PETALING JAYA: The government should close a loophole in the MySejahtera app which allows people to log into other people’s accounts on their phones, said former deputy health minister Dr Lee Boon Chye.

A check by FMT found that digital certificates can be displayed on other people’s phones upon logging in with the account of a fully vaccinated person. This will allow those who are unvaccinated to pass off as being fully vaccinated.

Digital certificates are issued to those who have received the requisite number of doses of the Covid-19 vaccine.

The discovery of this loophole comes soon after the government loosened certain restrictions for the fully vaccinated under the various phases of the national recovery plan, such as being able to dine-in and participate in economic activities in 11 different sectors.

“I think the government should look into this bug and rectify it so that people will not be able to get away with it easily,” Lee told FMT.

“This may not be much of a problem in the Klang Valley as most adults there are already vaccinated, but if the unvaccinated want to do this and move around, that is a risk they have to take — and they should be responsible for their own actions,” he said.

Among other SOPs eased for the fully vaccinated are allowing them to travel more than 10km within their districts, according to the sitting capacity of their vehicle as opposed to the previous two-person rule.

Earlier this month, the government allowed married couples, forced to live apart in different states or districts because of work or other commitments, to visit one another. It also allowed parents to visit their children who are below the age of 18.

The fully vaccinated are also now allowed to pray at mosques, suraus and non-Muslim houses of worship.

A person is considered to be fully vaccinated two weeks after receiving the second dose of the Pfizer-BioNTech, AstraZeneca and Sinovac Covid-19 vaccine, or 28 days after receiving single-dose vaccines such as Johnson & Johnson and CanSino.

Stressing that there has to be a “simpler way” for people to move around, Lee doubted whether making it mandatory for premises to double-check the digital certificate on MySejahtera with a person’s MyKad was the way forward.

“I don’t know if using the identity cards to verify will be useful as enforcement will become cumbersome. If you need to check their MyKad or other forms of identity, it becomes very complicated,” he noted.

Lee also advised people to guard their MySejahtera login details, noting that people were effectively “stealing your identity” the moment they logged in to the app with another person’s account.

“If you are registered with MySejahtera, you have your identity and it’s your responsibility to make sure it’s not stolen,” said the Gopeng MP.

FMT has reached out to the science, technology and innovation ministry (Mosti) for comment.

https://www.freemalaysiatoday.com/category/...ously-says-lee/

70m budget only. Jangan persoal pls.

the cert should also display photo as in mykad

inb4 face plastic surgery

Its not a bug.

Make it like whatsapp, only can log in, sign in on one phone

If detect second phone log in, auto log out

no issue, we create issue..

This post has been edited by brkli: Aug 22 2021, 04:23 PM

He doesn't have multiple phones?

it was not a bug. More than one phone can login into same mysejahtera, some ppl do that for their dependent that find it hard to register for themselves. Should the officer check if IC match with cert, then it would not create any issue.

This post has been edited by akhito: Aug 22 2021, 04:37 PM

Still need password to login ma

lulz,.. my sejahtera not log in with the phone number ??.. multiple phone can log in ??

yes,.. but i can give the password and login to my brothers or friends that no vaccinne,. to pass the 2 dose restriction,..

it still doesn't solve the issue of antivax use vax cert

because can always relog

or bagi pinjam phone terus if live under same roof or nearby

Kena minta ic like this..

Just verify the digital cert with IC number, is it difficult? I thought the digital cert has IC number in it, no?

Need another rm70 mil to fix the bug

Thanks for the loophole....

That will cost you 140m

use other people name?

no thanks.

THIS

the account should lock up once it detect secondary login

and action needed to be done by the actual owner to relogin
something will need to be changed once it locks up

diam2 sudah

need another project call MyFix to fix the loophole
budget : RM140m

not sure if you're encouraging burdensome on spillover...

but it could prevent 2 device online at the same time

btw, lets say i have 2 phones. and my iphone bateri mati,
i check in dengan android mysejahtera

how?

too advance..can't do it without additional cost..

70m is for dumb website that keep 404.

this mysejahera is hundreds and hundreds of millions

Jeng jeng jeng.... Vaccine photo card anybody

just put face photo there, the one from IC, kautim.

Simple.

Allow the Mysejahtera account to add a secondary phone number. Of course need to provide proof that you are the owner of the secondary phone number. Once added, can sign in with the other phone and a PIN will be sent to the secondary phone number for verification.

Even i use both samsung phone and tablet, i only install MySJ on phone
If phone no battery, i use web check in on tablet

lol yes i have 3 phones logging into my mysj accounts

yes

this is the workaround behavior

but the solution suggested is giving burdensome on his workaround behavior

Since everyone is wearing mask, how you gonna verify the person holding the IC is the actual person🤔🤔🤔

just use the method google is using

u can login but mysejahtera will be asking u to verify your identity
asking u to enter details that only the owner knows

but if the same account is being used 2 device at the same time...account will lock

bang,

vax and antivax are friend (or partners, because that's how exploitation can even happened....bukannya hacking)

they can simply just switch the login

and there are cases were people with multiple devices log in into mysej into all of their devices

Wow... I didn't know it is worth to replicate one's IC just to get the digital cert... Really need to go to such extent ?

Don't blame anti vaxx lol

More like the public did the wrong approach and try to shame these people and give more difficulties.

It's not even a vaccine to stop spreading . Everyone still will be carrier but after punishing the retailers , now non vaccinated /anti vaxxer get punished.

Nobody wanna do things upto this extent (fake cert) especially if they need to pay . This is a pathetic situation and depressing thingy instead.

bro, look at the picture TS using...both device are on the account simultaneously
on a google account, that would have trigger a warning and account would lock up

and once u login onto a different device, everytime it will prompt u to verify yourself with details only u know

yeah i did

and i provide the extension of exploitation,

yet you failed to provide the workaround

bodoh dijumpai. that's the purpose of MyKad.


that's how login work. some people like to login their email in every devices that the own. else auto logout all other session. but that doesn't solve the main issue, which is login with other people's credentials. this is not even an issue to begin with. verification needs to be checked with mykad.

This post has been edited by Skylinestar: Aug 22 2021, 07:57 PM

You guys think so and wide. Inikah generasi celik IT?


Banks already use single session for their banking app. Susah sangat until gomen need another RM70mil to consult them on implementing it?

it doesn't solve when the ID owner is the one who abuse the leeway by letting other people concurrently use his/her ID on multiple devices.

This post has been edited by Oltromen Ripot: Aug 22 2021, 08:02 PM

Exactly, enforcers can always seek to verify mykad along with digital cert on doubt.
Common folks won't wanna risk replicating an IC for a digital cert.

If that's the case, then this person is risking a heavy crime. Not worth in my opinion.

minta laa ic time check cert tu

why would government scared non vaccine people go inside shop with vaccinated people? if the vaccine is not effective, why take it in the first place?

logic?

if vaccinated people can still contract c19, this rules still posed threat to other people going to place that only allowed vaccined people. they can still get infected nontheless.

Polis saja boleh minta ya.

minta for checking only, not take ur ic. your ic number is already visible in the app anyway.
otherwise, then the cafe/owner can refuse entry.

This post has been edited by ciwi1166: Aug 22 2021, 09:37 PM

Guna new phone can get more than 2 jabs

Malas mau check, then call it a loophole.

... if this is in the SOP then boleh la ....otherwise it's illegal to check IC

jbcoder faps to this

apa bodo this guy

it's like any app out there

got password can sign in many device.

Still got loop whole, just log in when checked la, then the other person login when checked.

The new SOP is really stupid.

Last time u ask people to scan Mysejahtera before enter retail outlets and restaurant, now they want fully vaccinated people to enter it.

This kind of SOP will have so much backlash and issue in the future.

Why gov want to discriminate vaccinated and unvaccinated people

Many people have two phones. This is by design. You think those work on 70m budget are dumb people

Take extra step to check IC but no one does that

Lol, brother can always pass the password to another family member to log in.


Can. Have been using my own mysejahtera on 2 phones all the while. The issue can be solved by checking the ic number with the fellas IC

Thank you for reporting this loophole.
Now everyone knows about it.

Everyone already knew about it BEFORE it is officially announced.

This is excellent idea actually

U dont want ppl to check ur ic then dont go out or dine in. Easy

Wau wau you can changed the SOP ahh…👏

Then you are the problem not the app.

grab implemented similar facial recognition when you register for the first time

im not fancy over 2FA because it can be easily manipulated + more cumbersome

the issue now is how can physical shop identify the person with mysej cert is you only
and not someone impersonating to be you

what stopping them from screenshot & photoshop the info?

lol

i have my cert on both of my phones

but usually i only use one phone since check in history doesnt sync on both phones, only use another phone as backup

Lol, 1 person dont do doesnt mean thousands others wont do. What ppl here is trying to do is to find a solution to the loophole. If the app can be accessed by different people especially when it involves the nations health, then something is wrong

Soon, Your penis length and thickness info are also recorded inside

well indonesia had used virginity test checking

but you sure seems obsessed with dick for some reason