

1. The non-functional code should be removed from the documentation part.
2. The text "Scannen Sie diesen QR-Code gleich jetzt" - "scan this QR-code right now" should be printed next to the functional code.
3. The documentation should state clearly that the functional code remains at the testing facility and must be scanned before turning in the red part

Summary

To me this is a clear case of Murphy's law in an unholy marriage with nudging into the wrong direction:

• If you hand out a functional and a non-functional QR code, inevitably some people will scan the wrong code.
• If people have easier (and longer) access to the wrong code and you print "scan this code" next to the wrong code, then the majority will scan the wrong code.

---

Internal Tracking ID: EXPOSUREAPP-4026

[heinezen]

Hey @thawn ,

Thank you for reporting this issue. I have forwarded your finding internally by creating a Jira ticket (ticket ID: EXPOSUREAPP-4026). We will notify the RKI about this and see what we can do to improve the documentation. If we have any news of a fix, we will report it here on Github.

Regards,
CH

---

Corona-Warn-App Open Source Team

[Ein-Tim]

Related to: #400

[MikeMcC399]

@thawn
Each form is supposed to be unique, with a functioning Globally Unique Identifier (GUID), so your "suggested change" is actually the way it is supposed to work already. Since the forms are supposed to be unique, they are not allowed to be copied.

There is a nice video on https://www.synlab.de/human/coronavirus/fuer-niedergelassene-aerzte/ausfuellhilfe-fuer-corona-scheine-muster-10-c-oegd which explains how to fill out the forms.

It's difficult to know exactly what happened without seeing the form associated with your test, and you wouldn't want to post that publicly anyway. Possibly somebody copied a form or there were apparently some forms in circulation which contained invalid QR codes. It's good that @heinezen is involving RKI as they are the real authority here.

[thawn]

@MikeMcC399

Each form is supposed to be unique, with a functioning Globally Unique Identifier (GUID), so your "suggested change" is actually the way it is supposed to work already. Since the forms are supposed to be unique, they are not allowed to be copied.

As far as I can tell, this is only true for the red sheet. The documentation attached to it contains a different code which in my case was non-functional. This is also obvious in the example picture I linked to - both QR-Codes are clearly different.

Just to make sure, can you please confirm that the second code at the bottom of the documentation (the sheet that can be taken home) is also supposed to be functional?

[thawn]

@MikeMcC399
I also checked the videos. Also there you can clearly see that the two QR-codes (one near the center-left and one near the bottom-right) are clearly different. Are you sure that both QR codes are functional?

[MikeMcC399]

@thawn

Also there you can clearly see that the two QR-codes (one near the center-left and one near the bottom-right) are clearly different. Are you sure that both QR codes are functional?

If you scan the QR codes with a regular QR scanner app (not using the Corona-Warn-App) the one near center-left produces
GUID=3D6D08-3567F3F2-4DCF-43A3-8737-4CD1F87D6FDA
and the one near bottom-right produces:
https://localhost/?3D6D08-3567F3F2-4DCF-43A3-8737-4CD1F87D6FDA

so they both basically contain the same GUID (which incidentally is printed in clear text under each of the two QR codes).

If you scan the QR in the bottom-right of the example form using the CWA app, you get an error message:

"QR code is invalid
The QR code is invalid or has been registered on another smartphone already. ..."

When you get this error you don't know which of the two error conditions applies:

• is the QR code invalid?
• has somebody else already scanned it in?

Plus there is another possibility not mentioned:

• have you scanned it in, deleted the test and then tried to scan it in again?

It is clear from reading the form that the QR code at the bottom of the form is the one which is supposed to be scanned into the app by the person who has been tested and it is supposed to be functional.

Would you like to post a screen shot of the scanning error message from the CWA app? The message you get when you try to scan the code on the black part of the form 10C which was handed to you (not the "Muster nicht kopieren" form)? Just to make sure we are talking about the same issue.

[thawn]

"QR code is invalid The QR code is invalid or has been registered on another smartphone already. You will get your test result from the Testcenter or from the Lab independent of the validity of the QR-Code. In case of a positive result..."

This is exactly the error message I got after scanning the code.

It is clear from reading the form that the QR code at the bottom of the form is the one which is supposed to be scanned into the app by the person who has been tested and it is supposed to be functional.

This is exactly what I did.

GUID (which incidentally is printed in clear text under each of the two QR codes
My name is printed onto the sheet that I took home with me and it contains the GUID underneath the QR code, so it looks like indeed it is a personalized QR-code.

Maybe something else went wrong. I am certain, that noone but myself had access to the sheet (at least after I received it from the test center). Also, I have not scanned it in, deleted the test and tried again.

so they both basically contain the same GUID

This is good to know and if this works for most users, everything is fine.

[thawn]

I just installed the latest update of the app and now it worked.

What was different this time was that the app asked for my permission before scanning in the QR code. This did not happen before.

So I can confirm that the QR codes are indeed both personalized and are working as intendended. Not sure what the issue with the old version of the app was on my phone.

[MikeMcC399]

@thawn

I just installed the latest update of the app and now it worked.

That's great! 🚀

Do you know what version of the app you were using when the scan did not work? Was it 1.6.1? I assume you have now updated to 1.7.0.

If you are interested in getting to the root-cause you could scan in the code with a QR scanner (not the built-in CWA scanner) and post the beginning of it here e.g.
https://localhost/?3D6D08

[thawn]

Do you know what version of the app you were using when the scan did not work? Was it 1.6.1? I assume you have now updated to 1.7.0.

I am not sure what version I was using when the problem occurred. Ihave automatic updates turned on, so it should have been whatever version was current in the first week of November (that is when I got tested). Now, I am using ~1.7.0~
Edit: I checked again and I am currently using 1.6.1 and with that version it worked so I guess I was using 1.5.1 when it did not work.

If you are interested in getting to the root-cause you could scan in the code with a QR scanner (not the built-in CWA scanner) and post the beginning of it here

HTTPS://LOCALHOST/?46DBCD

[MikeMcC399]

@thawn

I am not sure what version I was using when the problem occurred. Ihave automatic updates turned on, so it should have been whatever version was current in the first week of November (that is when I got tested). Now, I am using 1.7.0

I'm guessing that you are using Android, not iOS, since the current version of CWA Android is 1.7.0 and for CWA iOS it is 1.7.1.

The version which was current in the first week of November was version 1.5.1. The version after that, 1.6.0, was released on Nov 11, 2020 and it had fixes in it regarding reading QR codes. (See https://github.com/corona-warn-app/cwa-app-android/pull/1524). That could easily explain why you had a problem at the beginning of November. (The start of the QR code you posted looks right by the way.)

Thank you for the dialogue. It's good to have understood the reasons for the issue and even better that it has now worked for you!

Edit: The QR code was upper case, causing the issue on CWA 1.5.1.

[thawn]

@MikeMcC399 Thank you very much for your help and thorough analysis :-)

[thawn]

@MikeMcC399 it looks like I was indeed affected by https://github.com/corona-warn-app/cwa-app-android/pull/1524 because the URL in my QR-Code is all upper case.

[dsarkar]

@thawn, thanks for the feedback! Best wishes,
DS

---

Corona-Warn-App Open Source Team