I said it before and I'll it again, the best solution for this is to have a standard API where device admins can optionally set a age group, and that treats an unset value as signalling unrestricted access. This is so simple it's almost impossible to fuck up, parents get a parenting tool, most people can just ignore it, and big brother can go on a long vacation.
This is what the California law requires BTW (except it makes the field mandatory which is shit). IMO in this case the EU solution is overcomplicated, it just feels like they needed an excuse to get more out of the COVID certificate investments...
I‘m a little bit confused because all of this is moving so quickly (and badly) when the EU is known to work slow. How do they even have an app ready so quickly? Even when it‘s trash. It‘s almost as if they act on the ‚wisdom‘: „Apologizing later is easier than asking for permission first.“ I get the impression they started working on this before any legislation was even proposed.
Bbbbbbut the politicians with no technical experience, knowledge or skills said that it would work! Should we trust the politicians or the actual experts?.......... /s
I feel like I'm going insane, I thought the EU just recently passed an initiative to directly ban age verification, and then I open my feed yesterday and there is nothing else other than news about this app & I can't find the initiative I thought I saw.
Edit: I figured out what was confusing me, the MEP just recently enshrined E2EE, which I remembered as a big win on the same level of no age verification.
Edit: I figured out what was confusing me, the MEP just recently enshrined E2EE, which I remembered as a big win on the same level of no age verification.
oh that sounds interesting! could you throw a link?
I think they didn't enshrine the right to end to end encryption, it's just that they did not renew the temporary law allowing voluntary scanning for tech companies
I am not capable of understanding it myself, I heard the German version is less ambiguous, the English version had too many clauses that were up for interpretation. The general consensus in the threads that I saw on Lemmy when this happened was that the good faith interpretation is the correct one, but I am unsure if that is just cope.
Maybe the security expert could read the readmes in the repos first. From the iOS app repo:
The initial development release has reduced security, privacy, availability, and reliability standards relative to future releases. This could make the software slower, less reliable, or more vulnerable to attacks than mature software.
And further:
If you're planning to use this application in production, we recommend reviewing the following steps: […] The Pin storage configuration matches your security requirements, or provide your own by following this guide Pin Storage Configuration […]
So the text hints not at design flaws but at facts that are already stated in the readme. Plus, the major source for the article is Pavel Durov, who’s messenger is of course a standard in security and privacy.
So there seems to be no news but a lot of speculation by Durov instead.
I really hope the manage to do this properly. I'm all for verification on the internet, but only if it is fast, secure and reasonably private. You can do it, but noboy has so far
I can say that it works fine for me, although I'm not up to speed regarding its security. I like that it explicitly tells me what kind of data is requested and by whom. The problem here is mainly low adoption. If they rolled the exact thing out EU wide, it would probably gain more traction. It's a joke they have no official Linux support despite having an Android app tho
Why do they source-link a random Twitter post but not the security researcher report nor the app the whole article is about? Every link is to their own articles.
That “ready” is just typical political advertising speech. Could have been worded more carefully, but it’s forgivable. As long as the git repo and website correctly identify it as a demo/prototype, it seems fine to me. E.g. not using the security enclave is totally fine for a demo. It doesn’t affect the general protocol design. There’s a lot of hostility both to these initiatives as well as to the EU (often by different actors, there’s e.g other countries pushing for less privacy respecting mechanisms), so the clever criticism tends towards nitpicking. There’s actually merit in releasing such an ambitious project as open source and so early, which even with the nitpicking and negativity, is a good thing.
So your argument is that since you are opposed to the app's very existence it's immoral to test it for security flaws.
I'd like to argue against that with the principle of defense in depth. I'm also not a friend of OS-level age verification and would like it to be dropped. But if it is implemented I want it to be implemented in a way that isn't wildly insecure. I can simultaneously argue against the principle as a whole and insist that any implementation of it be secure. If it does come I at least want the damage from a botched implementation to be mitigated.
To use your cage analogy, I can both complain about the principle of caging people and about the fact that the cage is badly made and poses an injury risk to the people inside it. Neither is acceptable.
you are missing the point: this measure is a steaming pile of dogshit. but it'll be forced on us anyway - the least we can do is make sure it's at least secure because even a hardliner can't defend this security issue
31 Comments
ViatorOmnium@piefed.social · 124 pts · 121d
I said it before and I'll it again, the best solution for this is to have a standard API where device admins can optionally set a age group, and that treats an unset value as signalling unrestricted access. This is so simple it's almost impossible to fuck up, parents get a parenting tool, most people can just ignore it, and big brother can go on a long vacation.
balsoft@lemmy.ml · 21 pts · 121d
This is what the California law requires BTW (except it makes the field mandatory which is shit). IMO in this case the EU solution is overcomplicated, it just feels like they needed an excuse to get more out of the COVID certificate investments...
ViatorOmnium@piefed.social · 2 pts · 121d
balsoft@lemmy.ml · 4 pts · 121d
Yes, exactly, I mention it in my comment. It almost did the right thing and blundered in one detail.
cley_faye@lemmy.world · 10 pts · 120d
That would be a good way to do it, if the goal was to be able to restrict/protect kids. Unfortunately, this have very little to do with that.
CosmoNova@lemmy.world · 44 pts · 121d
I‘m a little bit confused because all of this is moving so quickly (and badly) when the EU is known to work slow. How do they even have an app ready so quickly? Even when it‘s trash. It‘s almost as if they act on the ‚wisdom‘: „Apologizing later is easier than asking for permission first.“ I get the impression they started working on this before any legislation was even proposed.
Anafabula@discuss.tchncs.de · 31 pts · 121d
The specification has been worked on for at least a year going by the git repo. The (android) app is a fork of the EUID Wallet app I think which is at least three years old
Kissaki@feddit.org · 2 pts · 120d
The EUID effort is based on and for consolidating existing national solutions as well. They didn't start from scratch.
throws_lemy@lemmy.nz · 13 pts · 121d
uhm, vibe coding?
HeyThisIsntTheYMCA@lemmy.world · 1 pts · 121d
they were already working on it?
MrSulu@lemmy.ml · 34 pts · 121d
Bbbbbbut the politicians with no technical experience, knowledge or skills said that it would work! Should we trust the politicians or the actual experts?.......... /s
HeyThisIsntTheYMCA@lemmy.world · 1 pts · 121d
scotus (yeah i know) said chevron bad, so let's trust the politicians!
Attacker94@lemmy.world · 31 pts · 121d
I feel like I'm going insane, I thought the EU just recently passed an initiative to directly ban age verification, and then I open my feed yesterday and there is nothing else other than news about this app & I can't find the initiative I thought I saw.
Edit: I figured out what was confusing me, the MEP just recently enshrined E2EE, which I remembered as a big win on the same level of no age verification.
WhyJiffie@sh.itjust.works · 1 pts · 120d
oh that sounds interesting! could you throw a link?
Attacker94@lemmy.world · 1 pts · 120d
here you go
WhyJiffie@sh.itjust.works · 1 pts · 119d
I think they didn't enshrine the right to end to end encryption, it's just that they did not renew the temporary law allowing voluntary scanning for tech companies
Attacker94@lemmy.world · 1 pts · 119d
I am not capable of understanding it myself, I heard the German version is less ambiguous, the English version had too many clauses that were up for interpretation. The general consensus in the threads that I saw on Lemmy when this happened was that the good faith interpretation is the correct one, but I am unsure if that is just cope.
gsv@programming.dev · 19 pts · 121d
Maybe the security expert could read the readmes in the repos first. From the iOS app repo:
And further:
So the text hints not at design flaws but at facts that are already stated in the readme. Plus, the major source for the article is Pavel Durov, who’s messenger is of course a standard in security and privacy.
So there seems to be no news but a lot of speculation by Durov instead.
gsv@programming.dev · 7 pts · 121d
Link to app repos, both contain the disclaimers: https://github.com/eu-digital-identity-wallet/eudi-app-ios-wallet-ui https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui
ChairmanMeow@programming.dev · 5 pts · 120d
Yeah the weird thing is that Von der Leyen claimed it's basically done and perfect. But it's nothing of the sort.
UnfortunateShort@lemmy.world · -8 pts · 121d
I really hope the manage to do this properly. I'm all for verification on the internet, but only if it is fast, secure and reasonably private. You can do it, but noboy has so far
Kissaki@feddit.org · 1 pts · 120d
What's your assessment of the German eID and AusweisApp2 that has been in use for many years?
UnfortunateShort@lemmy.world · 2 pts · 120d
I can say that it works fine for me, although I'm not up to speed regarding its security. I like that it explicitly tells me what kind of data is requested and by whom. The problem here is mainly low adoption. If they rolled the exact thing out EU wide, it would probably gain more traction. It's a joke they have no official Linux support despite having an Android app tho
Kissaki@feddit.org · 16 pts · 120d
Why do they source-link a random Twitter post but not the security researcher report nor the app the whole article is about? Every link is to their own articles.
linule@lemmy.world · 9 pts · 121d
What’s the official stage of it? was it already intended to be released? If not it might be less of an issue.
Anyway it’s good that it’s open source. At the very least it encourages public discussion and in this case noticing the flaws.
Anafabula@discuss.tchncs.de · 24 pts · 121d
The git repo calls it a demo. The website calls it a prototype. The EU Commission calls it "ready".
But they also said it "Works on any device" and "Highest privacy standards in the world" so I guess we can't trust what EU Commission says.
linule@lemmy.world · 13 pts · 121d
That “ready” is just typical political advertising speech. Could have been worded more carefully, but it’s forgivable. As long as the git repo and website correctly identify it as a demo/prototype, it seems fine to me. E.g. not using the security enclave is totally fine for a demo. It doesn’t affect the general protocol design. There’s a lot of hostility both to these initiatives as well as to the EU (often by different actors, there’s e.g other countries pushing for less privacy respecting mechanisms), so the clever criticism tends towards nitpicking. There’s actually merit in releasing such an ambitious project as open source and so early, which even with the nitpicking and negativity, is a good thing.
kokesh@lemmy.world · 6 pts · 121d
Another thing that will be blocked on my DNS
username_1@programming.dev · -15 pts · 121d
Twongo@lemmy.ml · 17 pts · 121d
lol are you implying security experts should not probe this and we just let it happen?
username_1@programming.dev · -3 pts · 121d
Twongo@lemmy.ml · 7 pts · 121d
that is a very pessimistic outlook.
there covid app for example was also something that could be misused in terrible ways and they managed to even get it approved by the ccc.
defeatism just makes things worse.
username_1@programming.dev · 0 pts · 121d
Jesus_666@lemmy.world · 11 pts · 121d
So your argument is that since you are opposed to the app's very existence it's immoral to test it for security flaws.
I'd like to argue against that with the principle of defense in depth. I'm also not a friend of OS-level age verification and would like it to be dropped. But if it is implemented I want it to be implemented in a way that isn't wildly insecure. I can simultaneously argue against the principle as a whole and insist that any implementation of it be secure. If it does come I at least want the damage from a botched implementation to be mitigated.
To use your cage analogy, I can both complain about the principle of caging people and about the fact that the cage is badly made and poses an injury risk to the people inside it. Neither is acceptable.
Twongo@lemmy.ml · 4 pts · 121d
you are missing the point: this measure is a steaming pile of dogshit. but it'll be forced on us anyway - the least we can do is make sure it's at least secure because even a hardliner can't defend this security issue