EU age verification app can be hacked in 2 minutes, claims security expert

https://cybernews.com/security/eu-age-verification-app-hack/

425 points · 31 comments · view on lemmy.world

31 Comments

ViatorOmnium@piefed.social · 124 pts · 121d (4 replies)

I said it before and I'll it again, the best solution for this is to have a standard API where device admins can optionally set a age group, and that treats an unset value as signalling unrestricted access. This is so simple it's almost impossible to fuck up, parents get a parenting tool, most people can just ignore it, and big brother can go on a long vacation.

balsoft@lemmy.ml · 21 pts · 121d (2 replies)

This is what the California law requires BTW (except it makes the field mandatory which is shit). IMO in this case the EU solution is overcomplicated, it just feels like they needed an excuse to get more out of the COVID certificate investments...

ViatorOmnium@piefed.social · 2 pts · 121d (1 reply)
[ removed ]
balsoft@lemmy.ml · 4 pts · 121d

Yes, exactly, I mention it in my comment. It almost did the right thing and blundered in one detail.

cley_faye@lemmy.world · 10 pts · 120d

That would be a good way to do it, if the goal was to be able to restrict/protect kids. Unfortunately, this have very little to do with that.

CosmoNova@lemmy.world · 44 pts · 121d (4 replies)

I‘m a little bit confused because all of this is moving so quickly (and badly) when the EU is known to work slow. How do they even have an app ready so quickly? Even when it‘s trash. It‘s almost as if they act on the ‚wisdom‘: „Apologizing later is easier than asking for permission first.“ I get the impression they started working on this before any legislation was even proposed.

Anafabula@discuss.tchncs.de · 31 pts · 121d (1 reply)

The specification has been worked on for at least a year going by the git repo. The (android) app is a fork of the EUID Wallet app I think which is at least three years old

Kissaki@feddit.org · 2 pts · 120d

The EUID effort is based on and for consolidating existing national solutions as well. They didn't start from scratch.

throws_lemy@lemmy.nz · 13 pts · 121d

uhm, vibe coding?

HeyThisIsntTheYMCA@lemmy.world · 1 pts · 121d

they were already working on it?

MrSulu@lemmy.ml · 34 pts · 121d (1 reply)

Bbbbbbut the politicians with no technical experience, knowledge or skills said that it would work! Should we trust the politicians or the actual experts?.......... /s

HeyThisIsntTheYMCA@lemmy.world · 1 pts · 121d

scotus (yeah i know) said chevron bad, so let's trust the politicians!

Attacker94@lemmy.world · 31 pts · 121d (4 replies)

I feel like I'm going insane, I thought the EU just recently passed an initiative to directly ban age verification, and then I open my feed yesterday and there is nothing else other than news about this app & I can't find the initiative I thought I saw.

Edit: I figured out what was confusing me, the MEP just recently enshrined E2EE, which I remembered as a big win on the same level of no age verification.

WhyJiffie@sh.itjust.works · 1 pts · 120d (3 replies)

Edit: I figured out what was confusing me, the MEP just recently enshrined E2EE, which I remembered as a big win on the same level of no age verification.

oh that sounds interesting! could you throw a link?

Attacker94@lemmy.world · 1 pts · 120d (2 replies)
WhyJiffie@sh.itjust.works · 1 pts · 119d (1 reply)

I think they didn't enshrine the right to end to end encryption, it's just that they did not renew the temporary law allowing voluntary scanning for tech companies

Attacker94@lemmy.world · 1 pts · 119d

I am not capable of understanding it myself, I heard the German version is less ambiguous, the English version had too many clauses that were up for interpretation. The general consensus in the threads that I saw on Lemmy when this happened was that the good faith interpretation is the correct one, but I am unsure if that is just cope.

gsv@programming.dev · 19 pts · 121d (5 replies)

Maybe the security expert could read the readmes in the repos first. From the iOS app repo:

The initial development release has reduced security, privacy, availability, and reliability standards relative to future releases. This could make the software slower, less reliable, or more vulnerable to attacks than mature software.

And further:

If you're planning to use this application in production, we recommend reviewing the following steps: […] The Pin storage configuration matches your security requirements, or provide your own by following this guide Pin Storage Configuration […]

So the text hints not at design flaws but at facts that are already stated in the readme. Plus, the major source for the article is Pavel Durov, who’s messenger is of course a standard in security and privacy.

So there seems to be no news but a lot of speculation by Durov instead.

gsv@programming.dev · 7 pts · 121d
ChairmanMeow@programming.dev · 5 pts · 120d

Yeah the weird thing is that Von der Leyen claimed it's basically done and perfect. But it's nothing of the sort.

UnfortunateShort@lemmy.world · -8 pts · 121d (2 replies)

I really hope the manage to do this properly. I'm all for verification on the internet, but only if it is fast, secure and reasonably private. You can do it, but noboy has so far

Kissaki@feddit.org · 1 pts · 120d (1 reply)

You can do it, but noboy has so far

What's your assessment of the German eID and AusweisApp2 that has been in use for many years?

UnfortunateShort@lemmy.world · 2 pts · 120d

I can say that it works fine for me, although I'm not up to speed regarding its security. I like that it explicitly tells me what kind of data is requested and by whom. The problem here is mainly low adoption. If they rolled the exact thing out EU wide, it would probably gain more traction. It's a joke they have no official Linux support despite having an Android app tho

Kissaki@feddit.org · 16 pts · 120d

Why do they source-link a random Twitter post but not the security researcher report nor the app the whole article is about? Every link is to their own articles.

linule@lemmy.world · 9 pts · 121d (2 replies)

What’s the official stage of it? was it already intended to be released? If not it might be less of an issue.

Anyway it’s good that it’s open source. At the very least it encourages public discussion and in this case noticing the flaws.

Anafabula@discuss.tchncs.de · 24 pts · 121d (1 reply)

The git repo calls it a demo. The website calls it a prototype. The EU Commission calls it "ready".

But they also said it "Works on any device" and "Highest privacy standards in the world" so I guess we can't trust what EU Commission says.

linule@lemmy.world · 13 pts · 121d

That “ready” is just typical political advertising speech. Could have been worded more carefully, but it’s forgivable. As long as the git repo and website correctly identify it as a demo/prototype, it seems fine to me. E.g. not using the security enclave is totally fine for a demo. It doesn’t affect the general protocol design. There’s a lot of hostility both to these initiatives as well as to the EU (often by different actors, there’s e.g other countries pushing for less privacy respecting mechanisms), so the clever criticism tends towards nitpicking. There’s actually merit in releasing such an ambitious project as open source and so early, which even with the nitpicking and negativity, is a good thing.

kokesh@lemmy.world · 6 pts · 121d

Another thing that will be blocked on my DNS

username_1@programming.dev · -15 pts · 121d (6 replies)
[ removed ]
Twongo@lemmy.ml · 17 pts · 121d (5 replies)

lol are you implying security experts should not probe this and we just let it happen?

username_1@programming.dev · -3 pts · 121d (4 replies)
[ removed ]
Twongo@lemmy.ml · 7 pts · 121d (3 replies)

that is a very pessimistic outlook.

there covid app for example was also something that could be misused in terrible ways and they managed to even get it approved by the ccc.

defeatism just makes things worse.

username_1@programming.dev · 0 pts · 121d (2 replies)
[ removed ]
Jesus_666@lemmy.world · 11 pts · 121d

So your argument is that since you are opposed to the app's very existence it's immoral to test it for security flaws.

I'd like to argue against that with the principle of defense in depth. I'm also not a friend of OS-level age verification and would like it to be dropped. But if it is implemented I want it to be implemented in a way that isn't wildly insecure. I can simultaneously argue against the principle as a whole and insist that any implementation of it be secure. If it does come I at least want the damage from a botched implementation to be mitigated.

To use your cage analogy, I can both complain about the principle of caging people and about the fact that the cage is badly made and poses an injury risk to the people inside it. Neither is acceptable.

Twongo@lemmy.ml · 4 pts · 121d

you are missing the point: this measure is a steaming pile of dogshit. but it'll be forced on us anyway - the least we can do is make sure it's at least secure because even a hardliner can't defend this security issue