Mick Fox

6.1K posts

Mick Fox

Mick Fox

@mickfox

Dublin Techie, stable genius, increasingly GC, proud Paddystinian

Dublin City, Ireland เข้าร่วม Şubat 2009
601 กำลังติดตาม208 ผู้ติดตาม
Ivor Cummins
Ivor Cummins@FatEmperor·
The Digital ID simply MUST be stopped - it is a key part of the End Game to eradicate our inalienable rights and freedoms. This is an existential end-game issue:
Ivor Cummins tweet media
English
42
442
1.1K
9.7K
Mick Fox
Mick Fox@mickfox·
@jurbed While I don’t share the long term skepticism/paranoia, this the most measured, informed and reasoned article I’ve seen on the topic. Well done.
English
0
0
0
14
Juraj Bednar
Juraj Bednar@jurbed·
There have been recent "hacks" of EU Age Control. I think most of those people don't understand how it actually works and what they were hacking. For those of you that don't know much about it, you are probably assuming wrong things about it. I dug a bit deeper into it. It's hard - implementations, blueprints and hundreds of pages of bureaucratic-speak. But I believe this will give you a much more complete picture that bite-sized "I ran an AI agent against the public repo, don't know what it means, but here's how 'I' hacked it". juraj.bednar.io/en/blog-en/202…
English
4
4
10
865
Mick Fox
Mick Fox@mickfox·
@oidawosjetz @Paul_Reviews Check out the design - assertions are held in Secure Enclave or similar, a rooted file with edited system files won’t cut it.
English
1
0
0
11
Paul Moore - Security Consultant 
It's not easy to visualize the relay attack against the #EU #AgeVerification app from a user's perspective, so here it is. Even if the app works exactly as designed, the website & verification process is entirely decoupled & 'anonymous' The architecture assumes you'll send the request to your device, which contains your biometric data. But, it can go to any device, anywhere in the world... and because the phone has no way to know who initiated the process, the child still passes age verification. The assertion is the user is over 18. In reality, the app is responding to say the owner of this Android device is over 18. It doesn't know who the user is... how can it know their age? This is the current design, not a bug. They thought the ISO/IEC 18013-7 Annex C/DC API upgrade would protect against this, but CTAP only protects against external attackers, not the user wanting to bypass the system themselves - hence my description that we've replaced "I am over 18" with "someone is over 18" and it's supposedly better. If (more likely when) this is exploited, will company Directors/staff still face fines, legal action or imprisonment for not protecting children? Once you've signed in, websites are highly unlikely to ask for age verification again... so this attack, even if it could be mitigated in some way (I can't see how) only applies to new verifications. The EU #AgeVerification Relay Attack:
Paul Moore - Security Consultant  tweet media
Paul Moore - Security Consultant @Paul_Reviews

Let's shift focus and explain why the #EU #AgeVerification concept is fundamentally flawed. Assume: 1. The production app is released. 2. It's 100% secure, 100% private (fantasy land, but stick with me) 3. It cryptographically challenges every step, including hardware attestation which requires a physical device. 4. Every single other attack vector in the surrounding environment is somehow magically patched. aka - it's working exactly as intended/designed. It does not protect against a relay attack. This is a threat they considered and somewhat addressed here: github.com/eu-digital-ide… With the current design, there's nothing preventing someone running a verification-as-a-service; a remote Android device which returns a valid attestation. Remember, it's not returning "I am over 18", it returns "someone is over 18". Neither the verifier, nor the app has any way to link the session ID to a physical device. Their own docs state this clearly: Remote Cross-Device Presentation: "Note that the Wallet Instance does not see any difference between the cross-device flow and the same-device flow. In both cases, it receives an OpenID4VP-compliant presentation request over the Wallet Instance-platform API described in the previous section." This is a known & well-understood attack vector in all remote credential presentation models; it's just not mitigated in this one... primarily because they can't. CTAP 2.2 won't work with all app flows, hardware attestation doesn't mitigate relay attacks, on-demand liveness detection would be too intrusive & potentially privacy-invasive & timing calculations don't reveal anything useful... all the available options to resolve this break the core design; completely anonymous age verification. The Architecture & Reference Framework (ARF) is technically sound in some respects. They considered external threat actors and discussed solutions to mitigate them, including ZKP. However, the EC applied the wrong threat model, thus arriving at the wrong conclusion. Yes, you need to protect against malicious verifiers, phishing sites, session hijacks, data brokers et al... but that's addressing external threats, it doesn't protect the architecture from the user itself. In virtually every other scenario, the user and system's interests are aligned; protect my biometric asset at all costs. Specifically for age verification, most users do not want to present ID simply to access a website, so whilst the system may adequately protect from external threats, if the user wants to bypass the system, they can... and the architecture doesn't consider this. Every single applied mitigation assumes the user is the protected party, not the threat actor. To those people claiming "it requires physical access to the device and root, this is BS/hyperbole", you too applied the wrong threat model & completely missed the point. These disclosures demonstrate that you, the user, are the threat actor they haven't considered. You have your device. You can root your device. You can create a chrome extension, just as I did. Ironically, it's precisely those under 18 who can't pass verification who are motivated to bypass it. So where does that leave us? A system which replaces "I am over 18" with "someone is over 18", with absolutely no guarantee that it's true... which is the entire purpose of the app.

English
13
35
139
9.1K
Adriana 🇳🇱
Adriana 🇳🇱@AmHuijnink·
@CeesCees72 Maar wat doen we als ze het op zo'n manier verplichten dat weigering je bankrekening bevroren wordt? Want dat ze het gaan proberen af te dwingen staat vast
Nederlands
1
0
0
67
Cees
Cees@CeesCees72·
Het is een controlemiddel voor volwassenen. Kinderen <18 zullen hem immers niet installeren om aan te tonen dat ze ergens niet in mogen. Het gaat dus om acceptatie van het controlemiddel, en dat is precies niet wat je moet doen omdat die acceptatie de weg vrij maakt om meer zaken te privilegieren. Zoals wij inmiddels gewend zijn van de uitvoerders en handlangers. De toekomst gaat om tokenization van alles met privileges (die voorheen grondrechten waren) als ruilmiddel. Geef ze de tools niet in handen. Los van de pricacyvraagstukken en het paternalisme. De overheid is er om ons te dienen en niet andersom.
Nederlands
6
125
269
2.8K
Malue Montclairre _ Backup Account
UDPENSLING‼️ For de som stadig ikke har forstået alvoren og konsekvenserne af EU's nye aldersverifikations app, vil jeg mejsle det ud i sten: Fremover vil alle under 18 år få deres nyheder fra statens propaganda medier og dermed udvikles deres politiske meninger baseret på holdninger som er på linje med EU! Med andre ord; indoktrinering og hjernevask!
Malue Montclairre _ Backup Account@BackupMalue

SÅ ER DEN HER‼️ EU's nye Digitale Alders-Verifikations App for adgang til internettet og sociale medier, som ingen af os har stemt for eller imod, og som ingen af os heller er blevet informeret om skulle indføres! Ursula von der Leyen har tidligere i morges erklæret Appen for tilgængelig for alle EU medlemslande at få implementeret - alt for at "beskytte børn" imod online mobning! Det bliver her beskrevet, hvor let og simpelt det hele er - oversat: "Du downloader appen og konfigurerer den med dit pas eller ID-kort. Du beviser derefter din alder, når du tilgår onlinetjenester." Og yderligere "kan onlineplatforme nemt stole på vores aldersbekræftelsesapp. Så der er ikke flere undskyldninger." Ursula von der Leyen sammenligner selv dette digitale pas "med sundhedskortet med en QR-kode, der skal scannes under COVID"! I virkeligheden har det INTET at gøre med at beskytte børn og ALT at gøre med en pro-europæisk dagsorden, hvis eneste formål er at påtvinge det digitale pas og den europæiske digitale identitet! Dermed elimineres anonymitet for at kunne fjerne enhver, som deler meninger de er uenige i. Læs og se videoen her: ec.europa.eu/commission/pre… eller her: x.com/i/broadcasts/1… VELKOMMEN TIL FREMTIDEN SOM DU IKKE HAR INDFLYDELSE PÅ, MED MINDRE DU FATTER DIT MOD OG SIGER DIN MENING !

Dansk
35
73
277
4.9K
Mick Fox
Mick Fox@mickfox·
@Microinteracti1 How does the content compare to your substack feed? Considering stumping up some cash based on recent quality
English
1
1
3
112
Gandalv
Gandalv@Microinteracti1·
Thank you. Every follow, every read. I see it. Now something new. $3 a month. The open posts spark the thought. The subscription is where I finish it. Longer pieces. The full argument. The part where I show you exactly why it matters and what to do with it. Not just “here’s something interesting.” But “here’s what’s actually going on, and here’s how to think about it.” One topic. Taken all the way. If you’ve ever finished a post and wanted more, this is the more. $3. One link 😊 x.com/Microinteracti… Gandalv
English
9
13
42
4.2K
Christophe Boutry
Christophe Boutry@Ced_haurus·
💬Selon vous, vos messages sur WhatsApp sont :
Français
6
2
6
2.2K
Mick Fox
Mick Fox@mickfox·
@DrEliDavid If it involves Trump, the situation will flip in the next day or two. The adults will still need to clean up his mess.
English
0
0
0
7
Mick Fox รีทวีตแล้ว
Gandalv
Gandalv@Microinteracti1·
The Loneliest Superpower on Earth America is becoming North Korea with a better GDP. Sit with that. Not as provocation. As diagnosis. A country that has torched its alliances, taxed its closest friends, threatened to annex its neighbors and walked away from the institutions it spent a century building has made a deliberate choice about its place in the world. Applauded at rallies, repeated in press conferences, performed for cameras with the confidence of people who have never had to live with the consequences of being wrong at this scale. The choice is: alone. And alone feels like strength right up until the moment it doesn't. By the time it doesn't, the damage is already structural. Every single day before this began, billions of dollars moved across the Canada-US border. Every morning, trucks crossed, goods moved, money changed hands, relationships held. That is now bleeding out. Tourism has collapsed. The travelers who used to arrive with money and genuine affection are going elsewhere, to countries that did not threaten to absorb them. The weapons contracts that underwrote American industry and cemented American influence across three continents are being quietly reviewed in defense ministries from Berlin to Seoul. Nobody announces these reviews. They happen in rooms Americans are no longer invited into. The military bases are the same story. Nobody publicly cancels a base. They stop renewing. They start asking questions. They begin building the infrastructure that means they will not need to ask America for anything next time. That infrastructure, once built, does not get dismantled out of nostalgia. This is how empires actually end. Not with a bang. With a series of very reasonable decisions made by very serious people in other countries, each one small enough to dismiss, each one slightly irreversible. There is a village in the mountains of every country in Europe that made this same choice, once. Not geopolitics. Just a village that turned inward, closed the market, pulled back from the road, decided it had enough and did not need the noise from outside. For a while it felt like dignity. Then the young people left. One or two at first, then more, because the young always follow the future and the future had quietly relocated somewhere with a road and a reason. The craftsmen followed, because craftsmen follow customers. The market that came through on Thursdays stopped coming because there was no longer enough to justify the trip. The houses did not fall down immediately. They just stopped being repaired. And the people who stayed told each other this was fine, that they preferred it, that the outside world was corrupt and they were better without it. The outside world did not argue. It simply continued without them. That is the mechanism by which America is currently operating, at a scale that would have been unimaginable two years ago. North Korea chose this mechanism, because the alternative was accountability. The country that once produced steel and traded across Asia now produces propaganda and imports famine relief. The turn did not happen overnight. It happened through a thousand small closures, each one justified, each one making the next easier. The infrastructure of self-sufficiency became the infrastructure of imprisonment. By the time ordinary North Koreans understood what had been surrendered, the price of getting it back had become impossible. Myanmar sealed itself away and emerged decades later to find the world had rearranged its trade corridors around the empty space where Myanmar used to be. Those spaces had been filled and were not available for reoccupation. Cuba still drives the cars from 1962. Not as charm. As evidence of what happens when the compounding runs long enough. These are not cautionary tales about ideology. They are cautionary tales about direction. About what happens when a country holds a position long enough to discover the world was not waiting. Isolation is not a destination. It is a direction. And directions maintained with sufficient conviction always become destinations. In any other functioning democracy, a leader who had done this much damage this fast would already be gone, through the ordinary arithmetic of people who understand what hurts a country and what helps it. Europe remembers what international trust costs because Europe spent decades rebuilding from the rubble of losing it. The countries that clawed their way back from nothing remember exactly what it is worth and exactly what it costs to squander. America, having never rebuilt from rubble, is learning this for the first time. The tuition is enormous. The researchers are leaving. The students are choosing other universities in other countries. The institutions that were magnets for the world's best minds were never great because of their buildings. They were great because of who wanted to come. That reputation is not a faucet you can turn back on. It returns, if it returns at all, over decades, when the conditions that created it are restored. The conditions are not being restored. The allies have started building what they used to have no reason to build. Europe is developing defense architecture, which is great and irreversible. Canada is rewiring its trade toward Europe and Asia. China is walking, unhurried and methodical, into every room America has vacated. These are not acts of aggression. They are acts of adaptation. The world is making sensible arrangements in America's absence. These are countries that named streets after American presidents, countries whose grandparents wept when the Americans arrived. Americans traveling in Europe now reportedly adopt Canadian accents to avoid the conversation, because the conversation when it comes is not gentle and Europeans are not known for sparing people from conclusions they find uncomfortable. The country that liberated a continent, that fed Europe when Europe was on its knees, that built the postwar order with its own money and for all its failures largely meant it, that country's citizens are now pretending to be from somewhere else so they do not have to explain themselves to a stranger in a bar. That is not a data point. That is a civilization telling you something is wrong. America was genuinely extraordinary. Not in the way its politicians perform it, hand on heart, flag in background, but in the actual unglamorous world-historical way. The Marshall Plan was the most strategically generous act in modern history and it worked. The idea that you could arrive with nothing and become something was imperfect, frequently brutal, riddled with contradictions, and real enough that people crossed deserts and oceans and razor wire to test it. That is not nothing. That is, in fact, almost everything. That America still exists. It has not been destroyed. It is being buried by people who have confused its confidence for arrogance and its generosity for weakness and its complexity for something that needs to be flattened into slogans that fit on a hat. Buried things, left long enough, stop being things you can retrieve. They become geology. They become the sediment layer that future historians will drill through and hold up to the light and say: here, this is where it changed. The people doing this call it winning. The rest of America is sitting quietly, trying to find the words to explain to their children that this is not permanent, hoping they are right, suspecting in the honest 3am way that the window is smaller than anyone is saying out loud. It can become permanent through compounding, through the slow arithmetic of a thousand reasonable decisions made by serious people in other countries, each one locking in a future with slightly less room for America in it than the last. The village does not announce its own irrelevance. It just gets quieter, until one day you drive through and the market is gone and the young are gone and the houses are not quite falling down but not quite standing either, and the people who remain tell you they prefer it this way. If this kind of analysis matters to you, subscribe. Gandalv / @Microinteracti1
Gandalv tweet media
English
58
319
799
29.7K
Nick Sortor
Nick Sortor@nicksortor·
🚨 LMAO! President Trump says NATO just called him offering to help with the Strait of Hormuz — MINUTES AFTER he and the Iranians announced its full reopening And President Trump told them to GET LOST 🤣 What a USELESS organization “Now that the Hormuz Strait situation is over, I received a call from NATO asking if we would need some help. I TOLD THEM TO STAY AWAY, UNLESS THEY JUST WANT TO LOAD UP THEIR SHIPS WITH OIL. They were useless when needed, a Paper Tiger!”
English
3.2K
13.4K
55.9K
1.3M
⭕ Brock Pierson
⭕ Brock Pierson@brockpierson·
ICQ was released 30 years ago and really the first great instant messenger app. I spent so much time on this app. Did you?
⭕ Brock Pierson tweet media
English
402
109
1.9K
61.5K
Mick Fox
Mick Fox@mickfox·
@nyaraVT Just a quick one - what shape is the earth?
English
0
0
0
65
Anonymous
Anonymous@YourAnonOne·
Name a huge scam that has been normalised?
English
4.7K
129
1.8K
1.1M
Mick Fox
Mick Fox@mickfox·
@stoorbat @Paul_Reviews Yeah she certainly did overstate the readiness there. The release notes in GitHub dont tho
English
0
0
2
21
Daniel
Daniel@stoorbat·
@mickfox @Paul_Reviews "Our European age verification app is technically ready and soon available for citizens to use." - von der Leyen
English
1
0
0
54
Paul Moore - Security Consultant 
I'm yet to hear anyone question why, even if the #EU #ageVerification app is working flawlessly... why you're only over 18 thirty times?! What is it checking against after 30 successful/failed login attempts to verify the data is still correct?
GIF
English
13
24
158
10.5K