Brussels launched an age checking app. Hackers took 2 minutes to break it • Hacker News Board

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#121

Post by lukan » Tue, Apr 21, 2026, 8:49 AM UTC

philipallstar wrote: post #117

lukan wrote: post #115

Earlier quoted context omitted.

No, it is not quite the same as Moscow and Washington are capitals of centralised states who give orders to the whole nation. The EU on the other hand does not have a common constitution, army etc. so is not a real state (yet). It is made up of soveraign nations who come together debate and decide there, but then it is still up to the members to implement that. So the transition to the EU as one state is happening, b…

It doesn't imply that the EU is one state. It's just the place where the decisions are made. If Brussels didn't like anyone knowing that, I'm sure other cities in the EU would happily take the gobs of free money showered on wherever the EU is headquartered.

You mean like Strasbourg?

https://en.wikipedia.org/wiki/Seat_of_the_European_Parliamen...

Spoiler, the parliamanet moves once a month between Brussel and there. That's how centralized the EU is, we cannot even decide on one fixed place to meet and decide.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#122

Post by jimmydorry » Tue, Apr 21, 2026, 8:50 AM UTC

deminature wrote: post #84

Sweepi wrote: post #10

These are the sources cited by the article: [1] https://xcancel.com/Paul_Reviews/status/2044502938563825820 [2] https://xcancel.com/paul_reviews/status/2044723123287666921 [3] https://csa-scientist-open-letter.org/ageverif-Feb2026 | "The saga is turning into a PR disaster for Brussels. " imo: mostly because the Author wants it be a disaster. The App has not launched, they published the source code in order to invite…

Not immediately deleting the selfie is a pretty fundamental and egregious mistake to make. People are particularly sensitive to selfies not being handled correctly after Discord lost thousands of them, despite promising to delete them after age verification occurred (and then not doing so) https://www.bbc.com/news/articles/c8jmzd972leo The damage is limited because the selfie is only retained on device, but it still…

>Discord lost thousands of them, despite promising to delete them after age verification occurred (and then not doing so)

This is misleading, yet everyone seems to repeat it. Discord's implementation of ID verification did not retain IDs. Reporting on this was so poor, but what appears to have happened was that people that failed age estimation / ID checks had to raise a support ticket and get manually reviewed. That support platform was pwned and the active support tickets were leaked. Who knows how long these support tickets were set to live for, but up to 70,000 active tickets getting leaked feels like a drop in the bucket. It's also not immediately clear to me what the alternative is (other than not getting hacked), when you require human intervention to review problematic IDs. Even if the ID only lived on their server for 24 hours during manual review, across a userbase of >200 million users, that's a lot of IDs at risk at any given moment, especially during these initial roll outs of age verification.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#123

Post by lukan » Tue, Apr 21, 2026, 8:52 AM UTC

finghin wrote: post #118

lukan wrote: post #115

Earlier quoted context omitted.

No, it is not quite the same as Moscow and Washington are capitals of centralised states who give orders to the whole nation. The EU on the other hand does not have a common constitution, army etc. so is not a real state (yet). It is made up of soveraign nations who come together debate and decide there, but then it is still up to the members to implement that. So the transition to the EU as one state is happening, b…

I’m not sure you realise that this is a far more generic rhetorical phenomenon that encompasses all kinds of situations. Like referring to the FBI as Quantico.

Oh, or using building names like White House and Kremlin?

Yes, I heard of the concept. My point was just that many have a misconception about the nature of the EU.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#124

Post by seydor » Tue, Apr 21, 2026, 8:53 AM UTC

edarchis wrote: post #106

Please stop saying "Brussels" to mean the EU. It's a nasty trick to give the idea that it's some kind of external entity forcing your country to do something. It's not. It's an assembly. And it's insulting to people from Brussels. I don't want this any more than you do.

It's also very common inside the EU. Brussels is not an internal entity either, it's seen as distant eurocrats by most EU citizens. Only those interested in EU funds know about them really. It's not seen as a representative assembly

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#125

Post by TazeTSchnitzel » Tue, Apr 21, 2026, 8:56 AM UTC

lukan wrote: post #115

finghin wrote: post #108

Earlier quoted context omitted.

It’s very common throughout English. The Russian government is refered to as Moscow, US as Washington. It’s the same and doesn’t refer to residents. It’s known as synecdoche. In other words, sorry but it’s here to stay.

No, it is not quite the same as Moscow and Washington are capitals of centralised states who give orders to the whole nation. The EU on the other hand does not have a common constitution, army etc. so is not a real state (yet). It is made up of soveraign nations who come together debate and decide there, but then it is still up to the members to implement that. So the transition to the EU as one state is happening, b…

The European Commission is in fact empowered to boss member states around, it's one of the things that give EU law teeth rather than it being like "international law" (unenforceable anarchy). It also acts much like a government (in the sense of executive, not in the sense of state) when it comes to EU lawmaking, and has various government-like powers in fields like competition law for example. And the European Commission is based in Brussels. Saying "Brussels" to refer to Commission activity is as natural as saying "London", "Downing Street", "the Cabinet Office", "Whitehall" etc to refer to British government functions. And that's without getting into all the other EU institutions that are based there!

It is true that the EU institutions are ultimately subordinate to the member states in a way that, say, the US federal institutions are not, but the EU is still very much is its own thing. It even has legal personality these days: you can sue the EU and the EU can sue you.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#126

Post by philipallstar » Tue, Apr 21, 2026, 8:57 AM UTC

lukan wrote: post #121

philipallstar wrote: post #117

Earlier quoted context omitted.

It doesn't imply that the EU is one state. It's just the place where the decisions are made. If Brussels didn't like anyone knowing that, I'm sure other cities in the EU would happily take the gobs of free money showered on wherever the EU is headquartered.

You mean like Strasbourg? https://en.wikipedia.org/wiki/Seat_of_the_European_Parliamen... Spoiler, the parliamanet moves once a month between Brussel and there. That's how centralized the EU is, we cannot even decide on one fixed place to meet and decide.

Yes indeed - the gobs of money know no bounds.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#127

Post by lkuty » Tue, Apr 21, 2026, 9:08 AM UTC

edarchis wrote: post #106

Please stop saying "Brussels" to mean the EU. It's a nasty trick to give the idea that it's some kind of external entity forcing your country to do something. It's not. It's an assembly. And it's insulting to people from Brussels. I don't want this any more than you do.

Being belgian I thought that the city of Brussels did something. Using the term EU is more precise I guess in this case. For us, Brussels is just a town in our country, not the EU or representing the EU.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#128

Post by dlahoda » Tue, Apr 21, 2026, 9:11 AM UTC

Why it needs documents? From video of liveness check it clearly visible that 35 years old bearded man is over 18.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#129

Post by yaro330 » Tue, Apr 21, 2026, 9:18 AM UTC

Oh God not this stupid tweet again. He's "hacking" it from a rooted phone. You can't just willy nilly edit those files like that on a normal phone. Fml I would've written a CN under that.

On top of that they didn't infiltrate anything.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#130

Post by GuB-42 » Tue, Apr 21, 2026, 9:30 AM UTC

edarchis wrote: post #106

Please stop saying "Brussels" to mean the EU. It's a nasty trick to give the idea that it's some kind of external entity forcing your country to do something. It's not. It's an assembly. And it's insulting to people from Brussels. I don't want this any more than you do.

The assembly seats in Brussels, so the decision comes from Brussels (geographically).

It doesn't imply that people from Brussels are the ones to decide, not everyone has the same idea anyways. Though, as citizens of a EU member state, they have some responsibility, at least indirectly.