Tweet fixado
Marc Hollenbach
8.5K posts
Marc Hollenbach
@HollenbachMarc
I like creative commons
Dublin Entrou em Ekim 2020
774 Seguindo243 Seguidores
Marc Hollenbach retweetou
The image below is of a Shahed-136 engine. Russia has launched over 70,000 Shahed and Geran-type drones at Ukraine. The engine crankcase, cylinders and pistons are cast from aluminium in Russia. Ireland produces the alumina and ships it to Russia. Ireland is complicit!
Dan the “Shadow Tanker Bonker”@realLangerDan
🚨Latest Trans-Alumina Express™️ cargo ship is just about to depart Aughinish pier in Ireland to deliver Alumina to St Petersburg The ship. KASSANDRA, is owned by Hansa shipping - an Estonian company. Contacts below Alumina is a vital war time resource @OckersM @Kama_Kamilia
English
Marc Hollenbach retweetou
Marc Hollenbach retweetou
🚨For those questioning whether NAFO can achieve anything tangible, I present you evidence that our pressure is working regarding the export of Alumina to Russia from Ireland.
The EU is now actively considering a ban and then Belgian government are on board to lobby for same.
Dan the “Shadow Tanker Bonker”@realLangerDan
🚨Latest Trans-Alumina Express™️ cargo ship is just about to depart Aughinish pier in Ireland to deliver Alumina to St Petersburg The ship. KASSANDRA, is owned by Hansa shipping - an Estonian company. Contacts below Alumina is a vital war time resource @OckersM @Kama_Kamilia
English
Marc Hollenbach retweetou
@MetscherBo20275 @rehbergkk Ich hatte mein Geld dieses Jahr innerhalb von 1 Woche. Aufwand 3 Minuten...
Deutsch
@rehbergkk Wow , Deutschland ist nur 30 später als Irland ; dort hast du immer am Anfang des Jahres den Bescheid bekommen & brauchtest nur Zustimmen wenn du was zurück haben wolltest ; einfaches Ankreuzen und paar Dinge ausfüllen. Wenn gut war - einfach nichts machen ! Geld in 8 Wochen
Deutsch
WTF ist das 🤯
Hat das ausser uns noch jemand erhalten?
Ist ja nett, aber: Nein danke.
#Steuererklärung
Deutsch
Marc Hollenbach retweetou
🚨Latest Trans-Alumina Express™️ cargo ship is just about to depart Aughinish pier in Ireland to deliver Alumina to St Petersburg
The ship. KASSANDRA, is owned by Hansa shipping - an Estonian company. Contacts below
Alumina is a vital war time resource
@OckersM @Kama_Kamilia
English
@DessieSPolitics Merz was born in 1955. He is 70...
Dublin City, Ireland 🇮🇪 Deutsch
Marc Hollenbach retweetou
Litauen und Lettland sperren Fico den Luftraum – für seinen Flug zu Putins Siegesparade am 9. Mai in Moskau.
Das muss man sich vor Augen führen:
Ein EU‑Regierungschef pilgert zur Militärparade eines Kriegsverbrechers, der seit vier Jahren ukrainische Städte in Schutt legt. Legt dort Blumen nieder. Applaudiert Panzerkolonnen. Und erwartet, dass EU‑Nachbarn ihm dafür auch noch den Himmel öffnen.
Haben sie nicht. Wieder nicht.
Schon 2025 mussten Fico und Vučić Umwege über Aserbaidschan nehmen, weil Litauen, Lettland, Estland klar gesagt haben: Unser Luftraum ist kein Zubringer nach Moskau, solange Moskau auf Kyjiw schießt.
Die Balten tun genau das, was Berlin und Brüssel nicht mehr schaffen:
Sie ziehen eine klare Linie.
Sie sagen lautstark Nein.
Sie nennen das Regime beim Namen, ohne „man muss im Gespräch bleiben”.
Am 9. Mai werden in Moskau wieder Regierungschefs aus aller Welt auf der Ehrentribüne stehen und der russischen Armee zujubeln.
Und bei uns?
Das Russische Haus in Berlin ist weiterhin offen.
Am 9. Mai wird der russische Botschafter wieder Kränze an den sowjetischen Ehrenmalen niederlegen. Begleitet vom üblichen Pilgerzug aus russlandtreuen Ukraine-Hassern.
Ukrainer und ihre Unterstützer werden wieder an die Seite gedrängt.
Polizei wird wieder „Deeskalation” üben gegen die Falschen.
Die Balten haben gestern ihre Antwort gegeben.
Unsere steht noch aus.
Dzis Maksym@DzisMaksym
🇸🇰✈️❌ Fico publicly stated that 🇱🇹Lithuania and 🇱🇻Latvia have already informed Slovakia they will not allow his government plane to fly through their airspace for the planned trip to Moscow on May 9, 2026, for Russia’s Victory Day celebrations (the 81st anniversary).
Deutsch
YouTube
Dublin City, Ireland 🇮🇪 QME
Wie heißt die Einheit der Kraft?
a) Newton
b) Volt
c) Power
d) Watt
Deutsch
@Schiya346 Klingt jetzt evtl. doof, aber seit ich wieder regelmäßig Weed rauche hab ich keine Probleme mit Lippenherpes.
Das soll jetzt aber keine Empfehlung sein. 🙂
Deutsch
@b750fde9 @cstein79 @marioellerbrock Diesel-LKW (40t) Elektro-LKW (40t)
Verbrauch ca. 890 Liter Diesel ca. 2.700 - 3.200
kWh Emissionen (Betrieb) ca. 2.350 kg CO2
Elektro: 0 kg (lokal) Emissionen (Strommix DE)-ca. 1.000 - 1.200 kg CO2 vs.
2700 - 1200 kg CO2
laut dem UBA mehr mehr als 50%.
Egal ich bin raus.
Deutsch
@HollenbachMarc @cstein79 @marioellerbrock Ich habe auch nicht behauptet, dass der Diesel LKW nichts emittiert. Ich finde auch nicht Diesel besser als Elektro. Was ich nur nicht abkann, wenn man Äpfel mit Birnen vergleicht, die Hälfte unter den Tisch fallen lässt. Ist doch auch ok wenn der E-LKW nur 10-20% besser wäre.
Deutsch
Halbe Kosten, volle Leistung!
Mit 22t im E-Lkw zum Kunden. Dank Mautbefreiung und Strom-Vorteil fahren wir aktuell rund 50 % günstiger als mit Diesel.
Leise, sauber, stressfrei. Ein Win-Win-Win für Umwelt, Unternehmen und Fahrer!
#ELkw #Transport #Innovation #GreenLogistics #SpeditionNannoJanssen #ZeroEmission
#BatteryElectricTruck
#Logistik
#Transport
#Güterverkehr
#Innovation
Norden, Deutschland 🇩🇪 Deutsch
@b750fde9 @cstein79 @marioellerbrock Klar, die Diesel LKW verursachen natürlich keinerlei Feinstaub... 1,1t CO2 wären wohl bei einem unbeladenen LKW richtig. Leerfahrt: ca. 0,65 kg/km, Teilbeladen: ca. 0.85 kg/km, Voll ausgelastet ca. 1,10 kg/km
Laut UBA "ca. 600g bis über 1.000g CO2 pro km je nach Auslastung"🥱
Deutsch
@HollenbachMarc @cstein79 @marioellerbrock Dann machen wir doch mal eine Plausibilitätsprüfung für Deutschland. 2024: 363 Gramm CO₂ pro kWh (laut Umweltbundesamt -> Wert im Video in Deutschland grob falsch. 1,1t CO2 wäre da der korrekte Wert. Und die lokalen Emissionen sind nicht in der Vergleich eingeflossen.
Deutsch
@b750fde9 @cstein79 @marioellerbrock Bleiben wir doch einfach bei der Realität. Hier ein Vergleich auf der Straße: youtu.be/-JzETosMmrQ?si…
YouTube
Deutsch
@SalVUs_SerVUs R&Bed for Privacy💥 and Spam💥🐾🚫😊🫶
Fellas, you 👇
@FuriousManiati
@Hofrat_Irrsinn
@Sebs_federente
@HollenbachMarc
@tamsjointbiz
are following this ➡️x.com/RoseSylvia69153⬅️ fake soldier account based in Nigeria🇳🇬
Stay safe 💙💛
English
6 scammers for your attention.
All the real soldiers have given consent to share . Well worth following their accounts
English
Marc Hollenbach retweetou
Let's shift focus and explain why the #EU #AgeVerification concept is fundamentally flawed.
Assume:
1. The production app is released.
2. It's 100% secure, 100% private (fantasy land, but stick with me)
3. It cryptographically challenges every step, including hardware attestation which requires a physical device.
4. Every single other attack vector in the surrounding environment is somehow magically patched.
aka - it's working exactly as intended/designed.
It does not protect against a relay attack.
This is a threat they considered and somewhat addressed here: github.com/eu-digital-ide…
With the current design, there's nothing preventing someone running a verification-as-a-service; a remote Android device which returns a valid attestation. Remember, it's not returning "I am over 18", it returns "someone is over 18". Neither the verifier, nor the app has any way to link the session ID to a physical device.
Their own docs state this clearly:
Remote Cross-Device Presentation:
"Note that the Wallet Instance does not see any difference between the cross-device flow and the same-device flow. In both cases, it receives an OpenID4VP-compliant presentation request over the Wallet Instance-platform API described in the previous section."
This is a known & well-understood attack vector in all remote credential presentation models; it's just not mitigated in this one... primarily because they can't. CTAP 2.2 won't work with all app flows, hardware attestation doesn't mitigate relay attacks, on-demand liveness detection would be too intrusive & potentially privacy-invasive & timing calculations don't reveal anything useful... all the available options to resolve this break the core design; completely anonymous age verification.
The Architecture & Reference Framework (ARF) is technically sound in some respects. They considered external threat actors and discussed solutions to mitigate them, including ZKP. However, the EC applied the wrong threat model, thus arriving at the wrong conclusion.
Yes, you need to protect against malicious verifiers, phishing sites, session hijacks, data brokers et al... but that's addressing external threats, it doesn't protect the architecture from the user itself.
In virtually every other scenario, the user and system's interests are aligned; protect my biometric asset at all costs.
Specifically for age verification, most users do not want to present ID simply to access a website, so whilst the system may adequately protect from external threats, if the user wants to bypass the system, they can... and the architecture doesn't consider this.
Every single applied mitigation assumes the user is the protected party, not the threat actor.
To those people claiming "it requires physical access to the device and root, this is BS/hyperbole", you too applied the wrong threat model & completely missed the point. These disclosures demonstrate that you, the user, are the threat actor they haven't considered.
You have your device.
You can root your device.
You can create a chrome extension, just as I did.
Ironically, it's precisely those under 18 who can't pass verification who are motivated to bypass it.
So where does that leave us?
A system which replaces "I am over 18" with "someone is over 18", with absolutely no guarantee that it's true... which is the entire purpose of the app.
Paul Moore - Security Consultant @Paul_Reviews
Bypassing #EU #AgeVerification using their own infrastructure. I've ported the Android app logic to a Chrome extension - stripping out the pesky step of handing over biometric data which they can leak... and pass verification instantly. Step 1: Install the extension Step 2: Register an identity (just once) Step 3: Continue using the web as normal The extension detects the QR code, generates a cryptographically identical payload and tells the verifier I'm over 18, which it "fully trusts". This isn't a bug... it's a fundamental design flaw they can't solve without irrevocably tying a key to you personally; which then allows tracking/monitoring. Of course, I could skip the enrolment process entirely and hard-code the credentials into the extension... and the verifier would never know.
English
Marc Hollenbach retweetou
Bypassing #EU #AgeVerification using their own infrastructure.
I've ported the Android app logic to a Chrome extension - stripping out the pesky step of handing over biometric data which they can leak... and pass verification instantly.
Step 1: Install the extension
Step 2: Register an identity (just once)
Step 3: Continue using the web as normal
The extension detects the QR code, generates a cryptographically identical payload and tells the verifier I'm over 18, which it "fully trusts".
This isn't a bug... it's a fundamental design flaw they can't solve without irrevocably tying a key to you personally; which then allows tracking/monitoring.
Of course, I could skip the enrolment process entirely and hard-code the credentials into the extension... and the verifier would never know.
Paul Moore - Security Consultant @Paul_Reviews
Hacking the #EU #AgeVerification app in under 2 minutes. During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory. 1. It shouldn't be encrypted at all - that's a really poor design. 2. It's not cryptographically tied to the vault which contains the identity data. So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app. After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid. Other issues: 1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying. 2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step. Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.
English
Marc Hollenbach retweetou
Hey @currys as promised, just letting you know I’ve submitted a formal complaint to the ASA as you’ve broken the terms of your own T&Cs and haven’t provided a prize, regardless of how often your incredibly poor customer service team on here keep telling me otherwise 👍🏻 #Currys
Currys@currys
Congrats to our winner @JordyP1993 🎉
English