Post

I'll look at this when I get home, on the metro at the moment

Update it's pretty bad, even if just for reflected XSS If someone told me this were a credential harvester and not a supposedly real project that the european commission now runs on I'd believe them

Thanks for checking. It's... it's still there... 😬

such a rookie mistake... This is amateurish @wsocial.eu cc @vonderleyen.ec.europa.eu @president.ecb.europa.eu

As far as I know, they outsourced engineering to war-torn Ukraine because it's likely too expensive to build in the EU. Not that that is necessarily a bad thing; the Ukrainians need all the support they can get.

Outsourcing to Ukraine is perfectly fine IMHO. But you need to handle identity with care no matter what.

the EC could just as easily host their own pds just like they do mastodon :(

I mean, the Commission is running on this. Could it be escalated to make malicious announcements?

Thanks for raising this. Our technical team has reviewed the reported issue. While we do not assess it as posing a risk to user identity data, we take all reports seriously and have already implemented mitigations and additional safeguards.

We appreciate everyone who has taken the time to review the platform and report potential issues. Responsible disclosure helps make the platform stronger. We are building trusted digital infrastructure from Europe for the world. If you believe you can contribute, we’d be happy to hear from you.

Responsible disclosure happens when you have a process that enables it. Your own well-known security file only contained a link to a website that explicitly says not to use the form for sensitive information which a security vulnerability report is.

W Identity (widentity.eu) asks people to hand over passport scans, a biometric selfie and their date of birth to prove who they are. The reflected XSS vulnerability let attacker-controlled JavaScript run on your site's own origin. For an identity provider, your response is way too relaxed.

XSS on a login page means script running where users type credentials and where verification happens - able to read and alter the login form, manipulate the auth flow, and reach whatever the page can reach. Here are some questions I think users deserve an answer for if you want them to trust you:

Ok, here's what I have learned: if it's somehow connected to the EU, ESPECIALLY DO NOT TRUST THEM if they ask for an ID because it will be broken instantly.

Oh, this is true outside the EU as well.

Sounds bad. Could you explain XSS in non technical terms? Cc @crespolop.bsky.social

Sure thing. XSS is cross-site scripting. Basically, by linking you to someone else's site in a specific way I can get code I wrote to execute on that site, which I shouldn't be able to control. If you follow the link that was posted and click login, it shows a silly popup. That's proof.

Disconcerting. I would like to see plurality of providers but it needs to be done properly, especially ones endorsed by officials...

Exactly my point... I don't even think they should be on Eurosky, they should host their own, but no matter what they do it should at least be done competently.

I mean the blame is as much on the @ec.europa.eu IT department as on @wsocial.eu 's tech team (if any?). They should have vetted the system thoroughly first before moving @vonderleyen.ec.europa.eu and others accounts. What a clown show...

@ccc.de