How (Not) To Implement Secure Digital Identity: Study Of Poland's Digital ID System
summary
Shows a server‑side logic flaw that lets a captured, government‑signed ID container be replayed to impersonate someone else; a proof uses a modified app and a custom decryptor to capture live encrypted blobs, stores them (they remain valid for five years) and later injects them via an M hacker tool so a verifier accepts the container. Finds 75% of high‑risk orgs rely on weak visual/functional checks. The attack works cross‑platform and the issue is fixed after responsible disclosure.
AI-written summary · about
chapters (7)
- 0:00Poland's digital ID system intro
- 4:44Misuse of digital ID verification
- 17:54Technical deep dive
- 35:54Cryptographic verification flaw
- 39:28Government response
- 42:24Advice for users & devs
- 42:45Q&A
related talks
27mNew Phone, Who Dis?: Human Authentication in the Digital Age
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research
51mPrivate org & govt perspectives in navigating the tech landscape of remote digital identity proofing
52mFlying Under the Radar - New Security Evasion Techniques
49mContain Yourself: Building Secure Containers for Mobile Devices
31mIdentity Theft: Attacks on SSO Systems
56mUtilizing national IDs in the Ethereum ecosystem
37mThe Living Dead: Hacking Mobile Face Recognition SDKs with Non-Deepfake Attacks