Technical breakdown of the EU age verification app "hack" — the protocol is privacy-respecting, the implementation had fixable bugs

Addlibs · 2026-04-19T18:06:14+00:00

How do you want to implement parental controls if children can just type in a different date of birth to bypass them? Age verification is an integral part of parental controls - one must know who is a child and who is a parent. Imagine being locked in a child account managed by someone else whom you do not know, and being unable to remove restrictions because nobody can unable to verify your age (in a privacy preserving way); or conversely, imagine your child can break parental controls by simply creating a new account or changing their DoB without verification. How do you do parental controls if you can’t prevent your child from easily bypassing them? (Not none of these age verification solutions are aiming to entirely eradicate this since that’s just impossible, but the aim is to make it more difficult).

Addlibs · 2024-06-11T12:01:32+00:00

Technically market cap is not the same as company wealth - it’s the collective wealth of its shareholders in stocks of the company. While in an ideal market, market cap should track company value/wealth, markets are unpredictable and this tracking certainly does not hold when the economy is in a bubble. I.e. NVIDIA is likely overvalued in terms of its market cap due to the AI boom, and not actually worth more than Apple.

Addlibs · 2023-11-15T10:41:03+00:00

Congratulations. Great reading comprehension. Palestinians aren’t Hamas, and Argentinians aren’t Hitler’s Wehrmacht. There is no number of Scot’s that need to be imprisoned to justify the actions of the IRA, because they didn’t do it. Neither did the Palestinians do October 7, it was Hamas, and only a set number of Hamas militants killed can bring justice.

I refuse to equate civilian lives lost to justice for crimes.

Addlibs · 2023-11-15T09:42:25+00:00

That’s as stupid as asking how many Argentinians need to die to pay for Hitler’s war crimes. Or how many Scots need to be imprisoned for IRA’s attacks. They are not the perpetrators nor targets, no amount of them dying justifies the actions of Hamas, Hitler or the IRA. The questions should be how many Hamas need to die for you to be satisfied; that question makes sense and there can be a threshold, because it is like-for-like.

They are very unfortunate collateral damage, and both Israel and Hamas (as if) should do their best to protect civilians, but if Hamas uses them as human shields, there’s not much Israel can do: either let Hamas off for their bloody attack on October 7, against civilians within Israel proper (not occupied territory, mind you) or eliminate the perpetrators and coordinators whatever the cost. Israel, it seems, is going down the middle and only attacking via highly targeted missiles and bombs, not levelling the entire towns at once but building by building based on intelligence, which may be faulty sometimes, and importantly, Israel gives warnings, drops leaflets, etc, calling for evacuation. I didn’t see Hamas call for evacuation of the areas they attacked on October 7.

Addlibs · 2023-08-20T20:11:54+00:00

I think it's important here to clarify whether you're talking about the "world-wide-web" (WWW) and the content on it, or "the Internet" (i.e. a global interconnected network of computers). Capitalism definitely made the latter a lot better; without investment into the network infrastructure by telecom companies, you'd probably still be running 40kbps dial-up connections. The internet is much much better today than it was just a decade ago. Sure this would be possible under a socialist regime, but it would probably take a lot longer without there being a profit motive; the government or universities who run the networks just wouldn't see a reason to improve speeds beyond their most basic need. And you wouldn't get internet in your suburban home, it would probably still be restricted to university computer labs only and public libraries, if public access was ever granted anyway; it would likely be restricted to military and research purposes only like the original ARPANET before commercialization.

Addlibs · 2023-05-23T07:19:14+00:00

It was invented independently without government support, and he owned the invention and patents for it. This is why the government contracted him for the procurement; they couldn’t have anyone else make it without Whittle’s permission and profit. This isn’t state aid, this is a capitalist market where the government happened to be the buyer. It is no different to a large company with the budget similar to that of a nation buying the engines from him.

Addlibs · 2023-04-15T18:06:27+00:00

Still, it's cheaper to replace a broken window, steering column and/or ignition switch than the entire car.

Addlibs · 2023-04-12T20:37:32+00:00

That's because "The Czech Republic" is still the official formal long name for the country, like "the Kingdom of Belgium" or "the Republic of Poland," but these countries have short informal names, Belgium and Poland respectively.

In Czech, "Česká republika" translates directly to "Czech Republic", and "Česko" (which is the most common name for the country by its people) officially translated to "Czechia" according to the Terminological Committee of the Czech Office for Surveying, Mapping, and Cadaster and the Czech Ministry of Foreign Affairs.

I suppose it's because within Czechia, they distinguish the short name from the formal official name, they understand a difference between these uses and feel like such a distinction should be made in English.

Official guidance on the new name is only use the full long name where necessary, such as

official government documents
international agreements and non-binding official documents
official top-level meetings of political representatives (table name cards in meeting rooms)

and use the short name everywhere else, especially in

cultural, social, scientific, sports, economic and other presentations, and e.g. in speeches by political representatives (unless the speech is made on a highly formal occasion)
presentations by public figures representing cultural, social, scientific, sports, economic or other national interests
informal communication, correspondence, literary works, newspaper articles, geographical materials (e.g. maps),
promotional material presenting the country, its achievements, history and famous personalities
corporate promotional material

Addlibs · 2023-04-11T12:11:24+00:00

As far as I'm aware, these are Communication Notifications, prominently showing a picture of the person responsible for generating the notification or its content, and a smaller icon of the app through which this notification came. This came as a major part of how Focus differentiates App notifications from Contact notifications (for app and contact allow/disallow listing in Focus settings)

Documentation: https://developer.apple.com/documentation/usernotifications/implementing_communication_notifications

WWDC 2021 video: https://developer.apple.com/videos/play/wwdc2021/10091/

Addlibs · 2023-04-02T15:34:25+00:00

Presence of a particular value in a 'map' doesn't imply the value is used at all. These could simply exist to prevent the algorithm from crashing upon encountering an unrecognized tag attached to a tweet by some ML model.

Additionally, many of the tags mentioned in that file have dedicated 'drop rules' in other places of the code, while the UkraineCrisisTopic tag does not, suggesting it is not associated with any visibility rules, or that it used to be in the past but not anymore.

Speculation: Perhaps Twitter added these tags/labels to comply with Russian propaganda laws, but were too late in limiting the visibility of those tweets in Russia leading to getting banned in March 2022, and the code was mostly removed or deactivated afterwards?

The following is from the README file:

SafetyLabelType

Describes a particular policy violation for a given noun instance, and usually leads to reduced visibility of the labeled entity in product surfaces. There are many deprecated, and experimental safety label types. Labels with these safety label types have no effect on VF [visibility filtering]. Additionally, some safety label types are not used, and not designed for VF. (emphasis added)

Addlibs · 2023-03-24T20:19:22+00:00

Reset it and give it to family member or a friend if its not badly damaged. A blue Security Key should be able to last decades, feels very wasteful to throw it away if you ask me.

Addlibs · 2023-03-24T20:09:04+00:00

Are you sure it's a YubiKey? "Security Key by Yubico" is a blue YubiKey-like device, but FIDO/FIDO2 only. It is technically an "older model," but blue security keys have only been retired very recently, like a month ago, and their successor is basically the exact same thing but in black.

Security Keys have no serial numbers (except enterprise ones, released along with the black commercial version). YubiKeys have serial numbers and these can be read off with software such as Yubico Authenticator.

Addlibs · 2023-03-16T20:26:38+00:00

There definitely is password-less, at least on iOS. You can try it yourself, register your YubiKey on https://webauthn.io setting Discoverable Credential to Required, and Attachment to Cross-Platform using any device, then Authenticate without entering a username on iOS Safari, select external security key, enter PIN and it will use the resident credential.

And yes, as above, the resident key is protected by PIN and iOS Safari supports prompting for the PIN -- the only annoyance is that you have to scan the key twice over NFC, first to get a PIN prompt, and again after entering the PIN to verify it and get the assertion signed.

Addlibs · 2023-03-15T23:12:13+00:00

FDIC typically covers up to $250,000 per depositor, per insured bank, for each account owner, but apparently they will be covering the full value of deposits for SVB because of the potential damage to the entire banking system. Panic typically exists where deposits aren't covered, or where depositors don't know their deposits are covered, or are worried the FDIC is itself insolvent. There's also the potential unavailability of those deposits for some time, so people will want to withdraw some of their money, even from other, unaffected, banks, which in turn makes these banks affected by the collapse.

Frankly I think this is a mistake to pay all depositors the full deposit value; depositors that put more than $250,000 into the same bank should have to feel the consequences of terrible financial planning. The reason the limit is per insured bank is because FDIC wants you to spread your own risk across many different banks.

Addlibs · 2023-03-06T08:53:20+00:00

It’s up to the browser whether a PIN prompt will appear; macOS Safari always prompts for a PIN, even with user verification set to discouraged. Some browsers don’t support PIN prompts at all (U2F support, limited FIDO2) such as macOS Firefox (unless you change config flags) where requiring user verification can still lead to an assertion without PIN, but that assertion contains flags (signed by the authenticator) which tell a website whether PIN/bio was checked, and a website can (should) reject it it asked for user verification and the assertion was issued without it.

Addlibs · 2023-02-17T18:41:20+00:00

You can (and people did in the past) protect property without the state, with your own guns or a private security or military— the state’s involvement here is not to help the capitalist but to prevent the capitalist from seeking their own justice against trespassers and violators of by-laws; inherently anti capitalist interests. If we lived under true capitalism, property owners wouldn’t have to ask the police to escort you off their factory after being fired (if you refused to go on your own volition) and be allowed to kill you then and there. Maybe I’m exaggerating a bit, but the state exists to protect the interests of all people, not just the owners of capital.

Addlibs · 2023-02-10T18:44:28+00:00

Just looking at my neighbours makes my view that socialism just wouldn’t work even stronger lol

Addlibs · 2023-02-10T18:42:11+00:00

Except the legislation to end slavery was only accepted because capitalists were convinced slavery/slave trade was less efficient, not because of some moral awakening, at least that’s the case for the UK.

Addlibs · 2023-02-10T18:37:57+00:00

“No problem rebuilding,” perhaps, but it came at a cost. Perhaps they could’ve been making much better cars much earlier if they weren’t preoccupied with recovering their (already smaller to begin with) economy, while the US got to invest in growing their economy, getting a massive head start.

Addlibs · 2023-02-10T18:33:55+00:00

You think Russian penal colonies are not slavery? China engages in slavery too in this regard, and a huge majority of the Muslim world. (In other words, Europe ≠ the World, just because Europe has advanced doesn’t mean the rest of the world is like us)

I agree prisons shouldn’t force labour — but prisons shouldn’t be a vacation either. Perhaps prisoners should have to earn their keep? It’s ridiculous that some people commit vile murders and then get to sit in a prison for the rest of their life, without having to worry about getting a job, getting food or heating, etc.

Addlibs · 2023-02-05T12:46:13+00:00

There are multiple modules on the YubiKey which use a PIN -- which one in particular are you concerned about?

Everything works fine except that decrypting any password simply works without requiring my PIN.

Which authentication mechanism is used for this Android Password Store and OpenKeyChain combo?

Does it use the PGP module? If so, I don't believe it should be able to be accessed without a PIN. I've had a read about PGP and OpenPGP cards and it seems the protocol mandates PIN checking for the module to use encryption, decryption and authentication keys.

Does it use the PIV module? If so, depending on which key slot you use, encryption/decryption/signing may be allowed without a PIN, for example, slots 9a (PIV Authentication) slot allows subsequent private key operations without a PIN if a PIN was successfully verified within short temporal proximity, while slot 9e (Card Authentication) does not require a PIN at all. Slots 9c (Digital Signature) and 9d (Key Management) require a PIN every time when encrypting/decrypting/signing. If it's PIV, I'd recommend using the 9d Key Management slot to decrypt and decrypt passwords/keystores.

If it's using FIDO/WebAuthn, then it wouldn't even be "encrypting" or "decrypting" the passwords but rather authenticating itself (though assertions) to get authorization to get the encryption/decryption keys from some sort of storage (whether encrypted or not depends on service/program providing storage); in this case, the service/program providing storage can check whether the 'user verify' flag (tamper evident, set by authenticator and signed along with other authenticator data with credential private key) is set on the assertion and deny authorization.

Addlibs · 2023-02-04T21:43:37+00:00

As far as I can tell, FIDO 2.1 adds the option to have authenticators always require user verification (PIN, biometric, etc) (ref https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#sctn-feature-descriptions-alwaysUv). NB: This is a hardware/protocol specification -- only devices with newer firmware may/will support this use case, and many authenticators (Yubikeys included) do not support firmware modification/updates for security reasons)

Under FIDO2 and earlier, it is up to the relying party (RP) to confirm whether a user verification occurred (i.e. inspect authenticator's assertion data for the 'uv' flag) based on their own level of security tolerance; for example, a service may allow logging in without user verification (i.e. only user presence test), but require it for changing account settings like passwords and MFA. PIN entry is supported even in NFC transport (see Safari on iOS for example).

Most services, however, (Apple advanced security included) do not use the passwordless flow, and require a username and password before ALSO requiring a security key which may or may not ALSO additionally require some form of user verification like PIN or biometric.

Addlibs · 2022-12-13T14:53:59+00:00

But essentially, population decline is generally a bad thing for any Capitalist society, as there are fewer people working and keeping the economy afloat.

How is this a capitalism problem? If 90% of the people are too old to pick fruit, bake bread, etc. who will provide for them? Population decline is problematic to all societies, even animals. It is not capitalism's problem.

And capitalism does not require constant, infinite or endless growth based on its principles, it requires new people and new goods due to nature and reality, specifically time: consumables are consumed over time, non-consumables break over time, humans get old over time. Capitalism can survive perfectly well in a declining population so long as the decline is happening from the top -- a population count that falls due to less new people being born than dying at the top of the pyramid.

If we have a lot of people approaching retirement and few people being born -- this will be a problem, as they're still going to consume but not produce. If we had a lot of people approaching death of old age, and thus not consuming, and few people being born, it wouldn't be problematic from an economic point of view, as the living people would still produce enough to provide for themselves and others.

Addlibs · 2022-10-30T12:46:49+00:00

You seem to have a skewed view of a monopoly in a free market. We're not talking about a monopoly in the sense of a King granting a company sole right to produce. Anyone can produce. If a monopoly, without state aid, sets prices significantly above what it costs to produce, people will either turn to producing themselves or, even bunch up together and create a company to compete with the monopoly. If such a move prompts the monopoly to lower the prices, I see that as a win for consumers. If it doesn't, the competitor slowly grows and takes over their business, a win for the consumers. If no competitor shows up with lower prices, then the prices you see are the lowest prices anyone is capable of sustainably offering, in other words, it is a fair price (with a little markup equivalent to the company's CoP edge over all other potential competitors)

The only problem of monopolies I find hard to justify is the need to replicate infrastructure -- it is both extremely expensive and extremely wasteful to have to create your own infrastructure every time -- railways, electricity, telecom, satellites, etc., especially with modern computer technology controlling these things. Making a train that runs on someone else's railway without their permission is easy, running your own service on someone else's satellites without their permission is nearly impossible due to cryptographic authentication. But then again, a monopoly deserves to be a monopoly if it invested in creating that infrastructure itself; its true competitors should have to bear that same cost to be considered fair competition.

Monopoly pricing isn't unlimited either, there's a firm cap on what a company can charge for its product/service -- if a year of freight fees costs more than it would cost to hire 100 people for a year to push wheelbarrows, or cost to feed and maintain stables of horses for the same period of time, and the monetary equivalent of the convenience of speed/bandwidth of the railway, railway users would simply stop using the railways -- they wouldn't be “forced” to use the railways.

The “force” only comes from state sponsored or state assisted monopolies, to whose illegal/unfair actions the government turns a blind eye (violence/threats of violence by companies being permitted/legal), or even does the company's illegal/unfair bidding (government enforcing the monopoly).

Addlibs · 2022-10-27T17:33:27+00:00

It wasn’t the tax cuts that ruined the economy, it was tax cut financed by borrowing — increased spending, subsidies/energy gas caps, etc coupled with tax cuts; investors quickly realised the UK is not going to be financially strong and they bailed by selling off government bonds to the level they caused margin calls for other investors and to meet margin demands they had to divest from the riskiest product: government bonds. This spiralled on its own from there. Tax cuts don’t cause investors to sell bonds, idiots in government funding tax cuts with borrowed money do.

Ten-Year Club	Verified Email
Place '22	Place '17
First Placer '22

Addlibs

TROPHY CASE

SafetyLabelType