FLASH
Shkruar nga Pamfleti
The European Union's introduction of a mobile app to check people's age online has proven to be a total failure, after cybersecurity experts discovered obvious privacy and security problems in the code.
European Commission President Ursula von der Leyen unveiled the age verification tool in Brussels on Wednesday, saying it was "technically ready" and would soon be available for use, as countries move to ban children from social media.
"It's completely open source. Anyone can check the code ," von der Leyen said.
Cybersecurity and privacy experts immediately dived into the source code on the software platform GitHub and reported several problems with the application's design.
The saga is turning into a public relations disaster for Brussels. But beneath the controversy over the code are deeper divisions among privacy activists, children's rights groups, tech firms and politicians over how to protect minors online, as leaders vow to shield children from social media and pornographic sites.
Within hours of the app's release by the EU, security consultant Paul Moore discovered that it stored sensitive data on a user's phone and left it vulnerable, he wrote in a widely shared post on X. Moore claimed to have hacked the app in less than 2 minutes.
Baptiste Robert, a prominent French copyright hacker, confirmed many of the problems and told POLITICO that it was possible to bypass the app's biometric authentication features, meaning someone would be able to forgo entering a PIN code or using Touch ID to access the app.
The European Commission on Friday stood by its statement that the app is technically ready. "Yes, it is ready. Maybe we could add, 'and it can always be improved,'" chief spokeswoman Paula Pinho told reporters.
Digital sector spokesman Thomas Regnier said: "Now, when we say it's a final version, it's... still a demo version." He added that the final product is not yet available to citizens and "the code will be constantly updated and improved... I cannot rule out or prejudge today whether further updates will be required or not."
The European Commission on Thursday told POLITICO in a statement that the hackers were investigating an earlier “demo version” of the app that was released for “testing and development purposes.” The vulnerability “has been fixed,” it said.
But both Moore and Blazy said they were conducting their online tests on the latest version of the EU code.
"It's good that they made the app open source for experts to try and test. The problem is that the published source code does not meet the cybersecurity standards that we would expect for such an important app. We were worried that the Commission would rush to launch its app, despite the security issues, and now we can see that it wants to launch something that is not technically ready. Such a rushed launch could undermine trust in digital identity wallets in the future ," Blazy said.
The online debate over the EU application reveals a fierce divide over how internet users' access to everything from porn sites to social media platforms should be handled.
The EU and many of its member states are trying to find ways to check people's ages online — driven by a political push to better protect children online.
French President Emmanuel Macron gathered heads of state from across Europe for a video call on the issue on Thursday evening, attended by von der Leyen, Italy's Giorgia Meloni, Spain's Pedro Sánchez, Germany's Friedrich Merz and other leaders.
The European Commission in 2024 opened a €4 million tender for the age verification app late last year, which was won by Swedish digital identity company Scytáles and Deutsche Telekom.
The app allows users to verify their age via a passport, a national ID or through trusted providers like a bank. Tech platforms can ask the app if a person is over a certain age, but will not have access to more personal data, in what is known as a "zero-knowledge proof" method aimed at preserving privacy.
National governments can equally design their own apps, and the apps are intended to work together to allow for seamless age checks across the bloc.
But critics of age blocking say the technology to check people's ages with proper privacy and data protections simply isn't ready - and even if it were, internet users would easily bypass it with things like virtual private networks (VPNs) that mask their location.
Lini një Përgjigje