NYU's Independent Student Newspaper

Skirting the Screener
How Students Fake NYU’s COVID Pass
Skirting the Screener: How Students Fake NYU’s COVID Pass
Skirting the Screener: How Students Fake NYU’s COVID Pass

Frustrated with the Daily Screener, students are finding ways to avoid completing it.

Staff illustration by Susan Behrends Valenzuela.

When Clara Evaristo, a first-year studio art major at NYU, noticed that her Daily Screener wasn’t working, she realized that making a fake one was much easier than she thought — all she had to do was find the same fonts and colors that the real screener used. She took a screenshot of one of her completed screeners and used the online photo editor Picsart to create a textbox with a color sample from the background, type the new date in Helvetica Bold, and overlay that on top of the old date. 

Now, she could enter NYU buildings without completing the required Daily Screener, a questionnaire that NYU students must complete and show to Campus Safety officers in order to enter university buildings. Before COVID-19 vaccines were widely available, the screener asked students to affirm that they had not been experiencing COVID-19 symptoms. Students now log in with their NYU ID to verify their vaccination status.

Because Evaristo had incorrectly uploaded information about her booster shot to the NYU Student Health Center portal, she was unable to pass the Daily Screener for two weeks until the issue was resolved. Instead of taking weekly COVID-19 tests in the meantime, Evaristo decided to edit her old screeners to reflect the current date.

Why bother when you have easier alternatives?”

— an anonymous CAS first-year

Even though there were signs of inauthenticity, such as typos, she said that Campus Safety officers did not notice anything suspicious when she showed them her fake screener — they simply waved her through the gates.

After nearly four semesters of completing the Daily Screener, many students see it as a tedious ritual with no clear benefit. Some now fabricate their screener results by developing apps to generate lookalikes, exploiting programming flaws, manipulating screenshots or simply reusing out-of-date results.

Technical difficulties are one of the sources of frustration that lead students to forge their results. The screener requires users to complete several steps across three platforms — the NYU Mobile app, the survey site Qualtrics and the multi-factor authentication app Duo Mobile. Some students reported having to redo their screeners three to four times. Others had to wait for as long as a minute for the green “PASS” sign to load. 

“I think the major problem is really about the accumulation of annoyances, not so much the waste of time,” LS sophomore Matt Franco said. “There’s just so much you need to do.”

Students who choose to fake the screener said they were often motivated by convenience. Even if everything does go smoothly with no hiccups, it’s like, why bother when you have easier alternatives?” an anonymous CAS first-year said.

After a Daily Screener-free summer break, Tandon sophomore Aneesh Maganti did not want to go back to filling it out every morning. So he and his friend Calvin Tian, both computer science majors, designed and built a Windows application that automatically completes the screener. “I was just really frustrated and I had to do something about it,” Maganti said.

Maganti realized that the Daily Screener was essentially a Google Form, so he inserted the screener’s code into Selenium, a program that can fill out forms and automate websites. He then had to circumvent the multi-factor authentication step. “I would be working on my desk at my computer and then I’d have to get out my phone,” Maganti said. “But I knew there was some way to bypass it.” 

Tian extracted code from Bye DUO — an NYU student-made browser extension that allows students to log in to any NYU service without multi-factor authentication — and inserted it into their screener program.

A screenshot of the webpage for the Auto Daily Screener application.

The pair spent about a week perfecting the project. In September 2021, they posted the finished program on Reddit, where they received high praise from students. “You guys truly provide value to the NYU community,” one user wrote. “I hope you guys get whatever software engineer job/startup role you want.” 

A screenshot of a Reddit post by the creators of the Auto Daily Screener application announcing that it was available.

Maganti and Tian are not the only ones who have created a program. Some students have shared the link to fastdailyscreener.com, a website that makes it almost effortless to create fake screeners results. All students need to do is type in their names, and the website generates a Daily Screener look-alike with the current date. The site’s creator is unknown.

CAS sophomore Justin Chui has been using fastdailyscreener.com all year. “I’d be fine if the screener was just one button, but we have to go through so many steps just to show the guards basically a number,” he said, referring to the date on the screener. 

The only time he was stopped by a Campus Safety officer while using a fake screener was when he forgot to type in his last name. He feigned obliviousness, filled out the fake screener again and got away with it. “She definitely thought something was fishy,” Chui said. “I just acted like everything was fine.”

There are a few distinguishing factors between the fastdailyscreener.com imitation and the real Daily Screener — the font is slightly different and there are some punctuation errors. Other discrepancies can be attributed to browser differences. Still, students who spoke to WSN have not encountered many problems using inauthentic screeners like this one.

“I had this thing bookmarked and I used it all the way until spring break, when it suddenly stopped loading for me,” the CAS first-year said. “I never got stopped once.” According to NYU, students who do not show their Daily Screener may have their ID cards deactivated. WSN could not confirm any instances of this type of disciplinary action. In a statement to WSN, university spokesperson Shonna Keogan said the Office of Student Conduct has not received many reports of fake screeners.

“If students are found to have knowingly manipulated an access control measure in an effort to thwart security and public health protocols, the disciplinary consequences would become more formal and serious, such as disciplinary probation or restriction of privileges to access certain locations,” Keogan wrote.

Others have found a way to streamline the screener process without the use of external programs. In February, Franco noticed that if he completes the Daily Screener on Safari instead of NYU Mobile, he can simply refresh the page every morning and NYU will email him updated screener results. “I don’t even have to fake my screener now,” Franco said. He shared the trick with Reddit users on r/nyu.

This is such a common hacker technique that it really proves how shoddily the Daily Screener is programmed.”

— Mahi Shafiullah, computer science Ph.D. candidate

Mahi Shafiullah, a computer science Ph.D. candidate in NYU’s Courant Institute of Mathematical Sciences, explained that the Safari refresh method works because the screener’s developers neglected to block the replay attack. This technique, in which an authorized third party can fraudulently cause an action to repeat itself, is often used to steal money — for example, forcing Venmo to repeat a transaction.

“This is such a common hacker technique that it really proves how shoddily the Daily Screener is programmed,” Shafiullah said. “Anyone who knew what they were doing would have automatically prevented the replay attack. That’s why I was so shocked it worked.”

In addition to these creative techniques, many students say that security officers simply don’t catch those who pass off outdated screener results as current. WSN only spoke with one student who had received a warning.

Last semester, Chui was in a rush to get food from Palladium, so he showed the officers his screener from the day before. “I was just so, so hungry, and I couldn’t be bothered to do it,” he said. The officers didn’t notice at the time, Chui said, but the next day he received an email warning him that his ID card would be deactivated if he entered another building without the screener. “I took it seriously at first, but two weeks later, I stopped doing the screener again,” he said. “And nothing else happened.” 

Due to the lack of enforcement, some students have grown bold enough to slip past with an outdated screener and hope for the best. CAS sophomore Kurt Lukowitsch only completes his screener once or twice a month. “I figured I should at least have the month right, if not the date,” he said. “When I walk in, I just put my thumb over the date.” Only once has he been stopped by a guard who noticed that the day was incorrect. Lukowitsch said he simply stepped aside to complete the screener before proceeding.

Some students said NYU was unhelpful when issues out of their control prevented them from completing the screener.

When Steinhardt first-year Damila, who requested that her last name not be used, was in Chile for winter break, she was robbed at knifepoint by two teenagers who stole her phone, NYU ID and digital camera. She returned to New York to find that she was unable to complete the Daily Screener required for access to campus buildings — without her phone, she could not complete the multi-factor authentication step.

Read more: Locked out: a multi-factor authentication nightmare

In order to attend her classes in person, Damila had to call NYU IT services on her roommate’s phone to request a temporary 48-hour password that would allow her to complete the screener on her laptop without authentication from Duo Mobile. For two weeks, because she was having trouble with her laptop, she woke up an hour early to ensure she had time to print her Daily Screener. “Apart from me having that anxious, traumatizing event, I thought, OK, the school is going to understand, they will help me,’” she said. “But they did not help at all.”

At the beginning of the spring 2022 semester, a CAS junior’s NYU ID card was deactivated due to a technical error. She had fulfilled the vaccination requirement, but could not complete the Daily Screener. After a week and a half of calling the NYU Student Health Center and Department of Campus Safety, she gave up, and instead decided to use the photo markup tool on her iPhone to edit her past screeners. “They were so unprofessional and kept redirecting me — telling me to call someone else, or that this wasn’t their problem and I just needed to wait it out,” she said. 

She said that since attending NYU is so expensive, she would rather risk the consequences of faking her screener than wait until her ID was reactivated. 

Some students said they don’t understand the Daily Screener’s purpose, and hundreds have signed a petition to remove it. “I doubt that anyone on the COVID-19 safety board sincerely thinks the screener does anything,” Lukowitsch said. “But it’s about optics, you know? It’s just about bureaucracy.”

I don’t think it keeps us safe. If you got COVID-19, you can just lie and your screener doesn’t change.”

— LS first-year Simon Yu

Others have said the screener is mostly an honor system — one that people tend to breach. “I might as well pinky promise the guards I don’t have symptoms,” Tandon senior Landon Johnson said.

LS first-year Simon Yu’s biggest complaint is that the screener doesn’t serve its stated purpose of combating the spread of the virus. “I don’t think it keeps us safe,” he said. “If you got COVID-19, you can just lie and your screener doesn’t change.” An anonymous student tested positive for COVID-19 but did not report their symptoms. Though they self-quarantined, their screener remained green.

Two WSN editors were able to complete the Daily Screener with passing results on April 20 despite reporting positive COVID-19 tests to NYU a day earlier.

In a statement to WSN, university spokesperson John Beckman said there are currently no plans to get rid of the Daily Screener. Any changes to the process would likely cause confusion and a new set of problems, according to Beckman.

When the Daily Screener briefly stopped working on April 19, students, faculty and employees were temporarily allowed to enter buildings without presenting the screener. “The fact that they didn’t take this chance to get rid of the screener is pathetic,” one student wrote on Reddit. “Now get rid of the daily screener completely and reinstate the mask requirement,” another tweeted.

Some students have suggested alternatives to the current process. Opinion pieces and social media posts have suggested that NYU incorporate the information from the screener directly into students’ NYU ID cards. The anonymous CAS first-year said that his professor assigned a project to redesign the Daily Screener in his User Experience Design class. Students came up with ideas to streamline the process, such as a program that remembers a user’s NYU login without requiring the use of Duo Mobile.

“Every one of us could do it better,” the CAS first-year said. “Maybe we should just let the student body handle this one.”

Contact Jae Jin at [email protected]

Edited by Rachel Fadem. Developed for web by Sho Matsuyama.