Lugga

[Lugga @Shaggyboyo]

If there's no fire to guide my way, than i will start my own

[Lugga @Shaggyboyo]

My prounouns are Big/Dawg

[Weird Gifs/Videos @weird_gifs]

#NewProfilePic

[Paul Moore - Security Consultant  @Paul_Reviews]

.@vonderleyen "The European #AgeVerification app is technically ready. It respects the highest privacy standards in the world. It's open-source, so anyone can check the code..."

I did. It didn't take long to find what looks like a serious #privacy issue.

The app goes to great lengths to protect the AV data AFTER collection (is_over_18: true is AES-GCM'd); it does so pretty well.

But, the source image used to collect that data is written to disk without encryption and not deleted correctly.

For NFC biometric data:
It pulls DG2 and writes a lossless PNG to the filesystem. It's only deleted on success. If it fails for any reason (user clicks back, scan fails & retries, app crashes etc), the full biometric image remains on the device in cache. This is protected with CE keys at the Android level, but the app makes no attempt to encrypt/protect them.

For selfie pictures:
Different scenario. These images are written to external storage in lossless PNG format, but they're never deleted. Not a cache... long-term storage. These are protected with DE keys at the Android level, but again, the app makes no attempt to encrypt/protect them.

This is akin to taking a picture of your passport/government ID using the camera app and keeping it just in case. You can encrypt data taken from it until you're blue in the face... leaving the original image on disk is crazy & unnecessary.

From a #GDPR standpoint:
Biometric data collected is special category data. If there's no lawful basis to retain it after processing, that's potentially a material breach.
https://t.co/PKQ0DWSYzL

[Paul Moore - Security Consultant  @Paul_Reviews]

Hacking the #EU #AgeVerification app in under 2 minutes.

During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory.

1. It shouldn't be encrypted at all - that's a really poor design.
2. It's not cryptographically tied to the vault which contains the identity data.

So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.

After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.

Other issues:
1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying.
2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.

Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.

[Say walahi @abdirahman_raw]

@tragicbirdapp

[Teddy - PolyBackTest.com @Bitcoin_Teddy]

i have no desire to be rich so i can buy a lambo or birkins.

I want to be rich so I can control my time and go to the gym at 2 pm on a wednesday.

sit at a cafe and relax for an hour on a rainy afternoon.

so I can cook meals at home with fresh ingredients.

spend on my family and friends without worrying about a budget.

that’s my idea of a rich life, not the fake consumerist idea shoved down my throat.

[Lugga @Shaggyboyo]

Don't know the days that haven't
been

So l'lI wait around and see

And I hope that she'll be with me

any place that i might be

[TeamSpeak @teamspeak]

@discord

[Lugga @Shaggyboyo]

@windscribecom is it 80€ or 666.58€?

[The British Patriot @TheBritLad]

🚨WOW: Japan makes Muslim immigration extremely tough:

No special halal privileges - they cook their own food.

Building mosques is nearly impossible.

Public calls to prayer BANNED

In simple terms: Japan just told Islam to Fuck itself.

[Museum @DailyClassicArt]

Stephen Remick - "Winter Moonlight"

[Alex Armstrong @Alexarmstrong]

You can’t “tax the rich”.

They don’t have £5 billion just sat in the bank as cash. It’s all in assets and unrealised gains.

Many wealthy people take low interest loans (debt) out against their assets/wealth. Guess what? You can’t tax debt.

So when the left (Greens and Labour) say “tax the billionaires” what they really mean is tax the working and upper-middle class, people on PAYE and the businesses owned by the million/billionaires. Those business owners then just pass the cost to consumers or sack people.

So who loses? You do.

“Taxing the rich” is a cheap slogan that simply cannot work, they are the most mobile group of people in the world. Someone else will have their money and business.

For reference: see how Labour’s small wealth punishment on businesses is damaging the economy, raising unemployment and seeing record wealthy people flee Britain. Now ask, are you financially better off? Are you paying more tax to offset the wealth tax? We all know the answer, don’t we.

[Windscribe @windscribecom]

DO NOT GIVE DISCORD YOUR ID.
DO NOT GIVE DISCORD YOUR ID.
DO NOT GIVE DISCORD YOUR ID.
DO NOT GIVE DISCORD YOUR ID.
DO NOT GIVE DISCORD YOUR ID.
DO NOT GIVE DISCORD YOUR ID.
DO NOT GIVE DISCORD YOUR ID.

[Tuta @TutaPrivacy]

Let's remind everyone what a safe internet actually means. 🌐🌍

Share this & Spread the word!

#SaferInternetDay26 #SID