This is absolutely insane, this supposedly is built to handle our identification and personal information of the whole EU.
Age Verification app hacked in under 2 min.
https://x.com/Paul_Reviews/status/2044723123287666921
https://x.com/Paul_Reviews/status/2044723123287666921
This is absolutely insane, this supposedly is built to handle our identification and personal information of the whole EU.
13 Comments
Warl0k3@lemmy.world · 54 pts · 119d
Oh my god what. Did they let Claude write this? I mean... fucking hell...
jlow@slrpnk.net · 31 pts · 119d
At least in Germany you don't need slop to write completely broken government software, we've been doing that for decades.
Ooops@feddit.org · 4 pts · 119d
And afterwards they tell some whiny tale how the people are to blame and cry about those backward Germans opposing digitalisation.
When in reality there is only broken bullshit and so it becomes second nature to avoid it (like for example of course officially objecting to your participation in the new digital medical file years before the roll out... so about a year and a few days before the data of the few who missed it gets leaked).
tempest@lemmy.ca · 1 pts · 119d
Honestly Claude would probably do a better job ....
azimir@lemmy.ml · 17 pts · 119d
The README.md file also has lovely emojis in it. Their documentation writer is either a 14 year old or generated with an LLM in places.
hendrik@palaver.p3x.de · 5 pts · 119d
Huh, where did you find emojis? I found one lightbulb emoji in the iOS README. And some in their bio. But that's basically it for the 7 READMEs of the various sub-projects?!
azimir@lemmy.ml · 1 pts · 118d
There's a couple on the root org readme:
https://github.com/eu-digital-identity-wallet
Is it affirmative of AI? It's not a good look for what should be one of the utmost professional software projects I the EU.
hendrik@palaver.p3x.de · 3 pts · 118d
Ah, I get it. Yes. That section is weird. And it's unalike the bureaucrat English around it. And I'd say the call to action: "Embark on a journey [...]" is pretty much like ChatGPT sounded 2 years ago. I'm fairly certain the other text comes from humans with some expertise in writing legalese or specifications, and this will be a ChatGPT snippet.
The committer also has this weird habit of naming their commits "Update Readme.md". So I'm also fairly sure they're not your average open-source developer using Git how it's intended.
Most other markdown files in that specific directory smell of ChatGPT as well.
hendrik@palaver.p3x.de · 11 pts · 119d
My first thought was, has someone considered filing a bug report? But boy are the issues and PRs bad. Someone linked the Xitter post, though.
https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui
Dunno what kind of state the project is in. Seems development is very active. Maybe it's more an early tech demo? But they should probably be more upfront, if it is... And not have Ursula announce this is an App?!
And does the EU Wallet App (which it is forked from) contain the same basic design flaws?
Fishnoodle@lemmy.world · 4 pts · 119d
I mean, unless there's an advertised and honored bug bounty I wouldn't report it. If you want me to fix your shit software you're going to pay me for it, and pay me well
hendrik@palaver.p3x.de · 2 pts · 118d
Well, in theory it's your software anyway... In case you're an EU citizen.
4am@lemmy.zip · 2 pts · 119d
Not really following this one:
Isn’t the PIN supposed to be a secret? Why would it be bad to encrypt it?
tempest@lemmy.ca · 19 pts · 119d
There is no point to this.
It's a pin, why would you store it at all? Why would you put a password on your password and store it?
edit: Just got those who don't do software development it's considered generally bad practice to store the plain text of a password (encrypted or not).
The correct approach is to run the password through a one way hash algorithm and store the result. The hash algorithm always produces the same result for any given password but it is very difficult to do the reverse and figure out what password was used to generate what result.
So you store the result on your side and when the user submits a password you run it through the same one way hash algo and compare the result with the one you have on file. If they match the password is correct.
Any developer who has ever made baby's first Login should know this stuff it's very basic web development.