  Due to the widespread COVID-19 pandemic, there has been a push for `immunity
passports' and even technical proposals. Although the debate about the medical
and ethical problems of immunity passports has been widespread, there has been
less inspection of the technical foundations of immunity passport schemes.
These schemes are envisaged to be used for sharing COVID-19 test and
vaccination results in general. The most prominent immunity passport schemes
have involved a stack of little-known standards, such as Decentralized
Identifiers (DIDs) and Verifiable Credentials (VCs) from the World Wide Web
Consortium (W3C). Our analysis shows that this group of technical identity
standards are based on under-specified and often non-standardized documents
that have substantial security and privacy issues, due in part to the
questionable use of blockchain technology. One concrete proposal for immunity
passports is even susceptible to dictionary attacks. The use of `cryptography
theater' in efforts like immunity passports, where cryptography is used to
allay the privacy concerns of users, should be discouraged in standardization.
Deployment of these W3C standards for `self-sovereign identity' in use-cases
like immunity passports could just as well lead to a dangerous form identity
totalitarianism.
