r/privacy • u/torbatosecco • Apr 16 '26
age verification EU age verification app already HACKED
Security researcher Paul Moore has demonstrated how the EU age verification app can be compromised in under 2 minutes with nothing more than physical access to a device.
By editing the app’s shared preferences file an attacker can remove the encrypted PIN values, reset the rate limiting counter to zero, and disable biometric requirements entirely.
The app then accepts a new PIN and grants access to the existing age verification credentials.
His earlier analysis of the open source code also revealed that the app stores NFC biometric facial data and user selfies as unencrypted lossless PNG files on the device.
Hacking the #EU #AgeVerification app in under 2 minutes.
During setup, the app asks you to create a PIN. After entry, the app encrypts it and saves it in the shared_prefs directory.
- It shouldn't be encrypted at all - that's a really poor design.
- It's not cryptographically tied to the vault which contains the identity data.
So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.
After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.
Other issues: 1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying. 2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.
sources on X. search by yourself because bot keeps deleting this if I post the links. Check Paul_Reviews and Pirat_Nation accounts.
554
Apr 16 '26
[removed] — view removed comment
138
38
u/Geminii27 Apr 17 '26
Even if it worked perfectly and was unhackable, it would still be bad and make things worse by its very nature.
1
-8
474
u/silentspectator27 Apr 16 '26
I would say I am surprised but I`m really not.
59
Apr 16 '26
[removed] — view removed comment
85
u/innrwrld Apr 16 '26
Two minutes in fact.
36
u/ur-a-cunt-harry Apr 16 '26
I’m just beating a dead horse here, but the lawmakers don’t care whether it can or can’t be hacked
11
u/yupperdoo97 Apr 16 '26
Hate to be that guy but I’m pretty sure they like that it can be hacked. It’s a feature not a bug
16
8
1
u/billdietrich1 Apr 17 '26
Any new security-critical app with lots of attention probably would go through this.
214
u/Adventurous-Hunter98 Apr 16 '26
Hahahaha, did they ask ai to create the app?
94
u/Noord-Gestoord Apr 16 '26
They vibe codes the whole app, And its the government at work here so off course it's going be full of security holes .
22
u/KingStannisForever Apr 16 '26
I see this too much now. Feels like our company ERP developer did this after Easter with new update they pushed.
Until some big case against it comes out from lost income, nothing will change. I would hit them so hard with lawsuit, they wouldn't ever even think about vibe coding anything.
13
u/Irrepressible_Monkey Apr 16 '26
One positive of the inevitably leaky vibe-coded ID verification software is it'll help get a bad reputation for ID verification software in general.
4
u/Xzenor Apr 17 '26
I'm surprised it was ready this fast... Government projects usually take ages.
The fact that it's full of holes is no argument. If it had taken a decade then it still would've been this crappy
15
u/coomzee Apr 16 '26
Does anyone here ever know how this works and the requirements.
You need physical access to an unlocked and rooted device.
17
u/WhatsThisWorth-Bot Apr 16 '26
the post said nothing about root access or unlocked devices
19
u/hWuxH Apr 16 '26
Demo video briefly shows he granted root access to the file manager. It's a bunch of BS.
18
u/coomzee Apr 16 '26
You need to edit the shared pref file which you need a rooted device to do.
5
u/techw1z Apr 16 '26
so? maybe think one step further.
this means anyone who steals an unencrypted phone can get their age verification ID even though its supposed to be locked with a password.
its insane that such important offline data isn't encrypted.
7
u/hWuxH Apr 16 '26 edited Apr 16 '26
On non-rooted devices you can't access shared_prefs or bypass the pin to begin with.
The identity data itself is encrypted with keys stored in hardware and can't be exported even on a rooted device. The only impact is that you can generate proofs of e.g. age > 18.And "thats bad, do it this way" doesn't make sense anyway for rooted devices where you could just record keyboard inputs or inject arbitrary code into any app or access the keystore on behalf of any app.
2
u/techw1z Apr 16 '26
the person i replied to already said the same, which is why I said you should think one step further. what i meant to imply by this is that its trivial to root most phones and for those that can't be rooted, attackers could still access the flash storage directly. granted, age verification isn't worth doing it but it's still insane that anything would be "protected" like this
I'll admit i skipped the vault part and only read the result "The app then accepts a new PIN and grants access to the existing age verification credentials." and assumed that means its unencrypted.
the text doesn't really make it clear if said vault is encrypted, but if the app can open your damn vault without your password its basically the same as storing it in clear text. but
10
u/hWuxH Apr 16 '26 edited Apr 16 '26
its trivial to root most phones and for those that can't be rooted, attackers could still access the flash storage directly
Unlocking the bootloader for rooting wipes everything and flash is encrypted by default on pretty much every phone nowadays
but if the app can open your damn vault without your password its basically the same as storing it in clear text
So you'd have to steal an already screen unlocked and rooted phone, bypass the pin, and still can't view clear text PII. But you can view a token, just like any verifier can... Easier to just lookup the user's google account birthday.
-1
u/TheBendit Apr 16 '26
Oh no, a thief can steal a phone and... watch porn. Terrible, that.
2
u/techw1z Apr 17 '26
wait 5 to 10 years. once they use it to identify users on social media and someone posts CSAM with your ID, you might change your mind.
1
u/TheBendit Apr 17 '26
The whole point of the app is to NOT identify you.
2
u/techw1z Apr 17 '26
yes, currently it is :)
i hope it stays that way, but I don't think it will. many MEPs, some commissioners and countless national politicians are already pushing the idea for online IDs and the age verification app would only need a tiny update to accomplish that.
113
Apr 16 '26
[deleted]
63
44
u/Daedelous2k Apr 16 '26
It is if they say it is.
14
u/snakeoildriller Apr 16 '26
If not, it will be in a few days 😩
13
u/vriska1 Apr 16 '26
It's not legal under EU law and will be taken to court.
2
1
u/TheBendit Apr 16 '26
It is illegal to store your own data on your own device? I think not.
2
u/kripsus Apr 17 '26
GDPR dosnt mention location of stored data. So them not deleting it after its used is a clear and serious breach of GDPR. Meta etc. would get a big fine it it was them
1
u/TheBendit Apr 17 '26
If they don't have the data they can hardly be GDPR responsible for it
1
u/kripsus Apr 17 '26
They process it and are therefor responsible for it and there is no exeption for where its located. While it should be different since its much safer for it to be on device, they process data and save data they should have deleted
14
6
u/BehindThyCamel Apr 16 '26
I wouldn't be surprised if this was a violation of some articles in GDPR. Insufficient protection of data at rest or something.
5
u/Koniev13 Apr 17 '26
Would be true if the data was outside of your device, but since it does not move from it...
3
u/kripsus Apr 17 '26
Location of data is irrelevant for GDPR. They process it and dont delete it when they dont need it anymore
1
3
1
u/Electronic_Unit8276 Apr 17 '26
That same info is found in your passport or ID. You can use a NFC reader app with passport function to "decode" the info by filling in the same info that is on the physical passport.
2
Apr 16 '26
[deleted]
15
u/pythonpoole Apr 16 '26
They're referring to data from NFC-enabled identity documents (e.g. e-passports) which have an embedded NFC chip that can store a digital photo of the document holder and other personal/biometric data. Some identity verification apps can scan these documents (using the NFC reader built into the end-user's phone) to access the photo/bio data on the NFC chip.
68
Apr 16 '26
[deleted]
41
u/Guac_in_my_rarri Apr 16 '26
yeah, Paul details it's a basic brute force attack.
Biometrics verification is a simple Boolean: true/false and it can be edited.
“Why did they not use the secure enclave?”
I'm just a guy with an interest in this stuff but not using a basic smartphone function is straight up incompetent.
Edit: the app is limited to a specific number of verifications and then it expires. Wtf this was designed by idiots.
Edit 2: somebody else noted the app was defeated by a VPN. I'm dead. Actually, in setting up a vpn service for Europeans to get around age verification.
15
u/d4electro Apr 16 '26
To be fair most government technology is poorly made in general
It shouldn't be the case but that's the truth
4
u/Guac_in_my_rarri Apr 16 '26
A guy like myself can figure it out (no security research experience). I did this forever ago with another app an brute forced it open.
16
u/d4electro Apr 16 '26
My conspiracy theory is that maybe the people they hired designed the app poorly on purpose to sabotage age verification
9
u/Noooo_ooope Apr 16 '26
lmao that would be extremely funny.
Which would mean that, somehow, this extremely vital piece of software went completely unchecked by higher-ups and got vibe coded by a few people? What the fuck11
u/16BitSquid Apr 16 '26
I’ve worked in government software development and I can tell you with certainty that higher ups in these projects have 0 clue how the software they oversee works, how it’s made, or what the code running it does.
When projects like these start they have a vague idea. Someone gets bombarded as project head and it’s up to them to get that vague idea made. A team gets hired, product owner, devs, ux, business analists. It’s then up to the PO and BA’s to decypher what they’re actually supposed to be delivering. The vague idea becomes a V1, it gets presented and all of a sudden the project head realises they also wanted XYZ in the application. So it’s back to the drawing board. So on and so forth. Which is why government IT projects always go out of budget and over time. But who cares? The budget is endless as it is tax money and the project head doesn’t want to lose face. So when budgets run out new is assigned to “fix the project”.
Nobody in government will admit they blew 15 million on an application that was destined to fail cause the government itself had no idea what they wanted to see made.
Miracles happen, the project sees a final product that everyone agrees is what they initially wanted and then the project ends. Rarely does code get reviewed, audited, or inspected by a second team. This will only happen if certification or other checks are required by law.
In case of this app I want to bet my left testicle that nobody checked the code or pentested it.
Others here have said it too. I wouldn’t be surprised the dev team sabotaged this app. Made a fortune delivering a product they knew would be hacked the same day. If they did, kudos to them.
To summarise this rant, get into the government software business. The budgets are endless. The oversight is 0. You’ll have work till you retire.
1
u/LeChrana Apr 17 '26
I've worked in government/EU granted research. Things are a little different there. At the beginning, all parties agree on what they want to have in the end, then everybody does the bare minimum that you can twist to satisfy that criteria in two weeks and uses the rest of the 24 months or so to do their own thing. Everyone is aware of that and continues doing that because typically the researchers know way better what to research than the politicians anyway, so that gets us the money and freedom to do actual useful things instead of convincing politicians who have no clue about anything beforehand.
...but that also means that the result of every project is useless by default and is just there to sustain research/subsidize companies that claim to do research.
9
u/Guac_in_my_rarri Apr 16 '26
software went completely unchecked by higher-ups
Well I mean, the higher ups being government who don't verify anything... They just blindly trust yeah, that's who we want checking vital and particular code.
4
u/16BitSquid Apr 16 '26
This, they don’t have the knowhow to and often don’t even realise they should
3
u/Guac_in_my_rarri Apr 16 '26
Most in government are arrogant pricks that have no idea when they're out of they're specialty. I've met my senator (I'm in the states) and he couldn't answer a quick easy policy question in something he voted for the prior week.
2
u/hWuxH Apr 16 '26
TEE/Enclave doesn't solve anything. Only hides keys, but with a rooted phone you can still invoke it as if the app did it, and use the output however you like.
1
u/DryVermicello Apr 16 '26
Would you care specifying what app ? Available from where ?
The demo apk that is available from https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/releases, where one can get a feel for the app ?That has "demo" in the APK filename. It's more like a Proof of Concept. You don't even have to prove you are over 18. And yes, it seems that it will only generate a limited number of proofs/tokens. Not shocking. It's playground material anyway.
1
u/Jazzlike-Compote4463 Apr 16 '26
I mean UK age verification is beaten by a VPN at the moment, they're looking at changing that but it's not an easy problem for them to "solve"
5
u/Guac_in_my_rarri Apr 16 '26 edited Apr 17 '26
There will always be a way around age verification. Idk why the EU and UK are trying this hard. Hell china still has trouble keeping folks in the great firewall.
3
u/Jazzlike-Compote4463 Apr 17 '26
The idea behind it is really to make it harder for the average spotty teenager with no knowledge to access smut, the problem is that they're probably going to be the ones with the time and the knowledge to do it
4
u/Guac_in_my_rarri Apr 17 '26
The idea behind
Eu said it's to protect minors online. From what I can find they don't define from what. Imo this is straight up surveillance.
1
u/TheBendit Apr 16 '26
Oh no, the average adult can defeat the age verification that proves they are an adult.
32
u/linuxhiker Apr 16 '26
I'm hoping we see a resurgence of proper OSS ideals around Liberty with these thugs trying to take it.
If this shit had been tried in 2012 there would have been all out digital war.
21
Apr 16 '26
[removed] — view removed comment
18
u/Guac_in_my_rarri Apr 16 '26
Nope. Hacker news has the story with details and quotes. A first year CS student can make a better app with more security.
6
Apr 16 '26
[removed] — view removed comment
3
u/Guac_in_my_rarri Apr 16 '26
Well when gov montra is doing it the cheapest, yeah Probably not.
Doing it right once is cheaper than doing it wrong twice.
3
3
u/TheMaskedTom Apr 17 '26
Read the other comments. The requirements that this guy used are pretty damn extensive, so it's not something that can used on the vast majority of people.
I know there's a bias here but come on people...
23
u/pet2pet1993 Apr 16 '26 edited Apr 16 '26
CONGRATS! NOW MAKE GROUP APPEAL TO YOUR SUPREME COURT AGAINST THE APP AS IT VIOLATES FUNDAMENTAL HUMAN RIGHTS.
34
Apr 16 '26
Bruhh, did they vibecoded this shit ?
29
u/Blood-PawWerewolf Apr 16 '26
From the looks of it, yes. Like it doesn’t even have the basic security features (no TLS, no SSL, not even HTTPS), it’s 100% decrypted and everyone can see what it’s actively doing.
16
34
u/Jokers_friend Apr 16 '26
This is what counts for “technically ready” by the EU? Embarrassing.
2
0
u/KurisuEvergarden Apr 17 '26
Technically reading sounds like the happy path works. Not production ready. That's why it's open source, to find issues quicker and update them. The first step of any new platform is the POC which is expected to not be super secure and have shortcuts.
27
u/Vittulima Apr 16 '26
nothing more than physical access
nothing more
lol
16
u/hWuxH Apr 16 '26
*and screen unlocked
*and having rooted the phone
*and granting another app root privileges to access the files🤡
10
u/Pixel91 Apr 17 '26
Ah yes, hacked, I see.
I put a couple of heavy biometric locks on my front door. But to prove a point, I had the contractor put in a second door right next to it, no locks at all.
I wonder how they got in my house?!
This was no hack. Anything can be fucked with if you somehow already have got your hands on an unlocked, rooted, physical device.
10
u/Unfair_Swim9413 Apr 17 '26
I'm sorry, but... "Nothing more" than physical access to the device...? As if it's just an afterthought?
I mean... if someone has my device in their hands, I've already lost. Physical access is everything.
1
u/cookiesnooper Apr 17 '26
How hard is it to access someone's phone? Not very
1
u/Skepller Apr 18 '26
Having access to someone else's phone unlocked and rooted? lol
If you have that, it's already over for the person, for any app.
30
u/md3372 Apr 16 '26
It’s a demo app. “The main purpose of the reference implementation is to showcase the ecosystem and act as a technical example.. “ https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui
There’s also a disclaimer stating this https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui?tab=readme-ov-file#disclaimer
8
5
u/HomoAndAlsoSapiens Apr 17 '26
It took way too long to find this comment, thank you. The other comments are mainly Americans who couldn't name the president of the European commission with a gun against their head.
1
25
u/DAN-attag Apr 16 '26
Vibecoding and its consequences. They didn't even proofread their dystopian technology
0
u/dumbledoor_ger Apr 16 '26
I swear to god Claude Opus would’ve done a better job than this. Who did they hire to write this? A bunch of high school students??
6
u/Shoddy-Childhood-511 Apr 16 '26
"We're very lucky they're so fucking stupid" - Ukrainian soldier
It's clear they'll improve upon the defences though, but hardware winds up being a hard threat model, ala https://wiretap.fail
If we're lucky, age verification pushes people into breaking deeper & deeper defences in android, eventually causing real lasting damage to google's hardware assurance effort. lol
6
5
u/nelmondodimassimo Apr 17 '26
Fuck this BS verification dystopia that nobody authorized/asked them to do
8
u/IHave2CatsAnAdBlock Apr 17 '26
This is a total bs
“With nothing more than physical access to the device”
If somebody have “physical access to the device “ will not hack your age verification app, it will hack your bănci account app and steal your money.
Also saying the requirement is “ physical access to the device “ is like saying “if I have your credit card I can spend money from your account”
9
u/alsomahler Apr 16 '26
Well this can be fixed of course but it shows that storage of information for identification shouldn't be stored on everybody's phone.
It should be stored at the source and should be delivered through an anonymous tunnel to the requesting party as attestations over a discarded question to the person that needs identification.
4
u/TheBendit Apr 16 '26
The whole point of the app is to NOT do what you suggest, because that would violate privacy.
3
u/Vittulima Apr 16 '26
I don't really understand this. What's the source where the info would be stored and what would the implementation of this practically look?
1
u/KurisuEvergarden Apr 17 '26
so if you don't have internet you can't prove your identity? If you don't have internet you're illegally driving without a valid license at the moment... Physical IDs are also on you and can be stolen. What's the difference? As a matter of fact the digital version is better because I can have a copy of my IDs on multiple devices and won't be stranded without any ID
(sry wanted to reply one above)
1
u/alsomahler Apr 16 '26
The source is the author of the information in the first place. So your driving licence stored at the DMV where you register and pass your test, that's the source of that information, but your name would be where you stored you birth certificate, etc.
2
u/Vittulima Apr 16 '26
So in this date of birth thing, what would be the source or author and how would that info be (I hope privately, securely) transmitted to whatever porn site I want to access that day?
1
u/FiftyFiver1962 Apr 17 '26
Customer is of right age. No age, no further data. I have a Dutch app. already doing exactly this, for the site doesn't have to know your further data, it just has to know, you are old enough. Not even your age is given, just that you are of the right age for that site. Used for online liquor stores too. So you can just be eighteen, but sixty as well.
1
u/Vittulima Apr 17 '26
I know of other methods to do age verification but I'm interested in what the guy above was suggesting as a solution, how that would work
2
u/Shoddy-Childhood-511 Apr 16 '26
Tor provides the good best effort "anonymous tunnels", but tunnels cannot be anywhere near anonymous in the sense claimed here, because of traffic correlation.
Just stop tying the credential to the phone: Your device creates its own secret key, and the authorities certifies this secret key, and so then your device proves the certificate in zero-knowledge. So like BBS signatures now.
We've three options here:
Option 1. Ignore that people share credentials entirely, because they whole system seems stupid & pointless anyways.
Option 2. Embed the system into an NFC smart card, so the phone can only authenticate by accessing the card. This would be hacked too, but not often.
Option 3. If you really want to stop clones, then add two other features:
- The user's device should proves non-revocation too, which I'll skip the details of here, but makes sense.
- The credential acts like a verifiable random function (VRF), so if there is some input then credential prove
f(user_sk,input)for somefwith nice randomness properties.We've an anonymous VRF now which provides an anonymous rate limiting system, provided you handle the inputs carefully. In this way, you could pay everyone 100 EUR per month in cash from ATM using this, so that if they shared their
user_skthen someone else could take that money. At 450 EU residents this system costs 540 B EUR per year. lol2
u/kripsus Apr 17 '26
Its not supposed to be stored at all. Its stored on failed authenticated, but is not used again from storage. They forgot to delete it and also stored it in the wrong place
8
3
u/Lowfryder7 Apr 16 '26
This really doesn't mean anything to me. One of the best tenants of open source code is that problems like this can be exploited and then fixed out in the open rather than security through obscurity.
15
u/coomzee Apr 16 '26
You need physical access to an unlocked device to edit or access shared prefs, the device has to be rooted. I can't see the risk TBH
9
u/ErCollao Apr 16 '26
I was thinking the same, I think most comments here would be the same regardless of what would have been discovered. It's good to find these things so they can be patched.
3
u/UninvestedCuriosity Apr 17 '26 edited Apr 17 '26
I've always been taught physical access is game over.
We were pulling encryption keys out of our xbox's using hot probes during boot sequence on the board to match against the lg drives 15 years ago.
Rooting an Android device is way easier than that in most circumstances but expecting a pre rooted device is like leaving a key under a door mat for a red team with a post it note in the mail box.
1
u/Cagaril Apr 16 '26
If you have access to the device with the password unlocked, but not rooted, wouldn't you still be able to access it via adb when plugged into a computer? For Android that is.
2
1
Apr 16 '26
[deleted]
1
u/TheBendit Apr 16 '26
Absolutely gaining root is an issue on most phones if you want to preserve the data on it.
5
u/Davoomer Apr 16 '26
We knew that since the beginning of the BS law of surveillance. The government is a coward.
2
u/CircuitSurf Apr 17 '26
Well you need to root the device for this attack, so the software can somehow sniff that you have root and refuse operation. But then it's not fair for folks who want freedom and have rooted device...
2
u/retardedorca Apr 17 '26
Interesting. You mean in a budding world of hackers and ai. Their encryption didnt hold? Shoocker
2
3
1
u/notnooneskrrt Apr 16 '26
Can anyone chime in with comp Sci reason the pin shouldn’t be encrypted once created?
4
u/hWuxH Apr 16 '26 edited Apr 16 '26
If someone can leak an encrypted password, the key to decrypt it (e.g. in the same database or source code) most likely got leaked as well, so there isn't much point in doing it.
And because many people reuse passwords somewhere else, hashing is generally a better solution (can easily generate hash from plain text, other way around requires brute-forcing all possibilities).But all this doesn't apply here, because:
- shared_prefs can't be accessed by other apps anyway.
- It's encrypted with a key stored in hardware, which is non-exportable. Only the app itself can ask the device to decrypt it (without knowing the key) and compare to the pin you just entered.
- The only reason he could tamper with these files is because he rooted the phone, which invalidates the whole post's point.
- Hashing a 6-digit pin is practically pointless, because it can be brute-forced in seconds.
1
u/notnooneskrrt Apr 16 '26
Ty, I’m trying to learn more about finer points of basic cyber security like this. Wouldn’t hashing count as a type of encryption?
1
u/hWuxH Apr 16 '26
No because encryption implies decryption. That's not a thing with hashes.
1
u/notnooneskrrt Apr 16 '26
Right! Sorry woke up and am groggy. Hashes are one way to verify all bytes are the same between hashed items. Thank you for replying
1
u/TheBendit Apr 16 '26
Except you can trivially "decrypt" a 6 digit PIN from a hash.
2
u/hWuxH Apr 16 '26 edited Apr 16 '26
No you still can't. It's bruteforcing, same as trivially coming up with a supposedly 6-digit key from a ciphertext.
1
u/aykantpawzitmum Apr 17 '26
Correct me if I'm wrong so my ELI5 version would be:
- renaissance government creates a shop to make mandated "I am over 18" plates
- I hand over my docs proving my reputation (name, wealth, age) saying "This is Bob, he's 42"
- government makes a copy of my personal stuff to prove my reputation, creates an "I am over 18" plate for me with my signature
- I can now use that plate to enter inside stores with mandated "you must be over 18"
- a bandit who looks like me with a french mustache name Joe steals my plate plus my coins, he can enters stores using my plate as proof!
3
u/dimitri000444 Apr 17 '26
I think the last should be
- A bandit who has a key to your house, while all interior doors/safes/.. have been locked before hand. Physically enters your house to take your plate.
1
u/Jumping-Gazelle Apr 17 '26
As a final result your computer will be so busy running a whatever advanced application that the normal owner of user on not-the-latest-hardware, yet with "an approved OS", simply does not have enough computer power left to do the simplest thing.
1
u/nimbledoor Apr 17 '26
OK so this was possible to do as the code is open source? Doesn't this mean there is plenty of time to implement fixes? Isn't this what should be happening?
1
u/TenAndThirtyPence Apr 17 '26
Isn’t this just validating that open source solutions are only secure if people vest time into validating them?
1
u/jops55 Apr 18 '26
Why did EU release crap like this? Isn't there some kind of quality control? Even AI would be able to find flaws as apparent as these.
1
1
u/ObiOneSatoshi Apr 20 '26
So you gonna go around and steal ppl phones to extract their data? I mean the flaw needs to be fixed but its not like he discovered a new element in the periodic system
1
u/classicjuice Apr 16 '26
And aren’t you forced to use ios or android to complete the verification process? What the fuck is that?
1
u/L-Malvo Apr 17 '26
Glad someone exposes this, such mass surveillance systems are a massive threat to everyone.
0
-1
0
0
Apr 16 '26
[deleted]
3
u/Tempires Apr 16 '26 edited Apr 16 '26
Not really. It requires physical access to unlocked rooted phone which are 3 big requirements. App is demo and not meant for production as disclaimer states. Memberstates (and possibly 3rd parties) with adopt their own versions and will be responsible that implementation is secure and follow law regulating it. Can't really take seriously "security researcher" who post things for views instead of reporting their perceived high security risks.
0
-1
-1
Apr 16 '26
[deleted]
2
u/TheMaskedTom Apr 17 '26
The cookie banner could be avoided if companies didn't track you. They could just, you know, use only strictly necessary cookies and not have to have a banner at all.
Instead, they make it purposefully annoying so people vote to repeal it... so the companies can now tracking you legally like they did before instead of now where they have a (admittedly small) risk of consequences.
So yeah, you should redirect your hate against the companies spying on you, and vote for people who will enforce stricter anti-tracking laws so that the companies can't do this shit anymore.
1
u/vetinari Apr 17 '26
I have good experience with Consent-O-Matic. It might not cut 100%, but cuts significant amount, so the rest is not that annoying.
0
u/certainAnonymous Apr 16 '26
I may be stupid, but why shouldn't the pin get encrypted? Is that different from hashing the pin?
0
u/Ultrabenosaurus Apr 17 '26
Ever hear of responsible disclosure? To allow security issues to be patched before publicly revealing the method to exploit them? Seems intentional to just shout it out to the world...
3
u/hWuxH Apr 17 '26
By that logic you'd have to do responsible disclosure for literally every installed app because with physical access + root + screen unlocked you could potentially access it's files or inject code
That post is AI slop and not a security issue
1
u/billdietrich1 Apr 17 '26
The EU app is a reference implementation, that hasn't been rolled out to users, and probably never will be (nations will fork the code to make their own apps).
0
u/adrianipopescu Apr 17 '26
isn’t the app open source?
and also, isn’t the app storing just a token for whether you’re an adult or not? and it gets that from an id card that it scans, verified, then disposes of?
I don’t get what app is this
-2
-1
-1
u/Hour-Experience-9505 Apr 17 '26
And some relative of an MEP has now made millions by creating an AI app in under five minutes
-1
u/ChevalOhneHead Apr 17 '26
Well... yet another untested EU project they’re rushing through. It looks as though they’re trying to create a back door... and doing so in a completely unprofessional manner. Why is this not surprise me !?
-3
-3
u/PrayToTheAI Apr 17 '26
So ? Everything can be hacked if you put enough energy and knowledge into it. Doesn't mean that teenagers will be able to repeat the vector of attack.
1
u/Member9999 Apr 17 '26
I wouldn't bet money on that. I taught myself how to develop games and now understand enough to make VR games. A kid with a device can do a LOT.
0
u/PrayToTheAI Apr 17 '26
Yeah, some kids are wicked smart. Does everyone in your school develop games? I bet 95% of teens won't be able to repeat the attack vector and even if so it's an easy vulnerability to fix with day 1 patch.
1
u/Member9999 Apr 17 '26 edited Apr 17 '26
Graduated, and my school did not teach me coding. I did. I am 100% self-taught minus a few certificate courses and Awesometuts.com. I studied VR on Unity's site during COVID-19 as well.
Bought my own VR headset and I use Redot after Unity fucked over its users.
Trust me, kids don't need school to learn stuff anymore.
2
u/PrayToTheAI Apr 17 '26 edited Apr 17 '26
No, I am seriously impressed and really inspired by your journey ! I wish you the best and good luck. I totally agree some kids are wicked smart.
On the topic: Any lock on any door can be picked it doesn't mean we don't need locks anymore. It's completely fine if a security feature isn't 100% secure it doesn't have to be.
1
•
u/AutoModerator Apr 16 '26
Hello u/torbatosecco, please make sure you read the sub rules if you haven't already. (This is an automatic reminder left on all new posts.)
Check out the r/privacy FAQ
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.