Video yükleniyor...

Video Yüklenemedi

Ana Sayfaya Dön

Relay attacks don't care how cryptographically sound your credentials are. At some point, someone will create a paid service which accepts QR codes and verifies them with a fully autonomous Android phone. 1000 verifications: $1 #EU #AgeVerification #DigitalIdentity #Security

Paul_Reviews's profile picture

Paul Moore - Security Consultant 

17,157 subscribers

130,405 görüntüleme • 1 ay önce •via X (Twitter)

Haberler & Politika#EU#AgeVerification#DigitalIdentity#Security
LIVE

Anya Rossi• Live Now

Private livecam show

9 Yorum

darknessblade profil fotoğrafı
darknessblade1 ay önce

And then hackers will make a free to use version. that has a build in network spoofer, so the app thinks it has internet, so you can just run it locally.

stablestream profil fotoğrafı
stablestream1 ay önce

u have to reverify ur id every some time … and i dont think 11 year olds would even think of relay attacks

Paul Moore - Security Consultant  profil fotoğrafı
Paul Moore - Security Consultant 1 ay önce

No you don't. Tokens are deleted at the client, so an app can reuse them endlessly. Of course, a child won't understand a relay attack... but they can install a chrome extension or Android app.

Robert Foster profil fotoğrafı
Robert Foster1 ay önce

Would this also be bypassable by a child who doesn't have a mobile device? For example, if they installed MEmu and ManyCam on a computer, saved the QR code, and then displayed it through ManyCam so the program mistakenly treated it as a phone scanning the QR code, would that work?

Paul Moore - Security Consultant  profil fotoğrafı
Paul Moore - Security Consultant 1 ay önce

@stablestream Presently, yes.

Gray mind profil fotoğrafı
Gray mind1 ay önce

Well for thay reason if you accept 'QR Code payment settings' are begging to be robbed by someone with free time, same as contactless and NFC phone payment.....

TranslateMom profil fotoğrafı
TranslateMom1 ay önce

Sous-titrage français par ici Sous-titres/traductions: taguez @TranslateMom + la langue. Pour télécharger une vidéo, taguez aussi @TranslateMom. L'app TranslateMom est maintenant sur iPhone:

Yves 🐞 profil fotoğrafı
Yves 🐞1 ay önce

@TranslateMom français

Les Rectificateurs profil fotoğrafı
Les Rectificateurs1 ay önce

Excellent business idea! 💡

Benzer Videolar

Bypassing #EU #AgeVerification using their own infrastructure. I've ported the Android app logic to a Chrome extension - stripping out the pesky step of handing over biometric data which they can leak... and pass verification instantly. Step 1: Install the extension Step 2: Register an identity (just once) Step 3: Continue using the web as normal The extension detects the QR code, generates a cryptographically identical payload and tells the verifier I'm over 18, which it "fully trusts". This isn't a bug... it's a fundamental design flaw they can't solve without irrevocably tying a key to you personally; which then allows tracking/monitoring. Of course, I could skip the enrolment process entirely and hard-code the credentials into the extension... and the verifier would never know.
1:14

Bypassing #EU #AgeVerification using their own infrastructure. I've ported the Android app logic to a Chrome extension - stripping out the pesky step of handing over biometric data which they can leak... and pass verification instantly. Step 1: Install the extension Step 2: Register an identity (just once) Step 3: Continue using the web as normal The extension detects the QR code, generates a cryptographically identical payload and tells the verifier I'm over 18, which it "fully trusts". This isn't a bug... it's a fundamental design flaw they can't solve without irrevocably tying a key to you personally; which then allows tracking/monitoring. Of course, I could skip the enrolment process entirely and hard-code the credentials into the extension... and the verifier would never know.

Paul Moore - Security Consultant 

1,182,258 görüntüleme • 5 ay önce

Unlimited agent access is a security problem. Scoped credentials are the fix. James Lawton, Head of DevRel at Polygon, on onchain mandates that cap what an agent can spend, where, and for how long, issued by banks and fintechs, and verified cryptographically to block prompt injection and other attacks. You don't have to trust an agent's reasoning if you can verify its limits. Brought to you by Wrapped and Real Motion
1:10

Unlimited agent access is a security problem. Scoped credentials are the fix. James Lawton, Head of DevRel at Polygon, on onchain mandates that cap what an agent can spend, where, and for how long, issued by banks and fintechs, and verified cryptographically to block prompt injection and other attacks. You don't have to trust an agent's reasoning if you can verify its limits. Brought to you by Wrapped and Real Motion

Real Motion

11,218 görüntüleme • 22 gün önce

Hacking the #EU #AgeVerification app in under 2 minutes. During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory. 1. It shouldn't be encrypted at all - that's a really poor design. 2. It's not cryptographically tied to the vault which contains the identity data. So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app. After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid. Other issues: 1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying. 2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step. Seriously Ursula von der Leyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.
2:13

Hacking the #EU #AgeVerification app in under 2 minutes. During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory. 1. It shouldn't be encrypted at all - that's a really poor design. 2. It's not cryptographically tied to the vault which contains the identity data. So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app. After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid. Other issues: 1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying. 2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step. Seriously Ursula von der Leyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.

Paul Moore - Security Consultant 

3,410,223 görüntüleme • 5 ay önce

The size and abundance of lethal sharks at Australian beaches are out of control. Some people don't care because the ocean is "the shark's home". Politicians avoid the issue, despite the constantly increasing attacks. Is this the new normal? I am an independent journalist, author and filmmaker creating content defending and celebrating our awesome country and culture. Your support helps me create more content like this. Please become a free or paid subscriber at or drop me some spare change at
1:32

The size and abundance of lethal sharks at Australian beaches are out of control. Some people don't care because the ocean is "the shark's home". Politicians avoid the issue, despite the constantly increasing attacks. Is this the new normal? I am an independent journalist, author and filmmaker creating content defending and celebrating our awesome country and culture. Your support helps me create more content like this. Please become a free or paid subscriber at or drop me some spare change at

Fred Pawle

23,592 görüntüleme • 11 ay önce

A woman who died in 2012 was given credit for voting in the Fulton County General Election in 2023. Fulton County stated it was because of "redistricting issues." Someone please explain how someone who died well over a decade ago, voted in the 2023 GA Election, and how it has ANYTHING to do with a "redistricting issue?" This is why they don't want to purge or for you to even see the dirty voter rolls. They need dead voters to produce fake votes. On top of that, QR codes are printed on ballots that YOU can't read. Once you make a selection on the screen, a ballot is printed out with a QR code on it, which contains your selection. If the system is altered, you can have the QR code be printed for whatever candidate you choose and the voter would never know. The QR codes are easily able to be copied as well. How long has Fulton County been rigging elections? No wonder they didn't want us to have the ballots, erased the logs, and original ballot images.
1:43

A woman who died in 2012 was given credit for voting in the Fulton County General Election in 2023. Fulton County stated it was because of "redistricting issues." Someone please explain how someone who died well over a decade ago, voted in the 2023 GA Election, and how it has ANYTHING to do with a "redistricting issue?" This is why they don't want to purge or for you to even see the dirty voter rolls. They need dead voters to produce fake votes. On top of that, QR codes are printed on ballots that YOU can't read. Once you make a selection on the screen, a ballot is printed out with a QR code on it, which contains your selection. If the system is altered, you can have the QR code be printed for whatever candidate you choose and the voter would never know. The QR codes are easily able to be copied as well. How long has Fulton County been rigging elections? No wonder they didn't want us to have the ballots, erased the logs, and original ballot images.

The SCIF

63,562 görüntüleme • 2 ay önce

BREAKING: Trump is STANDING FIRM against Schumer and has no fear of a government shutdown, because it will be THEIR FAULT! "I think we could very well end up with a closed country for a period of time. We’ll take care of the military and take care of Social Security, we’ll take care of the things we have to take care of." "A lot of the things the Democrats fight for, which are not very good things, are not going to be able to be paid, and we’ll watch and see how they do with that" He is calling their bluff.
4:31

BREAKING: Trump is STANDING FIRM against Schumer and has no fear of a government shutdown, because it will be THEIR FAULT! "I think we could very well end up with a closed country for a period of time. We’ll take care of the military and take care of Social Security, we’ll take care of the things we have to take care of." "A lot of the things the Democrats fight for, which are not very good things, are not going to be able to be paid, and we’ll watch and see how they do with that" He is calling their bluff.

Gunther Eagleman™

1,447,508 görüntüleme • 1 yıl önce

U.S. Transportation Secretary Sean Duffy at the first autonomous vehicle safety forum today: “A lot of our top innovators from Waymo, Zoox and Tesla are here, and we're going to have a day long conversation; If you have an autonomous vehicle, do you need a steering wheel? We have to rethink some of our requirements, especially for autonomous vehicles, which will allow them to bring down price, maintain the safety structure, but move forward and be competitive with the rest of the world."
1:52

U.S. Transportation Secretary Sean Duffy at the first autonomous vehicle safety forum today: “A lot of our top innovators from Waymo, Zoox and Tesla are here, and we're going to have a day long conversation; If you have an autonomous vehicle, do you need a steering wheel? We have to rethink some of our requirements, especially for autonomous vehicles, which will allow them to bring down price, maintain the safety structure, but move forward and be competitive with the rest of the world."

Sawyer Merritt

135,458 görüntüleme • 6 ay önce

Combat Progression (WIP) Knights Path is a fully-fledged RPG focused on creating a deeply satisfying and rewarding sense of progression. The combat will evolve and become more complex with each skill level. In the video, we are showcasing only light attacks. You can also increase your speed and finesse by perfecting the timing of each strike. You won’t need to look at levels or icons to know how strong someone is. Just look at their armor, how they hold their sword, and how they move - you’ll immediately recognize how big of a threat your opponent is.
0:26

Combat Progression (WIP) Knights Path is a fully-fledged RPG focused on creating a deeply satisfying and rewarding sense of progression. The combat will evolve and become more complex with each skill level. In the video, we are showcasing only light attacks. You can also increase your speed and finesse by perfecting the timing of each strike. You won’t need to look at levels or icons to know how strong someone is. Just look at their armor, how they hold their sword, and how they move - you’ll immediately recognize how big of a threat your opponent is.

Knight's Path

40,441 görüntüleme • 11 ay önce

We don't use Kotak, otherwise we would have showed on Kotak. How can someone display Big MTM and significant profits with just an API? Look at the name as well. The only reliable method is to log in from a random laptop and verify whether the person is authentic or not. This is the only way. Request credentials and verify authenticity. If they don't provide them, you'll have your answer
0:37

We don't use Kotak, otherwise we would have showed on Kotak. How can someone display Big MTM and significant profits with just an API? Look at the name as well. The only reliable method is to log in from a random laptop and verify whether the person is authentic or not. This is the only way. Request credentials and verify authenticity. If they don't provide them, you'll have your answer

zubarekhan

519,295 görüntüleme • 3 yıl önce

NEWS: Tesla has introduced an updated Robotaxi website, a clear sign that expansion is coming soon. “We’re bringing autonomous rides to you today—starting with Model Y. Autonomous Robotaxi rides are currently being offered in Austin, Texas. To get started, download the Robotaxi app. Cybercab, our purpose-built fully autonomous vehicle, will offer rides in your area in the future. We are building an autonomous future that is accessible to all people. Our Robotaxi vehicles are designed to support various accessibility needs including space for service animals and room to store some wheelchairs and other assistive devices. The Tesla app is currently available in 29 languages, with more being added.”
1:08

NEWS: Tesla has introduced an updated Robotaxi website, a clear sign that expansion is coming soon. “We’re bringing autonomous rides to you today—starting with Model Y. Autonomous Robotaxi rides are currently being offered in Austin, Texas. To get started, download the Robotaxi app. Cybercab, our purpose-built fully autonomous vehicle, will offer rides in your area in the future. We are building an autonomous future that is accessible to all people. Our Robotaxi vehicles are designed to support various accessibility needs including space for service animals and room to store some wheelchairs and other assistive devices. The Tesla app is currently available in 29 languages, with more being added.”

Sawyer Merritt

164,265 görüntüleme • 9 ay önce

A caller tried asking our list of questions about socialism to her son. Instead of a screaming match, it led to a two-hour breakthrough for both of them. Socialism will likely be a big talking point this school year. So, whether your kids are flirting with socialism themselves or just hearing from friends who are, don't let them walk into their classrooms unprepared. Help them actually understand how to think about these ideas before someone else defines the "truth" for them.
3:01

A caller tried asking our list of questions about socialism to her son. Instead of a screaming match, it led to a two-hour breakthrough for both of them. Socialism will likely be a big talking point this school year. So, whether your kids are flirting with socialism themselves or just hearing from friends who are, don't let them walk into their classrooms unprepared. Help them actually understand how to think about these ideas before someone else defines the "truth" for them.

Glenn Beck

92,548 görüntüleme • 1 ay önce

The media spent days pushing headlines about a Trump-Netanyahu “feud” — which should sound reassuring, until you realize these stories always seem to surface right before another escalation. This is how the public gets gaslit: pretend Washington and Tel Aviv are headbutting — and right on cue, the US violates the ceasefire and attacks Iran again. At some point, people have to stop falling for it.
1:36

The media spent days pushing headlines about a Trump-Netanyahu “feud” — which should sound reassuring, until you realize these stories always seem to surface right before another escalation. This is how the public gets gaslit: pretend Washington and Tel Aviv are headbutting — and right on cue, the US violates the ceasefire and attacks Iran again. At some point, people have to stop falling for it.

Rick Sanchez

21,665 görüntüleme • 3 ay önce

Big Ben on Will Howard: “you're giving Will Howard a chance. I know there's some people out there on the radio and stuff that are just totally against him and I don't get it. How can you be against someone you've never seen play at this level.” 🎥 Footbahlin with Ben Roethlisberger
1:19

Big Ben on Will Howard: “you're giving Will Howard a chance. I know there's some people out there on the radio and stuff that are just totally against him and I don't get it. How can you be against someone you've never seen play at this level.” 🎥 Footbahlin with Ben Roethlisberger

Matthew Luciow

129,927 görüntüleme • 6 ay önce

Please 🇳🇬 don't see every Northerner as a bandits. "Sunday Igboho’s Iru Ekun Security Network claimed they captured some suspected bandits who fired back at them" *My Questions * (1) How did they know they are the ones that fired back at them ? (2) They said they caught them with knives , so they fired at them with knives? (3) Reference to the video, nothing criminality was found on them , so they think bandits can be captured that easily ?
2:09

Please 🇳🇬 don't see every Northerner as a bandits. "Sunday Igboho’s Iru Ekun Security Network claimed they captured some suspected bandits who fired back at them" *My Questions * (1) How did they know they are the ones that fired back at them ? (2) They said they caught them with knives , so they fired at them with knives? (3) Reference to the video, nothing criminality was found on them , so they think bandits can be captured that easily ?

The Crusader

313,597 görüntüleme • 2 ay önce

Elon Musk on Russia: We were never at any point selling Starlink to Russians. They got Starlink units they ordered through Ukraine and then smuggled them into eastern Ukraine, where Russians are. They were using them, in some cases, for attacks. In order to address this, we worked with the Ukrainian government to create a whitelist of approved Starlink terminals. This has some downsides because a whole bunch of innocent people who used Starlink for work or education now don't have Starlink. Source: The Economist
1:14

Elon Musk on Russia: We were never at any point selling Starlink to Russians. They got Starlink units they ordered through Ukraine and then smuggled them into eastern Ukraine, where Russians are. They were using them, in some cases, for attacks. In order to address this, we worked with the Ukrainian government to create a whitelist of approved Starlink terminals. This has some downsides because a whole bunch of innocent people who used Starlink for work or education now don't have Starlink. Source: The Economist

Military Summary

12,949 görüntüleme • 1 ay önce

Elon Musk on Russia: We were never at any point selling Starlink to Russians. They got Starlink units they ordered through Ukraine and then smuggled them into eastern Ukraine, where Russians are. They were using them, in some cases, for attacks. In order to address this, we worked with the Ukrainian government to create a whitelist of approved Starlink terminals. This has some downsides because a whole bunch of innocent people who used Starlink for work or education now don't have Starlink. Source: The Economist
1:14

Elon Musk on Russia: We were never at any point selling Starlink to Russians. They got Starlink units they ordered through Ukraine and then smuggled them into eastern Ukraine, where Russians are. They were using them, in some cases, for attacks. In order to address this, we worked with the Ukrainian government to create a whitelist of approved Starlink terminals. This has some downsides because a whole bunch of innocent people who used Starlink for work or education now don't have Starlink. Source: The Economist

Clash Report

93,206 görüntüleme • 1 ay önce

Google engineer, Jeff Dean: "You can delete your IDE at this point, you don't need it anymore. In 2026 if you are still not building AI agents, it's crazy how far behind you are. At Google, 85% of engineers are running agentic "loops" and graphs, that's how the engineering setup will look" In a 40 minutes, an ex Google engineer with 26 years of experience reveals how AI engineering will look like in 2026. Worth more than 10 paid agentic courses. Watch it today, then save the exact setup in the article below👇
41:59

Google engineer, Jeff Dean: "You can delete your IDE at this point, you don't need it anymore. In 2026 if you are still not building AI agents, it's crazy how far behind you are. At Google, 85% of engineers are running agentic "loops" and graphs, that's how the engineering setup will look" In a 40 minutes, an ex Google engineer with 26 years of experience reveals how AI engineering will look like in 2026. Worth more than 10 paid agentic courses. Watch it today, then save the exact setup in the article below👇

darkzodchi

258,701 görüntüleme • 28 gün önce