Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brussels launched an age checking app. Hackers took 2 minutes to break it

politico.eu

Post reply on HN
Print view View original

51–60 of 221 posts

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#51

Post by Sweepi »

Atreiden wrote: post #45
close04 wrote: post #33

Earlier quoted context omitted.

You make it sound like you put no effort in understanding my comment and just followed up with whatever supported your view. If you have anything on your phone that should be off limits to your child but make no effort to ensure that (give them the phone, no passwords, no supervision) because it’s too inconvenient you are failing the child. Can I put it in simpler words? > What do you have on your phone that's danger…

I don't like the idea of a central authority determining what "my child should be kept away from" and then implementing Orwellian surveillance laws to enforce it. "For the sake of the children". Seeing something scary, disturbing, or sexual on the internet as a child does not result in a maladjusted adult. These laws are about one thing and one thing only - furthering the global surveillance network. Everything else…

| 'I don't like the idea of a central authority determining what "my child should be kept away from" and then implementing Orwellian surveillance laws to enforce it.'

Well thank God this about a double-blind way to verify your age and not that.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#53

Post by nottorp »

sofixa wrote: post #49
nottorp wrote: post #46

Earlier quoted context omitted.

> That doesn't make sense, all IDs are already in a single government database. Kind of by definition in fact, for IDs to be useful they need to be emitted by a central authority with associated security and revokability guarantees. Yes and those databases are decently protected. However for an "app" someone will do a web 4.0 or 6.0 bridge to access these databases. Maybe even vibe code it. That's what I'm worried ab…

Hence the second paragraph in my comment. The app is client side and reads the physical ID.

Hmm how is it zero knowledge when you can be tracked to a single installation of an app? I thought zero knowledge means they ask a "trusted" 3rd party, i.e. the government. And that says yes/no, without passing any ID details on.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#54

Post by lyu07282 »

JimDabell wrote: post #3

Note that this is an implementation of eIDAS: https://www.eudi-wallet.eu/ The point of this is that you can use the credentials on your phone to prove that you are an adult to a website using zero-knowledge proofs to avoid disclosing your identity to anybody. If somebody who has access to your unlocked phone can access the data in the app, then this is something that should be tightened up but it’s a substantial priv…

The alternative would be to just not do anything and to remove liability from Meta et al. In the world we live in, where competing interests already spent tens of billions to bribe/lobby the EU, we have to be realistic about it.

This open source and transparent ZKP-based approach is extremely surprising to see, publishing a draft in advance and inviting the public to break it so it can be improved? Are you kidding me? What about the billions of private investment in all the companies that offer centralized ID checks like Persona, Socure, ID.me and more? Thats a growing billion dollar industry. They all counted on this as a future market opportunity that the EU just seem to have destroyed at least in the EU?

People fighting against this age id app might be paradoxically useful idiots for billion dollar investments and lobbying efforts. The demos is once again dragged into the trenches to fight a war they don't understand.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#55

Post by JimDabell »

kdheiwns wrote: post #47
JimDabell wrote: post #44

Earlier quoted context omitted.

> Most people trust their kids to generally not do bad things. Okay, so trust them not to access age-gated sites using your credentials then.

Then just get rid of the age gating and verification entirely because it's useless.

Other parents have different opinions to you about the value of this.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#56

Post by [deleted] »

Atreiden wrote: post #45
close04 wrote: post #33

Earlier quoted context omitted.

You make it sound like you put no effort in understanding my comment and just followed up with whatever supported your view. If you have anything on your phone that should be off limits to your child but make no effort to ensure that (give them the phone, no passwords, no supervision) because it’s too inconvenient you are failing the child. Can I put it in simpler words? > What do you have on your phone that's danger…

I don't like the idea of a central authority determining what "my child should be kept away from" and then implementing Orwellian surveillance laws to enforce it. "For the sake of the children". Seeing something scary, disturbing, or sexual on the internet as a child does not result in a maladjusted adult. These laws are about one thing and one thing only - furthering the global surveillance network. Everything else…

[deleted]

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#57

Post by klausa »

mrweasel wrote: post #21
klausa wrote: post #17

Earlier quoted context omitted.

You're competing with photos of a drivers license.

Not sure if you're joking or not, but Denmark have had people show an edited screenshot of the drivers license app, to get into clubs or buy alcohol. I think they "fixed" it. I think it has some effect now that only works if you tilt the phone.

You're competing with that for "I want to make sure the person standing in front of me is of legal drinking age" use-case, but for the remote KYC/age-verification usecases, you're competing with a photo of the document and/or a selfie.

Maybe bundling these under the same system is a mistake and they should be separate systems with different considerations; it would certainly help with arguments about it online ;P

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#58

Post by snackbroken »

actionfromafar wrote: post #38
snackbroken wrote: post #19

Earlier quoted context omitted.

> The point of this is that you can use the credentials on your phone to prove that you are an adult to a website using zero-knowledge proofs to avoid disclosing your identity to anybody. It is my understanding that this is not possible. I would be happy to be shown to be wrong, but to me it seems like you can either prevent people from lending out their credentials, or you can preserve the anonymity of the user, but…

Can attestations be rate-limited or is that the timing side-channel you are talking about?

Precisely. To rate-limit attestations you either need government somewhere in the loop so that they get notified and can revoke certificates when they detect abuse (but then they can correlate requests to prove adulthood with the service provider), or you need the proof of adulthood to be tied to the certificate in some way that the service provider can tell if a certificate is being re-used. But then anyone with a copy of all the certificates (read: the government) can re-run the proof on their end and figure out who is who.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#59

Post by subscribed »

lyu07282 wrote: post #54
JimDabell wrote: post #3

Note that this is an implementation of eIDAS: https://www.eudi-wallet.eu/ The point of this is that you can use the credentials on your phone to prove that you are an adult to a website using zero-knowledge proofs to avoid disclosing your identity to anybody. If somebody who has access to your unlocked phone can access the data in the app, then this is something that should be tightened up but it’s a substantial priv…

The alternative would be to just not do anything and to remove liability from Meta et al. In the world we live in, where competing interests already spent tens of billions to bribe/lobby the EU, we have to be realistic about it. This open source and transparent ZKP-based approach is extremely surprising to see, publishing a draft in advance and inviting the public to break it so it can be improved? Are you kidding me…

The main issue appears to be that as per the blueprint user MUST use one of the mandated handsets (iPhone or Android with pre-installed and privileged Google Services) and:

- MUST use either Google or Apple account - must not be banned by the provider or sanctioned in the USA

These issues have been flagged to the devs working on the blueprint since the inception, only to be handwaved away.

Getting banned can happen randomly even if you're not doing anything illegal or wrong (it's enough for a robot to decide you're within the blast radius), getting sanctioned can happen if you're an UN lawyer investigating human rights abuses USA actually likes.

So I do see a problem here.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#60

Post by subscribed »

JimDabell wrote: post #36
sam_lowry_ wrote: post #5

Earlier quoted context omitted.

You are mixing things up, and EU abbreviations do not help. Many countries in EU already have electronic identity documents and delegate authentication to mobile apps one way or another. eID or mobile identity application operating over QR codes and used to log into websites and apps is a commodity here. This has nothing to do with age verification.

I’m not sure what you are saying I am mixing up. The article links to the source code repository here: https://github.com/eu-digital-identity-wallet/av-app-android... That links to the tech spec: > The solution leverages the existing eIDAS infrastructure, including eIDAS nodes and the trust framework for trusted services, to ensure a high level of security and reliability. By aligning with the technical architecture…

You're both right.

Without exposing my citizenship, I was able to use by EU-nation issued ID to confirm only my year of birth.

The website supported this country's national ID login method, in the login challenge asked the server to provide my age, before I signed in to confirm (scanning qr code with my mobile app) I was informed what data was requested, then I consented to them confirming my data.

Not very sensitive things work without my physical ID present, sensitive have additional step with me providing my physical ID (to the NFC reader) and unlocking my key (stored on the ID) with a pin.

All in all it's really very sensible and fast.

Not necessarily the EU ID apps we're talking about but some of the existing implementations.

Post reply on HN