3 ms·

Oh god that’s pretty bad > The documents were hosted by systems used by cannabis clubs and a company called Nefos, which operates PuffPal, a platform that mana

by dgellow 4mo ago

Oh god that’s pretty bad > The documents were hosted by systems used by cannabis clubs and a company called Nefos, which operates PuffPal, a platform that manages membership and age verification for cannabis retailers and clubs across Europe. The infrastructure storing these identity documents—full passport scans, driver’s licenses with photos, names, and identifying numbers—was left completely unprotected on publicly accessible web servers. I cannot imagine the level of fines under GDPR for leaking that much PII

real_chudson 4mo ago
The EU's verification laws will ensure much more of these leaks in the future, and therefore much more fines
- dgellow 4mo ago
  Yep… not sure about more fines, but for sure more leaks
- Kuinox 4mo ago
  How so, are you purely speculating or you found a hole in the zero knowledge proof system some countries are implementing ?
  - 2748484848 4mo ago
    [dead]
  - raron 4mo ago
    It is not using ZKP. Zero knowledge proof is mentioned as an optional experimental feature in the next release. https://ageverification.dev/av-doc-technical-specification/docs/architecture-and-technical-specifications/#7-experimental-features https://ageverification.dev/av-doc-technical-specification/d...
    - Kuinox 4mo ago
      The specs are for the pilot phase. The faq and other documents state that it will be using ZPK. There is already multiple tech proof of concept, ie: https://github.com/eu-digital-identity-wallet/av-lib-android-zkp-age-icao https://github.com/eu-digital-identity-wallet/av-lib-android...
- forestry 4mo ago
  Is it requirement to retain the documents? Many are waiting for gatekeeper tech companies to organise around attestation rather than submission to third parties. I hope they are making progress.
- TacticalCoder 4mo ago
  I had to receive a letter from France (I'm not french, I don't live in France, but we've got family real estate there). To be able to open this letter, online (!), I had to scan my EU ID card, tilt it, and scan my face (pointing at the camera, looking to the left, etc.). We're talking about a major french institution here, either public or private but colluding with the government to have their monopoly (don't know, don't care: they're all the same worms to me). Speaking of which... There's been a recent case in France where a very nice lady working for some public institution (basically the IRS) was giving the name/wealth of "targets" to her brother so that her brother and his friends could go and kidnap/torture (fingers of victims have been cut) family members of rich french persons. It's sickening and the real culprits are those creating the laws mandating this full on surveillance apparatus.
  - axus 4mo ago
    The governments want to retain their abilities to target people for kidnapping/finger-lopping.
- ExoticPearTree 4mo ago
  > The EU's verification laws will ensure much more of these leaks in the future, and therefore much more fines So its a feature, not a bug and a clever revenue stream for the governments?
voakbasda 4mo ago
Show me the consequences. I hear there are supposed to be repercussions, but these asshats never seem to pay for their crimes.
hahahaa 4mo ago
Why can't verification simply be go to post office, clerk will affadavit that you presented correct ID via online form. Which could also do the photo lookup for good measure. Store that fact in the computer. Good for one ID usage. Good for less critical stuff like this weed thing (versus say a visa application which may need to store). The analogy is a nightclub bouncer checks your ID.
- simoncion 4mo ago
  > The analogy is a nightclub bouncer checks your ID. ...the obvious thing to deploy is a cannabis club bouncer that checks your ID with only his eyes and hands and either bounces you or lets you in, depending on the outcome of that check. That's far simpler than involving some unrelated third party and far more secure than storing any information about the event in any computer.

by dgellow 4mo ago

real_chudson 4mo ago

The EU's verification laws will ensure much more of these leaks in the future, and therefore much more fines

dgellow 4mo ago
Yep… not sure about more fines, but for sure more leaks
Kuinox 4mo ago
How so, are you purely speculating or you found a hole in the zero knowledge proof system some countries are implementing ?
- 2748484848 4mo ago
  [dead]
- raron 4mo ago
  It is not using ZKP. Zero knowledge proof is mentioned as an optional experimental feature in the next release. https://ageverification.dev/av-doc-technical-specification/docs/architecture-and-technical-specifications/#7-experimental-features https://ageverification.dev/av-doc-technical-specification/d...
  - Kuinox 4mo ago
    The specs are for the pilot phase. The faq and other documents state that it will be using ZPK. There is already multiple tech proof of concept, ie: https://github.com/eu-digital-identity-wallet/av-lib-android-zkp-age-icao https://github.com/eu-digital-identity-wallet/av-lib-android...
forestry 4mo ago
Is it requirement to retain the documents? Many are waiting for gatekeeper tech companies to organise around attestation rather than submission to third parties. I hope they are making progress.
TacticalCoder 4mo ago
I had to receive a letter from France (I'm not french, I don't live in France, but we've got family real estate there). To be able to open this letter, online (!), I had to scan my EU ID card, tilt it, and scan my face (pointing at the camera, looking to the left, etc.). We're talking about a major french institution here, either public or private but colluding with the government to have their monopoly (don't know, don't care: they're all the same worms to me). Speaking of which... There's been a recent case in France where a very nice lady working for some public institution (basically the IRS) was giving the name/wealth of "targets" to her brother so that her brother and his friends could go and kidnap/torture (fingers of victims have been cut) family members of rich french persons. It's sickening and the real culprits are those creating the laws mandating this full on surveillance apparatus.
- axus 4mo ago
  The governments want to retain their abilities to target people for kidnapping/finger-lopping.
ExoticPearTree 4mo ago
> The EU's verification laws will ensure much more of these leaks in the future, and therefore much more fines So its a feature, not a bug and a clever revenue stream for the governments?

voakbasda 4mo ago

Show me the consequences. I hear there are supposed to be repercussions, but these asshats never seem to pay for their crimes.

hahahaa 4mo ago

Why can't verification simply be go to post office, clerk will affadavit that you presented correct ID via online form. Which could also do the photo lookup for good measure. Store that fact in the computer. Good for one ID usage. Good for less critical stuff like this weed thing (versus say a visa application which may need to store). The analogy is a nightclub bouncer checks your ID.

simoncion 4mo ago
> The analogy is a nightclub bouncer checks your ID. ...the obvious thing to deploy is a cannabis club bouncer that checks your ID with only his eyes and hands and either bounces you or lets you in, depending on the outcome of that check. That's far simpler than involving some unrelated third party and far more secure than storing any information about the event in any computer.