w3ll_w3ll_w3ll

Nice video!

NFC (EMV Mode) is partially encrypted and much more secure than magnetic stripe

"The magnetic stripe will start to disappear in 2024 from Mastercard payment cards in regions, such as Europe, where chip cards are already widely used. Banks in the U.S. will no longer be required to issue chip cards with a magnetic stripe, starting in 2027.

By 2029, no new Mastercard credit or debit cards will be issued with a magnetic stripe. Prepaid cards in the U.S. and Canada are currently exempt from this change."

Do you have more information on how Germany deliberately borked the encryption ecosystem?

Yes it will be a long time until we are able to change this old habits.

But you can put it another way: if someone commit am identity fraud using a picture of your ID, you can defend yourself showing that you were required by many different entities to send a copy of your ID. So there are many parties that could have leaked your ID and a picture of you ID cannot be considered a prove that you authorized or allowed anything.

Case dismissed :)

Authentication and digital signatures (like for signing contracts) are usually kept separate on electronic cards. There are already standards for that.

Most newly issued identity cards in Europe work that way. They have a private key stored in the chip, that can be used to prove identity, without giving the ability to the other party to impersonate the citizen.

Unfortunately most places still check these type of cards visually, but I hope that electronic verification will become more common in a few years.

For example these cards can be checked very easily simply using an NFC Android phone and the right app.

In US for something similar you can look at ICAO passports and Enhanced driver's license,

In Italy the new ID card (issued from 2015 onwards) has NFC capabilities. It contains key attributes (including the picture) that can be read via NFC signed from governament PKI. Some information can be unlocked using a code printed on it, some using the private PIN given to the citizien, and some other only from police/governament.

Some innovative use cases could be using the ID also as a gym card or as transportation card.

I think in OP case the app is not phoning home. The data are still in his pc, but he would like to export it in another format. I don't think GDPR applies here, but I am not an expert.

Well, Enel has a strong presence in Italy, Spain and Latin America. It's actually the second largest power company in the world after China's state company. It was the first company to use smart meters in 2001.

But yeah, you don't see that from Italy.

If the DNS query is done with DoT or DoH the server name is not exposed.

Never give up

Italian digital team has a similar website. https://designers.italia.it/

But I believe believe most Italian agencies or local governments (around 22,000) don't follow those guidelines yet.

"all this stuff is outsourced to consultancy firms that deliver unresponsive, buggy sites for absurdly high prices." it's a good description for MOST (not all) Italian Government web presence.

A trivial thing that would became a mess really fast on a complex website.

A new subdomain for every different "website" is the clean solution in my opinion.

Not if the resolver is validating the tls certificate. That's the point of doh, make impossible to intercept dns query.

I don't think Microsft Edge embeds its own root store on Android.

Or they could pay workers with privileged access more.

Yes they allow debit, but the other party should acquire some sort of authorization from you, even if the requirements are not strong.

The typical use case: you want to allow recurrent payment for your electric bill. You login in with your credentials on the electric company website, then you give them your IBAN and you press a button to accept the terms and authorize them. The company then checks that the name on your bill is the same as the name linked to your bank account and that's it, they are allowed to charge you.

I know that it does not seem secure, but the rate of fraud is really low, at least in my country:

- your bank send you a notification when some company activate a recurrent debit scheme on you account;

- you can see some days in advance on your home banking what you are being debited, and you can freely cancel the charge up to 8 weeks after it happened, for any reason. The chargeback is automatic;

- you have 13 month to ask for a chargeback if you believe you did not give authorization, and is the company that must prove that you really authorize them. The chargeback is automatic;

- to enable the scheme the company has to go through their bank, and the bank is responsible for the chargeback if the company does not pay. So only big and medium business are usually enabled by their banks, because they don't want chargebacks;

This method is actually used by many countries, most of them in Africa, where thanks to MPESA and such the need of protection against SIM swapping is even higher, since your SIM is literally your bank account.

https://www.wired.com/story/sim-swap-fix-carriers-banks/

"The SIM Swap Fix That the US Isn't Using While foreign phone carriers are sharing data to stop SIM swap fraud, US carriers are dragging feet."

I'm afraid the solution cannot be simple, not only because the trust problem is not so simple, but because the nature of the problem is political, not technical. And so the solution must be political (CA/B forum, ballots, convoluted documents, processes for misbehaving entities).

Most people probably didn't pin the certificate. I think that the problem was caused by developers configuring their application to trust only the DigiCert Root CA.

This usually happens beacuse some applications don't use by default the root CA bundle of the underlying OS to authenticate TLS connections, but require you to put each Root CA certificate in a trust store (ex. Java).

Some devs probably added just the Digicert root CA and forgot about it.

These kind of changes with certificate are always kind of tricky, because they usually work very reliably until they don't.

Yeah it's the water.

https://medium.com/@sonicaghi/why-is-espresso-in-america-so-...

"The Eternal Mainframe"

http://www.winestockwebdesign.com/Essays/Eternal_Mainframe.h...