Greg Dash
392 posts

Greg Dash
@GregLabour
Higher Education, Skills and Strategy at @UCL Former Labour advisor: Elections, Local Government & Cabinet Office. Fellow of @IWA_Wales.

It's not easy to visualize the relay attack against the #EU #AgeVerification app from a user's perspective, so here it is. Even if the app works exactly as designed, the website & verification process is entirely decoupled & 'anonymous' The architecture assumes you'll send the request to your device, which contains your biometric data. But, it can go to any device, anywhere in the world... and because the phone has no way to know who initiated the process, the child still passes age verification. The assertion is the user is over 18. In reality, the app is responding to say the owner of this Android device is over 18. It doesn't know who the user is... how can it know their age? This is the current design, not a bug. They thought the ISO/IEC 18013-7 Annex C/DC API upgrade would protect against this, but CTAP only protects against external attackers, not the user wanting to bypass the system themselves - hence my description that we've replaced "I am over 18" with "someone is over 18" and it's supposedly better. If (more likely when) this is exploited, will company Directors/staff still face fines, legal action or imprisonment for not protecting children? Once you've signed in, websites are highly unlikely to ask for age verification again... so this attack, even if it could be mitigated in some way (I can't see how) only applies to new verifications. The EU #AgeVerification Relay Attack:







Walthamstow. Where even our chippy is just a bit cooler than everyone else’s …. #boastingMP Even if this isn’t a #banksy it’s brill and the chips there are magic so thank you whoever added this bit of beauty to our street art today … (h/t amy for the picture!)

























