Relay attacks don't care how cryptographically sound your credentials are. At some point, someone will create a paid service which accepts QR codes and verifies them with a fully autonomous Android phone. 1000 verifications: $1 #EU #AgeVerification #DigitalIdentity #Security

And then hackers will make a free to use version. that has a build in network spoofer, so the app thinks it has internet, so you can just run it locally.

u have to reverify ur id every some time … and i dont think 11 year olds would even think of relay attacks

No you don't. Tokens are deleted at the client, so an app can reuse them endlessly. Of course, a child won't understand a relay attack... but they can install a chrome extension or Android app.

Would this also be bypassable by a child who doesn't have a mobile device? For example, if they installed MEmu and ManyCam on a computer, saved the QR code, and then displayed it through ManyCam so the program mistakenly treated it as a phone scanning the QR code, would that work?

@stablestream Presently, yes.

Well for thay reason if you accept 'QR Code payment settings' are begging to be robbed by someone with free time, same as contactless and NFC phone payment.....

Sous-titrage français par ici Sous-titres/traductions: taguez @TranslateMom + la langue. Pour télécharger une vidéo, taguez aussi @TranslateMom. L'app TranslateMom est maintenant sur iPhone:

@TranslateMom français

Excellent business idea! 💡