They didn't launch an app per se - they've released the source code of such app. So, let's be more precise on the terminology, please!
Brussels launched an age checking app. Hackers took 2 minutes to break it
71–80 of 221 posts
Re: Brussels launched an age checking app. Hackers took 2 minutes to break it
#72Note that this is an implementation of eIDAS: https://www.eudi-wallet.eu/ The point of this is that you can use the credentials on your phone to prove that you are an adult to a website using zero-knowledge proofs to avoid disclosing your identity to anybody. If somebody who has access to your unlocked phone can access the data in the app, then this is something that should be tightened up but it’s a substantial priv…
Or just let us set our age in the OS profile? Works for adults and kids.
Re: Brussels launched an age checking app. Hackers took 2 minutes to break it
#731. Devs forgot to delete images in some failed scenarios. Images that do not get sent anywhere and remain locally. In an open source app that anyone can point calmly to the bug and it will get fixed easily.
2. "an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file"... Any android developer knows that to access the shared prefs file you need ROOT access on the phone, which is impossible on the stock os. Rooting the phone requires advanced knowledge. It means deliberately nuking your phone security, which most likely will require factory resetting the phone in the process. Or a hacker would need to use a sophisticated exploit, maybe even 0day, to access an app that would allow him to log in on some adult sites. Sounds reasonable (no).
So, the guy found two very superficial problems in a early demo app. Does not even look at the important code with the actual implementation of the zero knowledge proof cryptography, as it is way above his skill level. Throws malicious allegations mixed with blatant lies. Cries for attention to the whole internet and it gets augmented by news and people who understand security and technology even less than him. He dares calling it "hacking" in under 2 minutes. That's just disgusting.
He even calls himself "Security Consultant". Lord have mercy on whoever is going to work with him.
Re: Brussels launched an age checking app. Hackers took 2 minutes to break it
#74The “hack” in question is pointing out that the app forgets to delete images of the user's face and ID (stored). A lot of people have pictures of their face already on the phone, and often their ID as well so this is hardly a security flaw in any real sense.
Re: Brussels launched an age checking app. Hackers took 2 minutes to break it
#75The title seems totally misleading.
The app still hasn’t launched. There’s only so long you can run on hype before you lose the readers you were trying to win over.
Re: Brussels launched an age checking app. Hackers took 2 minutes to break it
#76[flagged]
Re: Brussels launched an age checking app. Hackers took 2 minutes to break it
#77Earlier quoted context omitted.
Because people share phones with their kids. It's not rare or even mildly unusual. The problem isn't that the app needs to solve this. The problem is the app is useless, along with this whole bizarre "need for age verification" plot that poofed out of existence simultaneously around the whole globe mysteriously a few months ago.
Well, reality called and says: Like ID, drivers license, credit cards and guns: Phones are sth. you dont just "share" with your kids. Also there is an option to guard the ID App with an additional PIN/Biometric.
In theory, maybe yes. But in practice people do share their phones with their kids.
Re: Brussels launched an age checking app. Hackers took 2 minutes to break it
#78Note that this is an implementation of eIDAS: https://www.eudi-wallet.eu/ The point of this is that you can use the credentials on your phone to prove that you are an adult to a website using zero-knowledge proofs to avoid disclosing your identity to anybody. If somebody who has access to your unlocked phone can access the data in the app, then this is something that should be tightened up but it’s a substantial priv…
The alternative would be to just not do anything and to remove liability from Meta et al. In the world we live in, where competing interests already spent tens of billions to bribe/lobby the EU, we have to be realistic about it. This open source and transparent ZKP-based approach is extremely surprising to see, publishing a draft in advance and inviting the public to break it so it can be improved? Are you kidding me…
> The alternative would be to just not do anything and to remove liability from Meta et al.
Or just give parents easy to use parental controls. But that wouldn't grow the surveillance state.
Re: Brussels launched an age checking app. Hackers took 2 minutes to break it
#79Re: Brussels launched an age checking app. Hackers took 2 minutes to break it
#80Earlier quoted context omitted.
Hence the second paragraph in my comment. The app is client side and reads the physical ID.
Hmm how is it zero knowledge when you can be tracked to a single installation of an app? I thought zero knowledge means they ask a "trusted" 3rd party, i.e. the government. And that says yes/no, without passing any ID details on.
Zero knowledge as in the state provides a certificate without directly interacting with the third party website, and the third party does not get personal information beyond "this access is by a certified adult", with no explicit or implicit information about which adult.