This repository has been archived by the owner on May 16, 2023. It is now read-only.
PDF Export-All Allows Country Check Circumvention #913
Labels
question
Further information is requested
Your Question
What is the reasoning behind not filtering foreign certificates in the "export all" feature?
Right now (CWA version 2.24, 2.25), I can simply import a single foreign DCC, click export all, and I get a nice 1-page PDF of my foreign DCC with a German look around it. Why prevent this in the individual export, but not in the bulk export?
What is more: the individual export (on Android) is hidden in the certificate details, behind the overflow menu. From the certificate landing page, this requires 4 taps and 1 scroll.
The export-all on the other hand is on the certificate landing page and is clearly visible through its icon. 1 tap away.
Thus it is much more exposed to the user.
Why this difference? What are the two different threat models that you applied here?
The text was updated successfully, but these errors were encountered: