| age verification | 2026-04-15 · NEW:  Appunta · Stampa · Cita: 'Doc 101206' · pdf |
Age verification ready at the best standards. E fa acqua. |
abstract:
Lo diciamo da anni.
Invece quello che leggerete subito qui sotto l'ha scritto una AI di IusOnDemand srl ancora in fase di test:
"Informatico: Allora forse la soluzione è un sistema anonimo di verifica età, tipo un codice generato da una app ufficiale. Non serve raccogliere dati personali, basta che il minore inserisca un codice valido. Così si evita il problema della privacy e si rispetta la legge."
Troppo semplice per la politica ?
Fonte: Paul Moore - Security ConsultantLink: https://x.com/i/status/2044436001611801072
analisi:
-
index:
Indice
- For NFC biometric data:
- For selfie pictures:
- From a #GDPR standpoint:
testo:
Paul Moore - Security Consultant
@Paul_Reviews
@vonderleyen
"The European #AgeVerification app is technically ready. It respects the highest privacy standards in the world. It's open-source, so anyone can check the code..."
I did. It didn't take long to find what looks like a serious #privacy issue.
The app goes to great lengths to protect the AV data AFTER collection (is_over_18: true is AES-GCM'd); it does so pretty well.
But, the source image used to collect that data is written to disk without encryption and not deleted correctly.
For NFC biometric data:
It pulls DG2 and writes a lossless PNG to the filesystem. It's only deleted on success. If it fails for any reason (user clicks back, scan fails & retries, app crashes etc), the full biometric image remains on the device in cache. This is protected with CE keys at the Android level, but the app makes no attempt to encrypt/protect them.
For selfie pictures:
Different scenario. These images are written to external storage in lossless PNG format, but they're never deleted. Not a cache... long-term storage. These are protected with DE keys at the Android level, but again, the app makes no attempt to encrypt/protect them.
This is akin to taking a picture of your passport/government ID using the camera app and keeping it just in case. You can encrypt data taken from it until you're blue in the face... leaving the original image on disk is crazy & unnecessary.
From a #GDPR standpoint:
Biometric data collected is special category data. If there's no lawful basis to retain it after processing, that's potentially a material breach.
Link: https://x.com/i/status/2044436001611801072
Testo del 2026-04-15 Fonte: Paul Moore - Security Consultant
Age verification Minori Identità europea Did