New Phone, Who Dis: Human Authentication in the Digital Age
summary
Reverse-engineering the New South Wales digital licence app reveals a QR payload of three base64 sections, a double base64 header with a missing expiry check that initially lets a pasted QR be valid forever, and an API that verifies codes server-side on every scan. Building a modified APK displays forged details locally, proving visual checks are meaningless unless backed by the server. Fixes add the expiry into the signed header and show the holder’s name; remaining risks include retained Android permissions, beacon tracking ideas and centralized logging.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:59Agenda
- 3:45Identity Documents
- 10:29Positives
- 12:16Negatives
- 12:51What if...?
- 14:37What about...?
- 26:38First Section
- 27:48Second Section
- 28:25Third Section
- 34:04Conclusion
related talks
27mNew Phone, Who Dis?: Human Authentication in the Digital Age
24mRecent Mobile App Security Incidents from Real-World Cases
45mI just hacked your app!
07mI just hacked your app!
39mHow to Not Lose Your Identity in 2035
37mThe Living Dead: Hacking Mobile Face Recognition SDKs with Non-Deepfake Attacks
30mAndroid FakeID Vulnerability Walkthrough
24mCracking open the COVIDSafe