#ageverification
Hacking the #EU #AgeVerification app in under 2 minutes. During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory. 1. It shouldn't be encrypted at all - that's a really poor design. 2. It's not cryptographically tied to the vault which contains the identity data. So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app. After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid. Other issues: 1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying. 2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step. Seriously Ursula von der Leyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.
Paul Moore - Security Consultant 3,412,211 views • 6 months ago
Bypassing the latest #EU #ageVerification app (2026.07-1) with a Chrome extension... again. Despite 3 months of security hardening and genuine improvements across the board, the fundamental issue cannot be solved. Anonymous age verification doesn't work.
Paul Moore - Security Consultant 1,363,016 views • 3 months ago
Bypassing #EU #AgeVerification using their own infrastructure. I've ported the Android app logic to a Chrome extension - stripping out the pesky step of handing over biometric data which they can leak... and pass verification instantly. Step 1: Install the extension Step 2: Register an identity (just once) Step 3: Continue using the web as normal The extension detects the QR code, generates a cryptographically identical payload and tells the verifier I'm over 18, which it "fully trusts". This isn't a bug... it's a fundamental design flaw they can't solve without irrevocably tying a key to you personally; which then allows tracking/monitoring. Of course, I could skip the enrolment process entirely and hard-code the credentials into the extension... and the verifier would never know.
Paul Moore - Security Consultant 1,182,928 views • 6 months ago
Relay attacks don't care how cryptographically sound your credentials are. At some point, someone will create a paid service which accepts QR codes and verifies them with a fully autonomous Android phone. 1000 verifications: $1 #EU #AgeVerification #DigitalIdentity #Security
Paul Moore - Security Consultant 130,405 views • 2 months ago
Bypassing the #EU #ageVerification app - part 2. This time, it's v2026.04-2 - which won't run on rooted devices & has encrypted shared preferences. If we ignore the fact they've used a 6 year old deprecated library, they haven't actually solved the problem at all. An attacker can just as easily delete ciphertext as plain text. Ironically, they've tried to solve a problem they don't truly understand... much like the concept itself.
Paul Moore - Security Consultant 70,605 views • 6 months ago
The biometric authentication of the #EU #AgeVerification app can be easily bypass too...
Baptiste Robert31,554 views • 6 months ago
Online gaming platform, Roblox has introduced a new age-verification safety feature, rolling out from December that will prevent children from playing with others outside of their age group and messaging adults they don't know. #Roblox #ageverification #safety #children #facialrecognition
7NEWS Australia45,881 views • 11 months ago
No more content to load