Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brussels launched an age checking app. Hackers took 2 minutes to break it

politico.eu

Post reply on HN
Print view View original

61–70 of 221 posts

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#61

Post by subscribed »

kdheiwns wrote: post #8
soco wrote: post #4

"Let’s say I downloaded the app, proved that I am over 18, then my nephew can take my phone, unlock my app and use it to prove he is over 18." - and how is that something that could, or should, be addressed by the app? Are we even serious??

Because people share phones with their kids. It's not rare or even mildly unusual. The problem isn't that the app needs to solve this. The problem is the app is useless, along with this whole bizarre "need for age verification" plot that poofed out of existence simultaneously around the whole globe mysteriously a few months ago.

My kid can take my phone and not be able to transfer any money form my bank account, because it's protected by pin and biometrics.

That's a solved problem and making an immense vulnerability out of it is silly.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#62

Post by subscribed »

mrweasel wrote: post #26
Mashimo wrote: post #20

Earlier quoted context omitted.

How does the nephew unlock the phone and app?

If it's just a PIN, and the PIN is his aunts birthday, it might not be much of a challenge. We also have to consider the cases where the adult is complicit, in these cases the app is even less secure than photo ID (for store purchases, not necessarily online).

If adult is "complicit" they can purchase the stuff for the kid anyway.

Why is that even a scenario to discuss?

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#63

Post by Mindwipe »

JimDabell wrote: post #42
Mindwipe wrote: post #34

Earlier quoted context omitted.

> The point of this is that you can use the credentials on your phone to prove that you are an adult to a website using zero-knowledge proofs to avoid disclosing your identity to anybody. No it isn't. Literally that is not the scope document, and such a solution would not be permitted by the EU as compliant with the legislation. The app isn't zero knowledge. A prototype workflow has been designed for a one way transf…

Zero knowledge proofs are when the prover can prove the statement is true to the verifier without disclosing more information beyond the statement. It doesn’t mean the prover cannot talk to other systems to produce the statement.

That only works in the context of when the sender isn't the adversary, which isn't the case in an age verification system - it very much does treat the sender as the enemy and untrusted. And again, the revocation chain on the backend is not zero proof.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#66

Post by snackbroken »

JimDabell wrote: post #39
snackbroken wrote: post #19

Earlier quoted context omitted.

> The point of this is that you can use the credentials on your phone to prove that you are an adult to a website using zero-knowledge proofs to avoid disclosing your identity to anybody. It is my understanding that this is not possible. I would be happy to be shown to be wrong, but to me it seems like you can either prevent people from lending out their credentials, or you can preserve the anonymity of the user, but…

> It is my understanding that this is not possible. I would be happy to be shown to be wrong, but to me it seems like you can either prevent people from lending out their credentials, or you can preserve the anonymity of the user, but not both. This is not designed to prevent adults from coöperating with minors; that makes no sense as a design goal because any technical measure can always be bypassed with “download t…

But laws against selling/giving alcohol to minors are moderately successful at curbing teen alcohol use because they carry with them a risk of punishment that grows with the scale of the operation. If all it took was one adult who thought "kids should be allowed to drink if they want" to provide all the kids in the country with free booze and that adult had no meaningful fear of repercussions, the laws would be nothing but sternly worded advice.

If the proof of adulthood scheme is truly anonymous, one adult with some technical chops who thinks "kids should be allowed to watch porn if they want" would be able to, say, run an adult-o-matic-9000 TOR hidden service that anyone can use to pinky promise that they are an adult without fear of repercussions. If such a service comes with a meaningful risk of being identified and punished, it is by definition not anonymous.

I suppose I'm just not convinced giving up some basic liberties for a law that converts into sternly worded advice if just one adult chooses to break it is a great idea.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#67

Post by dbvn »

soco wrote: post #4

"Let’s say I downloaded the app, proved that I am over 18, then my nephew can take my phone, unlock my app and use it to prove he is over 18." - and how is that something that could, or should, be addressed by the app? Are we even serious??

well of course because the whole reason you're making free men and women verify their identity with government-issued documents... was supposed to be to prevent that. If its not going to prevent such an easy work-around ITS NOT WORTH IT (not that it was in the first place)

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#68

Post by JoshTriplett »

JimDabell wrote: post #55
kdheiwns wrote: post #47

Earlier quoted context omitted.

Then just get rid of the age gating and verification entirely because it's useless.

Other parents have different opinions to you about the value of this.

The problem comes in when they feel their opinions should carry weight about other people's kids. There are very limited ways in which we should allow that, and to an oversimplified approximation, they boil down to "don't do kids harm that prevents them from becoming an intact person society treats as a human allowed to make their own decisions". And then the problem is that some people think some websites do such damage, and other people think some websites provide help to survive such damage.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#69

Post by [deleted] »

dbvn wrote: post #67
soco wrote: post #4

"Let’s say I downloaded the app, proved that I am over 18, then my nephew can take my phone, unlock my app and use it to prove he is over 18." - and how is that something that could, or should, be addressed by the app? Are we even serious??

well of course because the whole reason you're making free men and women verify their identity with government-issued documents... was supposed to be to prevent that. If its not going to prevent such an easy work-around ITS NOT WORTH IT (not that it was in the first place)

[deleted]
Post reply on HN