Bart Vandendriessche

[Bart Vandendriessche @div_]

@TijlDeBie Schadenfreude ist die schönste freude.

[Bart Vandendriessche @div_]

@Camposte1 @KoenSchoenmaeck @Pdbruyne Hij zegt toch letterlijk “Steekproeven bij bepaalde risicogroepen generaliseren is verkeerd.”, waarmee hij idd impliceert dat die groepen te homogeen zijn.

Je lijkt me violently in agreement te zijn.

[Bart Vandendriessche @div_]

@s_antisemitisme @theojacobs3 Met hetzelfde recht waarmee u het tegenovergestelde beweert natuurlijk.

[Jean Marie Dedecker @JMDedecker]

'Het is stil rond Gaza, doodstil' https://t.co/TeQGhpeKNf

[Taylor Lorenz @TaylorLorenz]

No matter where you are on the political spectrum you should be fighting against digital ID efforts in the U.S. and abroad

[Paul Moore - Security Consultant  @Paul_Reviews]

.@vonderleyen "The European #AgeVerification app is technically ready. It respects the highest privacy standards in the world. It's open-source, so anyone can check the code..."

I did. It didn't take long to find what looks like a serious #privacy issue.

The app goes to great lengths to protect the AV data AFTER collection (is_over_18: true is AES-GCM'd); it does so pretty well.

But, the source image used to collect that data is written to disk without encryption and not deleted correctly.

For NFC biometric data:
It pulls DG2 and writes a lossless PNG to the filesystem. It's only deleted on success. If it fails for any reason (user clicks back, scan fails & retries, app crashes etc), the full biometric image remains on the device in cache. This is protected with CE keys at the Android level, but the app makes no attempt to encrypt/protect them.

For selfie pictures:
Different scenario. These images are written to external storage in lossless PNG format, but they're never deleted. Not a cache... long-term storage. These are protected with DE keys at the Android level, but again, the app makes no attempt to encrypt/protect them.

This is akin to taking a picture of your passport/government ID using the camera app and keeping it just in case. You can encrypt data taken from it until you're blue in the face... leaving the original image on disk is crazy & unnecessary.

From a #GDPR standpoint:
Biometric data collected is special category data. If there's no lawful basis to retain it after processing, that's potentially a material breach.
https://t.co/PKQ0DWSYzL

[Paul Moore - Security Consultant  @Paul_Reviews]

Hacking the #EU #AgeVerification app in under 2 minutes.

During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory.

1. It shouldn't be encrypted at all - that's a really poor design.
2. It's not cryptographically tied to the vault which contains the identity data.

So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.

After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.

Other issues:
1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying.
2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.

Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.

[Marc Botenga MEP @BotengaM]

Peu après le cessez-le-feu entre les États-Unis et l'Iran, Israël lance 100 frappes en 10 minutes sur le Liban. Une escalade inédite. Des centaines de morts et de blessés. A Beyrouth c'est l'enfer, la peur.

Que faut-il de plus pour que les pays européens sanctionnent Israël ?

[Pedro Sánchez @sanchezcastejon]

Justo hoy, Netanyahu lanza su ataque más duro contra el Líbano desde que empezó la ofensiva.

Su desprecio por la vida y el derecho internacional es intolerable.

Toca hablar claro:

- Líbano debe formar parte del alto al fuego.

- La comunidad internacional debe condenar esta nueva violación del derecho internacional.

- La Unión Europea debe suspender su Acuerdo de Asociación con Israel.

- Y no debe haber impunidad ante estos actos criminales.

[Marc Botenga MEP @BotengaM]

Ursula Von der Leyen rewrites history.
As if the US never attacked Iran.
As if Israel never attacked Iran.
As if they did not put global economic stability at risk.

Constructing parallel realities to whitewash the crimes of her friends.

She does not speak for Europeans.

[Bart Vandendriessche @div_]

@elikowaz Why don’t you surrender Netanyahu and Gallant to the ICC and roll the dice if you think Mearsheimer is wrong ?

[Kathleen Van Brempt @kvanbrempt]

An agreement based on respect for human rights cannot remain in place when those rights are repeatedly and systematically violated. It’s never too late to do the right thing, but now action is long overdue. Suspend the EU-Israel Association Agreement.

https://t.co/zHT3jhaFjk

[Bart Vandendriessche @div_]

@swabackerjau @MouinRabbani Dit is sarcasme, of account overname fyi https://t.co/CqSsN9zUfK

[Bart Vandendriessche @div_]

@thomas_spaas Al jaren sturen Europese lidstaten hun politiek afval naar de EU en dan verwachten we goed bestuur 🤷‍♂️

[Thomas Spaas @thomas_spaas]

We hebben een majeur probleem met de N-VA-fractie in het EP, en media die dit niet melden, zijn medeplichtig.

[Marc Botenga MEP @BotengaM]

Why are crimes against Iranian, Lebanese, and Palestinian children not a priority for the European Parliament ? Because those responsible sit in Tel Aviv or Washington.

When it comes to its allies, Europe supports or condones the worst crimes, undermining international law.

[Tijl De Bie @TijlDeBie]

Wie het gemist heeft: vanaf 4 april mogen berichtendiensten (whatsapp,...) uw berichten niet meer zonder onderscheid scannen, omdat het voorstel om #ChatControl 1.0 te verlengen niet werd goedgekeurd.
Wie stemde wél voor het voorstel? @de_NVA (en @MR_officiel). Ze wilden zelfs een straffere versie van wat uiteindelijk ter stemming voorkwam, want ze stemden tégen een amendement dat het verzwakte.
Hieronder drie screenshots met wat @FranckenTheo, @MichaelFreilich en @jeroen_bergers over #ChatControl nog geen half jaar geleden te zeggen hadden. Ik denk dat een uitleg op zijn plaats is.
Een pluim voor @pvdabelgie en #Groen die het als enige Vlaamse partijen consequent voor uw privacy opnamen.
Partijen zoals de N-VA verwijten Europa nogal eens dikwijls een gebrek aan transparantie en democratische legitimiteit. Dat klopt, maar alleen omdat partijen zoals de hunne misbruik maken van de Europese complexiteit om A te zeggen en ondertussen in Europa B te doen. En omdat journalisten het ofwel zelf niet snappen, ofwel niet uitgelegd krijgen.

[Francesca Albanese, UN Special Rapporteur oPt @FranceskAlbs]

Palantir - named in my report for complicity in Israel’s crimes - is a threat to all of us. Palestinians were only the first in line.

[Ramy Abdu| رامي عبده @RamAbdu]

French judge Nicolas Gouyou, who issued an arrest warrant for Netanyahu at the ICC:

• Visa and Mastercard have blocked all my cards
• I cannot make any purchases
• I am a judge, yet treated like a criminal
• Judges, lawyers, and politicians are being intimidated
• A colleague told me my name won’t be removed from the blacklist until Trump’s term ends
• Despite intervention by the French president, U.S. authorities have not responded

[Haaretz.com @haaretzcom]

‘Like we did in Gaza’: Israeli defense minister says IDF ordered to flatten homes in Lebanese border villages
https://t.co/9muyS43MTC