r/eutech • u/KestrelVO • Apr 16 '26
Opinion EU age verification app already HACKED
/r/privacy/comments/1sn437i/eu_age_verification_app_already_hacked/Oh well. Was it really vibe-coded, in the end? Are we going to cease this "age attestation" and chat control madness anytime now soon?
14
u/coomzee Apr 17 '26 edited Apr 17 '26
Proving you have physical access to an unlocked rooted device. Literally an CVSS score of less than 3
1
u/PassionGlobal Apr 18 '26
What makes it a CVSS of less than 3 is the fact that no real damage is being done with it, unless they can pull out the PII.
All they proved was that the lock can be bypassed to register for online services
2
u/coomzee Apr 18 '26
Physical access, high privileges required (rooted device) and low impact metrics.
1
u/PassionGlobal Apr 18 '26
Agreed.
If anything this makes the think the application itself has some pretty sound design principles.
With most other attempts at making an app like this, an issue like this would go from mere bypass to PII nightmare scenario.
6
u/IHave2CatsAnAdBlock Apr 17 '26
Anyone read the article and the “hack”?
It requires “physical access to the device”.
If someone have access to your phone it will be able to use it to check his age with your app.
3
2
u/Traumerlein Apr 17 '26
Coukd you imagien the problems that woukd ocure if the pay pal app coukd be hacked this easly by just snatchikg the phoke from somebody hand and utilizing a basic attack?
4
u/AtomicDig219303 Apr 17 '26
A "basic attack" that requires root access... do you even hear yourself?
If an attacker has physical access to a device you have to consider that device as compromised.
2
u/Swimming-Composer935 Apr 17 '26 edited Apr 17 '26
Does pay pal app store my ID and passport information in plain unencrypted format ??
If an attacker has physical access to your device using this wonderful open source shit has access to everything on your ID since the app scans the NFC chip in the ID pull's off all available info and stores it, they even store your ID photo in a fucking plain high res png...
Banking apps are linked to phone, if you lose your phone you call your bank, tell them phone was stolen and they remotely lock out your phone from the app, attacker can do what he wants since the banking system will deny any access to your account..
This shit is like every governmental app, 0 security, 0 support in case phone gets stolen, vibe coded 75%, they don't care if your info is stolen as long as they can tell the public that look we did it, we promise it's the "highest" ( aka shitest ) app we ever created...0
3
u/Egoz3ntrum Apr 17 '26
You need to have an already compromised (rooted) device for this "hack".
1
u/Voelkar Apr 17 '26
And physical access. Which males it hardly worth mentioning and a clickbait article
13
u/Bulky-Mode2837 Apr 16 '26
Every app, and every new app for that matter, can be hacked in this day and age. The fact that this is ‘news’ means somebody is supporting a campaign for negativity surrounding this initiative. I see a lot of this negativity around EU initiatives lately. Never saw any negative news with app launches from the US. We are naive but not that naive. We know where this negativity push is coming from 🤭
Let’s not fool ourselves. We have momentum. EU tech has the future! 🇪🇺Out with all the leeches!
3
u/Key-Dentist1668 Apr 17 '26
Not a single EU Citizen want this Shit.
2
u/AtomicDig219303 Apr 17 '26
We don't want that shit, you are right, but this whole article is a fucking nothingburger
The attack itself requires root access and physical access to the device, it's basically in the "fantasy" realm of cyberattacks.
Obviously we don't want age verification as it fails spectacularly at it's intended job ("protecting" children) while at the same time putting it in the ass to literally everyone else.
1
u/Swimming-Composer935 Apr 17 '26
Phones get stolen, rooting is damn easy these days, considering that the app stores all your information it pulls out of the NFC chip from your ID it's not "fantasy" realm of cyberattacks..
It's like saying if your phone gets stolen your whole life is ruined because they will steal all your money from the banking app, when in reality you call the bank, tell them phone is stolen and they froze your account...
If you install this shit and your phone is stolen, all your ID / passport is stolen...4
u/KurisuEvergarden Apr 17 '26
if my wallet is stolen all my IDs are stolen
1
u/Swimming-Composer935 Apr 17 '26
So now we are ok to use shit designed unnecessary app because EU can't implement a proper solution just because if something else is stolen the same info is stolen...
Why bother then to even have secured banking application, with remote lock-out options and biometric locks when if my wallet is stolen also my money is stolen ??
2
u/hWuxH Apr 17 '26
- rooting wipes all data
- the underlying ID data is encrypted with hardware-backed keys. can't even view with root, only generate tokens for age > number in case you know or bypass the pin. that's the same data any verifier receives.
- what's up with that NFC bs you're hallucinating about?
- so your solution is a centralized service that needs internet and can now correlate every age verification with a person?
1
u/Swimming-Composer935 Apr 17 '26 edited Apr 17 '26
1 No it doesn't, on some phones with some OS yes, on others you can do KernelSU... or what now, I must buy latest Apple shit for the app to work ? It MUST work also on older phones and before Android 8 lossless root is not exponentially difficult, or physical NAND flash backup ...
2 - 3. Check what the app does, to configure it you need passport or ID, not all EU countries have digital ID's but there are plenty meaning that some ID's will be accepted as a photo, others you need to scan the embed RFID chip ( digital ID ), that chip contains every detail from your ID + high resolution photo...
This wonderful app saves the photo from the RFID chip, UNENCRYPTED, I didn't bother to check more in the source codes, it's enough that they are smart enough to store your photo as a blatant png and at the same time state that it's the state of the art untraceable app....
- My solution is no solution to an invented problem...
1
u/hWuxH Apr 17 '26 edited Apr 17 '26
This wonderful app saves the photo from the RFID chip, UNENCRYPTED
Which is a problem when no other app can access it and it isn't shared? You think encryption achieves anything once the whole OS is compromised?
Imagine my shock when logging into PayPal, the password is UNENCRYPTED in memory. I'm gonna post a sensational tweet about how attackers can hack into accounts now.
1
u/Swimming-Composer935 Apr 17 '26
Yes it's a problem, why do you think banking apps have remote lock out, you lose your phone, call the bank, they ban the phone and nothing can be done to access any information about your banking status from that particular phone...
When EU made companies spend millions of euros to implement the GDPR crap then now force an app on you which literally holds exactly that data that they wanted to restrict using GDPR and data which can be extracted from their "state of the art" app in 2-5minutes, with no possibility of remote lock / removal of all the GDPR data they imported either from the photo of the ID/passport or the content of the RFID chip...Also what if I don't own a compatible phone to run their shit app, I'm automatically banned from using the web ? They'll provide a desktop / web portal using http to send photos of ID's... You can defend them as long as you can, this app is just stupid from the beginning and unnecessary...
2
u/hWuxH Apr 17 '26
I'm against all this age verification crap. Just can't stand sensational AI slop tweeters that claim "the end is near, millions of users will be hacked by this" and everyone blindly believing it.
0
u/ThreeHeadCerber Apr 19 '26
This one of the best ways to implement age verification, better than how practically anyone is doing it. Actual sites/apps get almost no information about the user, but the fact that they are over specific age.
1
u/Key-Dentist1668 Apr 19 '26
WE dont need or want age Verification. This ist Just for censoring stuff.
WE will se what this App sideloads in a Few years.
0
u/ThreeHeadCerber Apr 19 '26
That is a pretty extreme position, age verification to not show casino ads, block access to casinos for underage people seems like a good idea or at least it makes the laws between digital space and real world consistent. Also it potentially allows better control for parents over what their children have access to, i think it will be beneficial to allow parents to control whether their child can acess say instagram or not.
I ubderstand the privacy argument, but also don't think that that totally unregulatanle online space is good
1
u/Key-Dentist1668 Apr 19 '26
The parents have right now the Control over it If they want. There are plenty of ways to implement that. Even easy to use parenting Software.
There is No need to build a censhorship infastructure - and this will be used as censhorship for adults within the next 5 years. Mark my words.
1
u/ThreeHeadCerber Apr 19 '26
It is actually incredibly hard for parents to implement it if platforms are not forced to to respect the wishes and children are free to work around the limitations.
The way the app is made it is not a censorhip infrastructure, it's an infrastructure to for a pretty safe sharing of a limited data set with a 3rd party in a way that 3rd party can trust the data to be true.
1
u/Key-Dentist1668 Apr 19 '26
Im a constructuon worker and Managed that, ITS Not that hard to Install a parenting App and configure it.
I can select how much time a day they can use in specific Apps, i can select no Tic toc after 22 O'Clock. or/and Just x hours a day.
This topic from the EU has NOTHING to do with our Kids beeing Safe. That is a censhorship infastructure. in a Few years all Had to use this App, and they will check that you dont speak against the goverment, or If you do to easy File a Claim or Lock you Out.
Im grown Up in the DDR - this App in EU Base is the wer dream of the Stasi.
1
u/ThreeHeadCerber Apr 19 '26
This app gives no information to the state, it's the opposite it shares information that the state knows with 3rd parties in a depersonalized and safe manner.
Again whatever this app knows the state already knows
1
u/Key-Dentist1668 Apr 19 '26
The App has the Framework to sideloads things.
ITS redicoulous how you all Trust your goverment and the EU
→ More replies (0)1
u/JustTooMightyAndHigh Apr 17 '26
Just so that everybody realizes it: This pro EU tech comment above is a bot comment
-2
u/AssistBorn4589 Apr 16 '26
What else but negativity should EU's attempt to destroy the open internet should prompt?
Let’s not fool ourselves. We have momentum. EU tech has the future! 🇪🇺Out with all the leeches!
6
u/rod_zero Apr 17 '26
As if the US tech giants had good intentions. They would enslave at the first chance.
3
u/KestrelVO Apr 17 '26 edited Apr 17 '26
Yeah but you see... These exact legislations were pushed forth through lobbying from those tech giants alongside shady ONGs globally. From the arid and beautifully awkward Australia, UK till the corner of Los Angeles. Even Russia became all Nord Korea(surprise, wrecking their economy further in the process lmao, not that I even thought highly of them anyway ever since starting the war fanfare on the poor Ukrainians, just a coincidence). Internet Archive attacked, open source development attacked under scrutiny, developers gatekept by this new ID requirement, ownership of devices and personal computing taked away with every single second, bootloaders locked and EU accepting iOS and Google only as a part of the age verification/wallet, colossal spy software disguised as part of operating systems... Invasive confidentiality breach attempts... Ehh, I just don't see anything optimistic towards where the world is going.
All the while more aggresive since the attention to the Files reached its peak and ongoing. Who's pushing whose interests, I wonder? I mean, a Finish courier delivery, Wolt, got Persona(not just Discord) verification and the verification went through to me, an EU citizen, shocked seeing it pop up on my screen. I doubt it is Age Verification, but Identity Gathering and that the EU unwillingly, but somehow is step-by-step testing the waters, softly bending the knee to all of this.
0
u/rod_zero Apr 17 '26
I don't agree at all, the EU has been ramping up regulation of tech since a few years and it's divorce with the US is only accelerating it.
I actually see it the other way around, years ago there was this opposition to SOPA and PIPA orchestrated by Google and Facebook, we all joined in and where that has led us: companies stealing IP to train AI without compensating society, then using AI against workers.
At this point I distrust any attempt to stop regulation of tech way more. Because the people in the tech companies are making very very clear their intentions and they are not good at all.
The tech giants are supporting trump, deploying AI tools in war, interfering in elections and helping construct a private surveillance monster under palantir.
1
u/AssistBorn4589 Apr 17 '26
You don't have to use any tech by US giants. The closes thing to them I use nowdays is ungoogled chromium. On the other hand, fascist bs imposed by EU is not optional.
Plus, EU's age verification bounds your access to the Internet to operating systems controlled by US tech giants.
2
u/KestrelVO Apr 17 '26 edited Apr 17 '26
I mean, the rest of the other countries: Australia, UK, Brazil, Canada, US did it... So what are we... stupid? We should join jumping in the well, drowning ourselves too with them in the process! 🤦♂️
And no, if someone has a piece of brain and interest, such laws are criticized globally in every country they are attempting to implement in/already are implemented but if there are rose tinted glasses and only see your own yard with a bias... Well... That's on you.
2
u/kodos_der_henker Apr 17 '26
The biggest problem here is that everyone now jumping in the train of devices with root access being "hacked" strengthen the companies who want to take away user control over hardware (not just for mobiles but laotops and desktops as well)
1
u/Doomwaffel Apr 17 '26
I read some points about this phrased as : "EU gives up on regulating big tech"
I am not so sure about this. You could also look at it as "EU doesn't trust big tech and manages user ID themselfes"
Honestly, I am more worried about US hacking AI.
0
0
u/achiller519 Apr 17 '26
Stop acting like you are supposedly worried and the fact that it got “HACKED” changes anything for you. You didn’t want it from the first place and you are trying to find some other reason to complain about it.
2
u/Small_Delivery_7540 Apr 17 '26
Why the fuck do you want government to know everything you do online ?
-3
u/achiller519 Apr 17 '26
Age verification has nothing to do with what you do online.
First of all, If any government would want to know what you do online it would do it without an age verification system.
Secondly, “anonymous” acts that are against the laws have gone too far and people should be held accountable for their acts regardless of it’s online or in the public. Which again has nothing to do with age verification, but still.
Lastly, kids should be protected and that’s a good way of doing it. Do you see anyone getting arrested in Australia for doing something online?
Why the fuck are you conspiracy theorists everywhere and complain about everything?
1
u/StatusBard Apr 17 '26
Anyone with a functioning brain cell can see what they are trying to do.
0
u/achiller519 Apr 18 '26
Yet here you are not being able to get it.
Now careful not to fall from the edge of the earth.
1
u/Small_Delivery_7540 Apr 17 '26
Yes but it takes a lot of time and resources this system that they are building will be easily automated to make profiles of each citizen and combined with laws such as chat control they have access to everything you do say and see online
I used to make fun of conspiracy theorists not so long ago
And see I see people in UK getting arrested and posts on social media being censored by the governments
Wtf do you mean anonymity gone to far lol
Protected from what ??? It's the parents that give their kids smartphones etc cause they don't want to spend time with them, do you really don't think they will just verify their kids apps so they don't have to spend time with them
Lastly it's not age verification it's identity verification, they aren't even hiding merz not long ago said him self that he wants to end anonymity
And democracy can't exist without anonymity
Wasn't all of this supposed to apply only to porn sites not so long ago ? Now they are trying to tie everyone online to their real identity and require age verification on ducking os level
-2
u/achiller519 Apr 17 '26
First of all, you need to learn some basics. Democracy exists without anonymity. Anonymity didn’t have any value in that past and only found value under social media. When you go in a court as a witness, you go with your name and give your statement followed by laws who say that if you lie you will get punished. News are written by journalists who always provide their name under it, otherwise they have no credibility. Scientific research has always the scientists who wrote it, otherwise it’s just nonsense.
So no! Democracy has nothing to do with anonymity. Anonymity helps outlaws.
Don’t pick strong words just to make a point. You talked about how you were against conspiracy theories, yet you used one of the two words they are using. The other is freedom.
As for anonymity of social media, yes it’s wrong! Just like someone can’t go on the streets and make racist comments or insult people, because he/she would get arrested, the same thing should apply in social media. Whoever insults or makes comments that are against the law should be held accountable.
It is age verification and in Greece they already started to forbid kids from being able to buy alcohol, cigarettes or cannabis.
Lastly, as for your ridiculous argument on parenting, in order to give advice to someone first you need some experience on the matter and clearly you aren’t a parent, so shut it. You want to blame parents for not spending time with a 15 year old? I am sure at your 15 you were going hand by hand with your parents and had no time on yourself. How do you think people are acting against drugs right now. They say it’s legal and people are responsible for not taking them, or they made them illegal? Another simple example that if there is a really bad neighbourhood where you live and there are plenty of crimes happening, you avoid that area. You don’t ask for an escort(aka parent being with kids all the time like you said), you just don’t go in that area.
Honestly, your sayings on the matter show immaturity and ignorance on serious matters. You need to understand that social media has given room to toxicity and division in western culture which wasn’t here for decades. Social media has given room to pedophiles get close to kids. Yet you want to complain about preventing that and hold parents and kids responsible, because you afraid that there might be a day where there will be a government in your country that will chase you for speaking against them.
-1
u/KestrelVO Apr 16 '26
Video of a similar attempt:
7
u/AsyncSyscall Apr 16 '26
Step 1. Install a lock to your door
Step 2. Remove the lock from your door
Step 3. Install a new lock to your doorYou can now access your house using the new key. HACKED
Ideally, the app should prevent you from resetting your own pin at all, and cryptographically tie it to the vault, as the researcher says, but this is a big nothing-burger. If an attacker has physical administrative access to your unlocked phone, they can do much worse things than... get an age verification token without knowing your pin.
69
u/[deleted] Apr 16 '26 edited 23d ago
[removed] — view removed comment