Brussels launched an age checking app. Hackers took 2 minutes to break it • Hacker News Board

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#191

Post by Aurornis » Tue, Apr 21, 2026, 3:25 PM UTC

senorqa wrote: post #101

Why does this app even exist? Why is everyone in this thread so okay with more surveillance? It’s ironic that people are arguing over technicalities instead of tackling the moral and societal impact of age verification.

> Why is everyone in this thread so okay with more surveillance?

Sentiment on hacker news is surprisingly split on age verification as an abstract concept. There are always a lot of posts in favor of age verification.

I’ve tried engaging with some of them and it usually reveals a belief that age verification will only apply to certain sites they don’t use and don’t want other people using easily: Facebook, porn sites, TikTok, Instagram and the like.

As soon as age verification comes too close to services we might use, like Discord, the sentiment turns to complete outrage.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#192

Post by atoav » Tue, Apr 21, 2026, 3:27 PM UTC

anticrymactic wrote: post #165

atoav wrote: post #109

It would be possible to implement age verification in a way that would somewhat work and that would be to use the correct crypto on an government issued ID card. Crypto where the OS (or a website) can ask the card: "Is the holder of that card over X years old y/n?" and the card would just answer with a binary yes no question without exposing any other data while still checking the government signature. Obviously that…

> Crypto where the OS (or a website) can ask the card: "Is the holder of that card over X years old y/n?" and the card would just answer with a binary yes no question without exposing any other data while still checking the government signature. This is the same as "What's the card holders age" by simply binary searching for it. A better way would be: 1. Have the card define the countries age access levels. (Example…

I don't think this belongs on the card to be honest. Otherwide each legislative adjustment would require population-scale updates.

This can go into the reader of anybody who e.g. sells beer to pick your example:

  1. Reader knows beer >= 18 because reader is in Germany  
  
  2. Reader asks card to verify >= 18
  
  3. etc.

This keeps the many cards simple and safe, while the locale is set to the thing that is both easier to police, to update and to support (far less people sell beer than buy it).

Self exclusion would still be possible if there is a standard for it.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#193

Post by atoav » Tue, Apr 21, 2026, 3:31 PM UTC

Cthulhu_ wrote: post #157

atoav wrote: post #109

It would be possible to implement age verification in a way that would somewhat work and that would be to use the correct crypto on an government issued ID card. Crypto where the OS (or a website) can ask the card: "Is the holder of that card over X years old y/n?" and the card would just answer with a binary yes no question without exposing any other data while still checking the government signature. Obviously that…

in the Netherlands we have a better system called iDIN; it works like doing an online payment (iDeal / WERO): * Website asks for age verification * User is redirected to their bank * Bank asks the user to log in - username/password, 2fa, bank app (whose login is behind the device's security and a secondary verification like PIN code or biometrics) * Bank tells the requester that the user is 18+, no more This leverage…

There are people without bank account. It isn't a big part of the population (estimated to be 0.02% or about 16.000 people in Germany), but I still feel on principle this is a basal governmental function that should remain governmental and not tied to other services that can be denied to you for various reasons. This or you make having a bank account a guaranteed human right. I am fine with both.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#194

Post by some_random » Tue, Apr 21, 2026, 3:39 PM UTC

edarchis wrote: post #106

Please stop saying "Brussels" to mean the EU. It's a nasty trick to give the idea that it's some kind of external entity forcing your country to do something. It's not. It's an assembly. And it's insulting to people from Brussels. I don't want this any more than you do.

The EU can force member states to do things though, what do you mean?

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#195

Post by summm » Tue, Apr 21, 2026, 4:00 PM UTC

goobatrooba wrote: post #168

subscribed wrote: post #59

Earlier quoted context omitted.

The main issue appears to be that as per the blueprint user MUST use one of the mandated handsets (iPhone or Android with pre-installed and privileged Google Services) and: - MUST use either Google or Apple account - must not be banned by the provider or sanctioned in the USA These issues have been flagged to the devs working on the blueprint since the inception, only to be handwaved away. Getting banned can happen r…

The technical specifications published online foresee publication of the app also on alternative android stores, but Linux phone users are missing out. Though I guess things could always be extended...

Their security model requires remote attestation. So, open, user-controlled platforms cannot be used. Of course some other future locked-down linux-based OS might be usable.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#196

Post by spiderfarmer » Tue, Apr 21, 2026, 5:12 PM UTC

cm-t wrote: post #181

spiderfarmer wrote: post #172

Earlier quoted context omitted.

Speaking of well chosen words. If you have to put "funny" between quotes at the beginning of a sentence, just tell us how you really feel. I fully understand the people who say it's all about control. I also understand why politicians feel they have to do something. My wife works with low IQ, low income and otherwise underprivileged kids. The completely unsupervised 'iPad' generation, if you will. There are no adults…

Let's take an example with a current project of law from Macron (french president): "Some people can't support their health condition, and they should be helped to die". This end of life law is introduced like a care service for people having issue with health with no happy ending at sight. The reality of the vision of Macron (liberale capitalist) is: All his actions are made to kill public health care, and aims to o…

It might help to broaden your perspective a bit and look at multiple sources, before you spread rumours like they are facts.

Under Emmanuel Macron, France has been debating a law on “assisted dying” (aide à mourir). This is not a general idea that “some people should be helped to die,” but a narrowly defined proposal.

The draft would apply only in very specific situations:

- Adults (18+)

- With a serious and incurable illness

- Often life-threatening or terminal

- Experiencing unbearable suffering

- Who make a voluntary and well-considered request

If approved, the patient would typically self-administer the medication. Only if physically unable would a doctor be allowed to assist.

For context, Netherlands already has a regulated system for euthanasia. This policy allowed my terminally ill grandmother to pass away with dignity. She hated her final days, being bedridden, in pain, and dependent on others for basic needs like taking a shit.

Because of this policy, she was able to say goodbye to everyone she loved, over 100 family members, and make her own decision. No one questioned her choice.

Honestly, that’s the kind of dignity and control I would want for myself if I would ever end up in that situation.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#197

Post by thomastjeffery » Tue, Apr 21, 2026, 5:30 PM UTC

Cthulhu_ wrote: post #159

thomastjeffery wrote: post #82

Earlier quoted context omitted.

The first premise you are avoiding is that a child can misuse a phone. The second premise you are avoiding is that the government can define , for every child, what constitutes misuse. You are advocating thought crime. You do not have my support. My government cannot adequately manage responsibility for my cupboards. It therefore shall not have authority over them.

Your government does have various authorities over what you put in your cupboards though. like, you can't just put a gun in there (actually I don't know where you live but that's true for most countries). You can't just get in a car. Anyway, ultimately it's best effort. No security is flawless, but if it stops 99% or more of cases it's better than 0%.

Cases of what? Beer in an unlocked cupboard? Porn on an unverified computer?

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#198

Post by thomastjeffery » Tue, Apr 21, 2026, 5:32 PM UTC

notTooFarGone wrote: post #97

thomastjeffery wrote: post #82

Earlier quoted context omitted.

The first premise you are avoiding is that a child can misuse a phone. The second premise you are avoiding is that the government can define , for every child, what constitutes misuse. You are advocating thought crime. You do not have my support. My government cannot adequately manage responsibility for my cupboards. It therefore shall not have authority over them.

Do you also refuse to show id when buying alcohol because the gubbernment does not have authority over what you may buy? That's how you sound.

No, because that's a public store. The government can go to the store. They can't go to my cupboards without a warrant. The same goes for my computer, and its connection to another computer.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#199

Post by thomastjeffery » Tue, Apr 21, 2026, 5:41 PM UTC

close04 wrote: post #96

thomastjeffery wrote: post #82

Earlier quoted context omitted.

The first premise you are avoiding is that a child can misuse a phone. The second premise you are avoiding is that the government can define , for every child, what constitutes misuse. You are advocating thought crime. You do not have my support. My government cannot adequately manage responsibility for my cupboards. It therefore shall not have authority over them.

I replied to the content of the article and HN comments, not what you think I should have replied to. If anything you even failed to notice that I expect parents to do some of the parenting and not expect an app to magically do it all for them. The government already defines what misuse is both for children and adults, defines responsibility for a lot of things even in your cupboard, and has been doing so for as gove…

Why would I want to write better? This is a comment on a website.

You replied to a subset of the topic, and that's the point I was making. I felt the conversation needed relevant details from outside that subset, so I provided them.

I was terse in my comment, because that's how I like comments: short and to the point. That makes them much easier to skim through.

The government doesn't enforce its rules by going through my cupboards. It doesn't put a lock on them. Instead, it tells me what the rules and consequences are, placing both authority and responsibility for the cupboards themselves into my hands.

This is the primary change we are taking about: allowing the government to introduce its own code (lock) into my private digital interactions. Why are you so intent on focusing the conversation on the mechanics of that lock? Is it really so unreasonable for me to ask you to think about the rest of the topic?

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#200

Post by sofixa » Tue, Apr 21, 2026, 6:00 PM UTC

themaninthedark wrote: post #167

sofixa wrote: post #43

Earlier quoted context omitted.

Stop with the scaremongering. This is a reference app implementation that uses a detailed framework which explicitly has as a core tenet double blindness. The place you prove your age to has no idea about anything other than you being of age, and the thing you use to prove your age has no idea about where you're using that proof.

Why do I need to prove my age again? Right because a child might get online with a phone or computer and see something bad. I think you should take your own advice: >Stop with the scaremongering.

Few pretty good reasons.

First, yes, it has been proven that there are things online children accessing is damaging to their development. From social media to porn.

Second, and much more important to me, proof that you are actually a human from an approved location. Bots and spam are a problem in general, but specifically foreign meddling in critical moments like elections and referenda is extremely dangerous for democracies. Being able to gatekeep participation in public forums based on you actually being a human in that country would kneecap foreign interference. It can't do anything against local interference, but at least it restricts its volume/scale, which is better than nothing.