this post was submitted on 19 Apr 2026
123 points (93.6% liked)

Europe

11001 readers
980 users here now

News and information from Europe πŸ‡ͺπŸ‡Ί

(Current banner: La Mancha, Spain. Feel free to post submissions for banner images.)

Rules (2024-08-30)

  1. This is an English-language community. Comments should be in English. Posts can link to non-English news sources when providing a full-text translation in the post description. Automated translations are fine, as long as they don't overly distort the content.
  2. No links to misinformation or commercial advertising. When you post outdated/historic articles, add the year of publication to the post title. Infographics must include a source and a year of creation; if possible, also provide a link to the source.
  3. Be kind to each other, and argue in good faith. Don't post direct insults nor disrespectful and condescending comments. Don't troll nor incite hatred. Don't look for novel argumentation strategies at Wikipedia's List of fallacies.
  4. No bigotry, sexism, racism, antisemitism, islamophobia, dehumanization of minorities, or glorification of National Socialism. We follow German law; don't question the statehood of Israel.
  5. Be the signal, not the noise: Strive to post insightful comments. Add "/s" when you're being sarcastic (and don't use it to break rule no. 3).
  6. If you link to paywalled information, please provide also a link to a freely available archived version. Alternatively, try to find a different source.
  7. Light-hearted content, memes, and posts about your European everyday belong in other communities.
  8. Don't evade bans. If we notice ban evasion, that will result in a permanent ban for all the accounts we can associate with you.
  9. No posts linking to speculative reporting about ongoing events with unclear backgrounds. Please wait at least 12 hours. (E.g., do not post breathless reporting on an ongoing terror attack.)
  10. Always provide context with posts: Don't post uncontextualized images or videos, and don't start discussions without giving some context first.

(This list may get expanded as necessary.)

Posts that link to the following sources will be removed

Unless they're the only sources, please also avoid The Sun, Daily Mail, any "thinktank" type organization, and non-Lemmy social media (incl. Substack). Don't link to Twitter directly, instead use xcancel.com. For Reddit, use old:reddit:com

(Lists may get expanded as necessary.)

Ban lengths, etc.

We will use some leeway to decide whether to remove a comment.

If need be, there are also bans: 3 days for lighter offenses, 7 or 14 days for bigger offenses, and permanent bans for people who don't show any willingness to participate productively. If we think the ban reason is obvious, we may not specifically write to you.

If you want to protest a removal or ban, feel free to write privately to the admin that applied the rule (check modlog first to find who was it.)

founded 2 years ago
MODERATORS
 

This is absolutely insane, this supposedly is built to handle our identification and personal information of the whole EU.

https://x.com/Paul_Reviews/status/2044723123287666921

top 10 comments
sorted by: hot top controversial new old
[–] Warl0k3@lemmy.world 49 points 4 days ago* (last edited 4 days ago) (2 children)

Other issues:

  1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying.
  2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.

Oh my god what. Did they let Claude write this? I mean... fucking hell...

[–] jlow@slrpnk.net 30 points 4 days ago (1 children)

At least in Germany you don't need slop to write completely broken government software, we've been doing that for decades.

[–] Ooops@feddit.org 4 points 4 days ago

And afterwards they tell some whiny tale how the people are to blame and cry about those backward Germans opposing digitalisation.

When in reality there is only broken bullshit and so it becomes second nature to avoid it (like for example of course officially objecting to your participation in the new digital medical file years before the roll out... so about a year and a few days before the data of the few who missed it gets leaked).

[–] tempest@lemmy.ca 1 points 3 days ago

Honestly Claude would probably do a better job ....

[–] torik@lemmychan.org 9 points 3 days ago

Remember guys, it's not if there's a data breach, but when.

[–] hendrik@palaver.p3x.de 10 points 4 days ago (1 children)

My first thought was, has someone considered filing a bug report? But boy are the issues and PRs bad. Someone linked the Xitter post, though.

https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui

Dunno what kind of state the project is in. Seems development is very active. Maybe it's more an early tech demo? But they should probably be more upfront, if it is... And not have Ursula announce this is an App?!

And does the EU Wallet App (which it is forked from) contain the same basic design flaws?

[–] Fishnoodle@lemmy.world 3 points 3 days ago* (last edited 3 days ago) (1 children)

I mean, unless there's an advertised and honored bug bounty I wouldn't report it. If you want me to fix your shit software you're going to pay me for it, and pay me well

[–] hendrik@palaver.p3x.de 1 points 3 days ago

Well, in theory it's your software anyway... In case you're an EU citizen.

[–] 4am@lemmy.zip 2 points 3 days ago (1 children)

Not really following this one:

During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory. 1. It shouldn't be encrypted at all - that's a really poor design.

Isn’t the PIN supposed to be a secret? Why would it be bad to encrypt it?

[–] tempest@lemmy.ca 15 points 3 days ago* (last edited 3 days ago)

There is no point to this.

It's a pin, why would you store it at all? Why would you put a password on your password and store it?

edit: Just got those who don't do software development it's considered generally bad practice to store the plain text of a password (encrypted or not).

The correct approach is to run the password through a one way hash algorithm and store the result. The hash algorithm always produces the same result for any given password but it is very difficult to do the reverse and figure out what password was used to generate what result.

So you store the result on your side and when the user submits a password you run it through the same one way hash algo and compare the result with the one you have on file. If they match the password is correct.

Any developer who has ever made baby's first Login should know this stuff it's very basic web development.