Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brussels launched an age checking app. Hackers took 2 minutes to break it

politico.eu

Post reply on HN
Print view View original

131–140 of 221 posts

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#131

Post by sofixa »

nottorp wrote: post #119
torben-friis wrote: post #80

Earlier quoted context omitted.

Zero knowledge as in the state provides a certificate without directly interacting with the third party website, and the third party does not get personal information beyond "this access is by a certified adult", with no explicit or implicit information about which adult.

Yep, that's a good idea, but it also means the app on your phone has to talk to the state. Probably through a web 7.0 RESTLESS api. And even though the 3rd party web site doesn't get your identity, the state's database does. It's the RESTLESS api being hacked I worry about.

No.

The app checks your physical ID you have, and provides a certificate that you give the third party you're proving yourself to. The app knows you requested proof, but not what for. The third party knows you're proven to be 18+, but knows nothing else.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#132

Post by bboozzoo »

finghin wrote: post #108
edarchis wrote: post #106

Please stop saying "Brussels" to mean the EU. It's a nasty trick to give the idea that it's some kind of external entity forcing your country to do something. It's not. It's an assembly. And it's insulting to people from Brussels. I don't want this any more than you do.

It’s very common throughout English. The Russian government is refered to as Moscow, US as Washington. It’s the same and doesn’t refer to residents. It’s known as synecdoche. In other words, sorry but it’s here to stay.

If there was a major event in Belgium, which city would the news outlets refer to in order to avoid ambiguity?

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#133

Post by philipallstar »

bboozzoo wrote: post #132
finghin wrote: post #108

Earlier quoted context omitted.

It’s very common throughout English. The Russian government is refered to as Moscow, US as Washington. It’s the same and doesn’t refer to residents. It’s known as synecdoche. In other words, sorry but it’s here to stay.

If there was a major event in Belgium, which city would the news outlets refer to in order to avoid ambiguity?

They might say "The city of Brussels".

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#134

Post by philipallstar »

like_any_other wrote: post #78
lyu07282 wrote: post #54

Earlier quoted context omitted.

The alternative would be to just not do anything and to remove liability from Meta et al. In the world we live in, where competing interests already spent tens of billions to bribe/lobby the EU, we have to be realistic about it. This open source and transparent ZKP-based approach is extremely surprising to see, publishing a draft in advance and inviting the public to break it so it can be improved? Are you kidding me…

> The alternative would be to just not do anything and to remove liability from Meta et al. Or just give parents easy to use parental controls. But that wouldn't grow the surveillance state.

Or just have parents look after their children.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#135

Post by philipallstar »

James_K wrote: post #74

The “hack” in question is pointing out that the app forgets to delete images of the user's face and ID (stored). A lot of people have pictures of their face already on the phone, and often their ID as well so this is hardly a security flaw in any real sense.

"Lots of people choose to keep their key under their mat, so our lock not stopping anyone is hardly a security flaw in any real sense".

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#136

Post by philipallstar »

mrweasel wrote: post #18
Sweepi wrote: post #12

Earlier quoted context omitted.

Well, reality called and says: Like ID, drivers license, credit cards and guns: Phones are sth. you dont just "share" with your kids. Also there is an option to guard the ID App with an additional PIN/Biometric.

That's not reality for many of us. I don't consider my phone a secure device by any means. It has nothing on it that I'd regard as something I'd need to guard against my family. I know a fair number of especially elderly people who want to disable PIN and bio-metrics from their phone, because they view it as a pain to deal with. PINs can also be guessed or someone might look you over the shoulder and steal it that wa…

> It has nothing on it that I'd regard as something I'd need to guard against my family.

It has the internet on it.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#137

Post by ptx »

crimsoneer wrote: post #110
senorqa wrote: post #101

Why does this app even exist? Why is everyone in this thread so okay with more surveillance? It’s ironic that people are arguing over technicalities instead of tackling the moral and societal impact of age verification.

As a society, we broadly agree shops should check ID before selling kids alcohol. It is not that crazy to extend that online.

The online version has been extended quite a bit beyond what we broadly agree. If we translated back to checking ID in shops, it might look more like this:

1) Obviously you can't be trusted to handle your own ID card, because you could lend it to someone else or manipulate it in some way, so there should be a trusted guard with you at all times to manage your ID card for you and hand it to the shopkeeper.

2) Obviously you can't be trusted not to try to influence or attack your guard, so you must be kept in handcuffs for your own safety.

3) Obviously you can't be trusted with acquiring unapproved tools or meeting unapproved people who might enable you to break out of your handcuffs, so the guard must only allow you to communicate with approved people and buy approved products.

Conveniently and profitably, this also puts the company supplying the guard in a position where they can sell access to their control over you (as a consumer and as a source of experimental data) to their trusted partners.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#138

Post by philipallstar »

saghm wrote: post #87
JimDabell wrote: post #55

Earlier quoted context omitted.

Other parents have different opinions to you about the value of this.

Okay, so those parents can just not give their kids their phones, and everyone else can continue living life as usual without needing a fancy new way of telling websites how old they are

Giving your kid a gateway to every bad thing on the internet is not life as usual. It's incredibly recent, and I don't have shares in SSRI manufacturers, so I don't like it.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#139

Post by 948382828528 »

edarchis wrote: post #106

Please stop saying "Brussels" to mean the EU. It's a nasty trick to give the idea that it's some kind of external entity forcing your country to do something. It's not. It's an assembly. And it's insulting to people from Brussels. I don't want this any more than you do.

> It's a nasty trick to give the idea that it's some kind of external entity forcing your country to do something

Which it is. How nasty to engage in wrongthink.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#140

Post by GoblinSlayer »

nottorp wrote: post #32
JimDabell wrote: post #3

Note that this is an implementation of eIDAS: https://www.eudi-wallet.eu/ The point of this is that you can use the credentials on your phone to prove that you are an adult to a website using zero-knowledge proofs to avoid disclosing your identity to anybody. If somebody who has access to your unlocked phone can access the data in the app, then this is something that should be tightened up but it’s a substantial priv…

> The point of this is that you can use the credentials on your phone to prove that you are an adult to a website using zero-knowledge proofs to avoid disclosing your identity to anybody. That's the theory. How is it in practice? In my opinion, it just means there is a single government database to hack to get copies of all IDs... By the way have the "security experts" checking this app evaluated that part? Or they'r…

Do you care about it when running a smartphone full of NSA backdoors, CIA backdoors, Google backdoors, Apple backdoors, Baidu backdoors, Chrome backdoors and official reCAPTCHA backdoors and google analytics backdoors?
Post reply on HN