Mick Fox
6.1K posts

Mick Fox
@mickfox
Dublin Techie, stable genius, increasingly GC, proud Paddystinian




Let's shift focus and explain why the #EU #AgeVerification concept is fundamentally flawed. Assume: 1. The production app is released. 2. It's 100% secure, 100% private (fantasy land, but stick with me) 3. It cryptographically challenges every step, including hardware attestation which requires a physical device. 4. Every single other attack vector in the surrounding environment is somehow magically patched. aka - it's working exactly as intended/designed. It does not protect against a relay attack. This is a threat they considered and somewhat addressed here: github.com/eu-digital-ide… With the current design, there's nothing preventing someone running a verification-as-a-service; a remote Android device which returns a valid attestation. Remember, it's not returning "I am over 18", it returns "someone is over 18". Neither the verifier, nor the app has any way to link the session ID to a physical device. Their own docs state this clearly: Remote Cross-Device Presentation: "Note that the Wallet Instance does not see any difference between the cross-device flow and the same-device flow. In both cases, it receives an OpenID4VP-compliant presentation request over the Wallet Instance-platform API described in the previous section." This is a known & well-understood attack vector in all remote credential presentation models; it's just not mitigated in this one... primarily because they can't. CTAP 2.2 won't work with all app flows, hardware attestation doesn't mitigate relay attacks, on-demand liveness detection would be too intrusive & potentially privacy-invasive & timing calculations don't reveal anything useful... all the available options to resolve this break the core design; completely anonymous age verification. The Architecture & Reference Framework (ARF) is technically sound in some respects. They considered external threat actors and discussed solutions to mitigate them, including ZKP. However, the EC applied the wrong threat model, thus arriving at the wrong conclusion. Yes, you need to protect against malicious verifiers, phishing sites, session hijacks, data brokers et al... but that's addressing external threats, it doesn't protect the architecture from the user itself. In virtually every other scenario, the user and system's interests are aligned; protect my biometric asset at all costs. Specifically for age verification, most users do not want to present ID simply to access a website, so whilst the system may adequately protect from external threats, if the user wants to bypass the system, they can... and the architecture doesn't consider this. Every single applied mitigation assumes the user is the protected party, not the threat actor. To those people claiming "it requires physical access to the device and root, this is BS/hyperbole", you too applied the wrong threat model & completely missed the point. These disclosures demonstrate that you, the user, are the threat actor they haven't considered. You have your device. You can root your device. You can create a chrome extension, just as I did. Ironically, it's precisely those under 18 who can't pass verification who are motivated to bypass it. So where does that leave us? A system which replaces "I am over 18" with "someone is over 18", with absolutely no guarantee that it's true... which is the entire purpose of the app.

Brussels launched an age checking app. Hackers say it took them 2 minutes to break it. dlvr.it/TS4zLX



The “age verification app” the EU wants to impose on the world got hacked in 2 minutes. Step 1: Present a “privacy-respecting” but hackable solution. Step 2: Get hacked (you are here). Step 3: Remove privacy to "fix" it. Result: a surveillance tool sold as “privacy-respecting”.


SÅ ER DEN HER‼️ EU's nye Digitale Alders-Verifikations App for adgang til internettet og sociale medier, som ingen af os har stemt for eller imod, og som ingen af os heller er blevet informeret om skulle indføres! Ursula von der Leyen har tidligere i morges erklæret Appen for tilgængelig for alle EU medlemslande at få implementeret - alt for at "beskytte børn" imod online mobning! Det bliver her beskrevet, hvor let og simpelt det hele er - oversat: "Du downloader appen og konfigurerer den med dit pas eller ID-kort. Du beviser derefter din alder, når du tilgår onlinetjenester." Og yderligere "kan onlineplatforme nemt stole på vores aldersbekræftelsesapp. Så der er ikke flere undskyldninger." Ursula von der Leyen sammenligner selv dette digitale pas "med sundhedskortet med en QR-kode, der skal scannes under COVID"! I virkeligheden har det INTET at gøre med at beskytte børn og ALT at gøre med en pro-europæisk dagsorden, hvis eneste formål er at påtvinge det digitale pas og den europæiske digitale identitet! Dermed elimineres anonymitet for at kunne fjerne enhver, som deler meninger de er uenige i. Læs og se videoen her: ec.europa.eu/commission/pre… eller her: x.com/i/broadcasts/1… VELKOMMEN TIL FREMTIDEN SOM DU IKKE HAR INDFLYDELSE PÅ, MED MINDRE DU FATTER DIT MOD OG SIGER DIN MENING !




BREAKING: Merz, Starmer, Macron and Meloni issue joint announcement in Paris saying they’re sending a naval mission to the Hormuz Strait to protect freedom of navigation 🇩🇪🇬🇧🇫🇷🇮🇹




It is for parents to raise their children. Not platforms. The European Age Verification App is ready ↓ twitter.com/i/broadcasts/1…

With the release of iOS 26.4, Apple introduced mandatory age verification for users in the United Kingdom. Yes, they added age verification at the operating system level. Let’s unpack 🧵

European Commission President Ursula von der Leyen announced a new European age verification app that will give users a sort of digital ID card to prove their ages online — without sharing their sensitive personal information with every site or app they want to access. cnn.it/4vtqBIR








