7 ms·

8 Out of 10 Banks in Belgium Hate This One Weird EID RCE

21 points by Doohickey-d 1mo ago

PeterStuer 1mo ago
Nice writeup. As a belgian, I do not think I know anyone or any apllication that uses you eID pin. I know you have to create one at the municipality when you collect your id card, but I doubt anyone would ever remember it. ItsMe has universally replaced all scenarios that would have needed an eID with pin, and booting the ItsMe account, while I think you in theory could do it with an eID and reader, I do not think anyone does. I know I have such a reader from a developer conference decades ago from when eID was lauched. Not sure it would even work on 2026 OS'es.
- acorn221 1mo ago
  Thanks! ItsMe actually uses the connective signing ext system to sign users up so it's likely lots of people signed up for itsme with this flow and just never uninstalled the extension and native host.
  - PeterStuer 1mo ago
    Not sure. Do you have numbers? AFAIK having the eID reader was mostly an IT crowd thing. 'Normies' never had them, and even if they did they would have borked on the install.
    - acorn221 1mo ago
      The only numbers I've got right now are the 2M+ weekly active users on the chrome web store listing - I've not got exact numbers for how many people use the card readers but I get the impression it's more common in the legacy enterprise/government world. The 2M+ WAUs would still be vulnerable to the RCE (assuming the native host is setup) independent of whether or not they have a card reader.
netsharc 1mo ago
Is the top image AI slop? It feels like it, and it makes me wary about reading past the TL;DR...
- x______________ 1mo ago
  How are you not sure? There are many inconsistencies in the picture: the feet with no bank face, the randomness of having hands or not for the banks drinking beers, how some of tbose beers are incorrectly held, the magic bottom half-torso on the left side, the hand-held pen-rocket launcher squirted red ink, how that is held in the driver's hand.
  - acorn221 1mo ago
    The thumbnail is ai generated, the content is not. I'm OP here. I can't afford artists to draw all the thumbnails and I'm not going to refrain from using all the tools at my disposal.
- tmtvl 1mo ago
  I'd say it's worth a read, if only to get to the $200 bit.
- SpicyLemonZest 1mo ago
  Having a visual thumbnail is extraordinarily important for clickthrough rate on social media platforms which support them, which is most these days. I don’t think you should prejudge articles for doing what they’ve gotta do to get readers.

21 points by Doohickey-d 1mo ago

Nice writeup. As a belgian, I do not think I know anyone or any apllication that uses you eID pin. I know you have to create one at the municipality when you collect your id card, but I doubt anyone would ever remember it. ItsMe has universally replaced all scenarios that would have needed an eID with pin, and booting the ItsMe account, while I think you in theory could do it with an eID and reader, I do not think anyone does. I know I have such a reader from a developer conference decades ago from when eID was lauched. Not sure it would even work on 2026 OS'es.

acorn221 1mo ago
Thanks! ItsMe actually uses the connective signing ext system to sign users up so it's likely lots of people signed up for itsme with this flow and just never uninstalled the extension and native host.
- PeterStuer 1mo ago
  Not sure. Do you have numbers? AFAIK having the eID reader was mostly an IT crowd thing. 'Normies' never had them, and even if they did they would have borked on the install.
  - acorn221 1mo ago
    The only numbers I've got right now are the 2M+ weekly active users on the chrome web store listing - I've not got exact numbers for how many people use the card readers but I get the impression it's more common in the legacy enterprise/government world. The 2M+ WAUs would still be vulnerable to the RCE (assuming the native host is setup) independent of whether or not they have a card reader.

netsharc 1mo ago

Is the top image AI slop? It feels like it, and it makes me wary about reading past the TL;DR...

x______________ 1mo ago
How are you not sure? There are many inconsistencies in the picture: the feet with no bank face, the randomness of having hands or not for the banks drinking beers, how some of tbose beers are incorrectly held, the magic bottom half-torso on the left side, the hand-held pen-rocket launcher squirted red ink, how that is held in the driver's hand.
- acorn221 1mo ago
  The thumbnail is ai generated, the content is not. I'm OP here. I can't afford artists to draw all the thumbnails and I'm not going to refrain from using all the tools at my disposal.
tmtvl 1mo ago
I'd say it's worth a read, if only to get to the $200 bit.
SpicyLemonZest 1mo ago
Having a visual thumbnail is extraordinarily important for clickthrough rate on social media platforms which support them, which is most these days. I don’t think you should prejudge articles for doing what they’ve gotta do to get readers.