
denial.of.service
17.9K posts

denial.of.service
@densityofstate
philanthropist






The @EU_Commission has released an update to patch out the issues I raised last week, v2026.04-2 (#release-notes_1" target="_blank" rel="nofollow noopener">ageverification.dev/releases/#rele…
) Honestly, I don't know if I should laugh or cry. Let's review each one: 1. On-device data: database and settings encrypted at rest, with keys protected by the device’s hardware-backed key store. Sounds great, until you look closer. They introduced androidx.security:security-crypto, deprecated in 2025. Also androidx.security.crypto.EncryptedSharedPreferences, deprecated in 2025. Finally, androidx.security.crypto.MasterKeys, which were deprecated in 2020. 3 deprecated dependencies introduced following criticism over weak security. These weren't left over and missed during an update... they've added them now to "harden security". Remember, this isn't an isolated app. It's intended to lay the foundation for many production applications; all using deprecated security libraries from the outset. Worse, they already correctly use KeystoreController in their codebase. The correct answer already existed and they still got it wrong. 2. Runtime: the app checks device integrity on startup and refuses to run on rooted or jailbroken devices. Production deployments should complement it with stronger device-attestation mechanisms appropriate to their infrastructure and compliance requirements. They check for su, check package manager for root apps, run "which su" and checks if it's a custom ROM. Paths: /system/bin/su /system/xbin/su /sbin/su /system/su /data/local/su /data/local/bin/su /data/local/xbin/su /system/app/Superuser.apk /system/app/SuperSU.apk Great... in 2015. These are all trivially bypassed in 2026. 3. Passport onboarding: more stable scanning; the passport photo is stored privately and deleted as soon as it’s no longer needed. They're still not encrypted, so I'm not sure what "privately" means - but they are deleted correctly now. 4. PIN: stricter rules block easy-to-guess PINs; PINs are salted and hashed, never stored in plain form. They salt correctly (a true CSPRNG), then use PBKDF2-SHA256 - which is outdated and only recommended where FIPS compliance is required, which doesn't apply here. To make matters worse, they use just 210,000 iterations. For those of a NISTy disposition, you're likely already shaking your head. 210,000 seems oddly specific. It is. It's the @owasp minimum for PBKDF2-SHA512, not SHA256. Right number, wrong algorithm. In reality, OWASP recommended 600,000 iterations as a minimum in 2023. Worse still, 600,000 is the baseline minimum for passwords, not PINs with 1 million permutations. You could use 1B iterations, you're not measurably increasing security when there are so few attempts required to break it. At the very least, use a modern hash with reasonable brute-force resistance against a 2026 threat model. All this... cited as a "first hardening step". Again, utter security theatre. None of this negates my fundamental point. This isn't fixable through code - it's fundamentally ill-conceived and poorly implemented.
#SONDAKİKA BÜYÜK ÇÖKÜŞ BAŞLADI: DİJİTAL KİMLİK SİSTEMİ İMHA EDİLDİ! Fransa'da 19 MİLYON insanın tüm hayatı şu an karanlık ağda (Dark Web) açık artırmada! France Titres (ANTS) hacklendi; adınız, adresiniz, çocuklarınızın doğum yeri ve tüm özel bilgileriniz artık siber korsanların elinde birer silah! "Güvenli" dedikleri sistem, aslında sizin en büyük zayıf noktanızmış. Devletin koruyamadığı veriyi, hackerlar saniyeler içinde pazarlıyor. Tüm hayatınızı bir "çipe" sığdırdığınızda, o çipin anahtarı başkasının eline geçtiğinde siz kimsiniz? Şimdi Umarım Anladınız Digital Kimlik Nedeni?



🚨 BREAKING: Hungary violated EU law when it banned children from accessing LGBTQ+ content, the Court of Justice of the EU has ruled. Read the full story: politico.eu/article/eu-top…






@BorisJohnson ‼️MHRA HAVE EVIDENCE OF HARM‼️ Tribunal against MHRA forced them to release Yellow Card Vaccine Monitor they had sat on for 4 years. (36,604 participants; 2514 pregnant) Conclusion: 1 in 7 (13.7%) had a SERIOUS medical event.





The full text for HR 8250, the proposed Federal law which would require all Operating Systems to implement Age Verification, has just been made publicly available. It is short, poorly written, clearly not at all thought out, and almost entirely devoid of specifics. Some key points: - The bill does not specify how age verification would work at all. It states that the Federal Trade Commission would have 180 days to specify the exact mechanism and requirements for Age Verification within the Operating Systems. - The Federal Trade Commission would also specify data storage protection requirements as well as requirements for how the Operating System must provide access to collected user data. - This bill would apply to ALL Operating Systems. Everything from Windows to Linux to embedded systems. Yes, even to a smart refrigerator. The “Operating System” definition is incredibly broad. - The law will be considered in effect 1 year from the date it is enacted. - Violations of the law will be handled under the Federal Trade Commission Act. - It is given the “Short Title” of “Parents Decide Act”. congress.gov/bill/119th-con…








