Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brussels launched an age checking app. Hackers took 2 minutes to break it

politico.eu

Post reply on HN
Print view View original

81–90 of 221 posts

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#81

Post by thomastjeffery »

Sweepi wrote: post #51
Atreiden wrote: post #45

Earlier quoted context omitted.

I don't like the idea of a central authority determining what "my child should be kept away from" and then implementing Orwellian surveillance laws to enforce it. "For the sake of the children". Seeing something scary, disturbing, or sexual on the internet as a child does not result in a maladjusted adult. These laws are about one thing and one thing only - furthering the global surveillance network. Everything else…

| 'I don't like the idea of a central authority determining what "my child should be kept away from" and then implementing Orwellian surveillance laws to enforce it.' Well thank God this about a double-blind way to verify your age and not that.

The surrounding context is that. Why else would you participate with a government in an age verification system?

Maybe your argument is that it's not a surveillance state because it is implemented with a 0 knowledge proof. Sure, the age verification is, but that is only part of the system we are talking about. The rest of the system is the demand that every adult play keep-away with their verification, and every host on the internet (that can be adequately threatened) play, too.

The only way for this to be anything else is if every participant can individually decide what should and should not be kept away from children. Such a premise is fundamentally incompatible.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#82

Post by thomastjeffery »

close04 wrote: post #15

On top of the pretty bad article, HN finds the “can’t win” scenario again. There’s no age verification scheme that will survive “collusion”, that’s when the adult allows the minor to use validated credentials, devices, etc. And whatever more intrusive age verification schemes we come up with will also fail this but add the intrusiveness to ruffle even more HN feathers. We can have the constant face, fingerprint and D…

The first premise you are avoiding is that a child can misuse a phone.

The second premise you are avoiding is that the government can define, for every child, what constitutes misuse.

You are advocating thought crime. You do not have my support.

My government cannot adequately manage responsibility for my cupboards. It therefore shall not have authority over them.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#83

Post by HWR_14 »

snackbroken wrote: post #66
JimDabell wrote: post #39

Earlier quoted context omitted.

> It is my understanding that this is not possible. I would be happy to be shown to be wrong, but to me it seems like you can either prevent people from lending out their credentials, or you can preserve the anonymity of the user, but not both. This is not designed to prevent adults from coöperating with minors; that makes no sense as a design goal because any technical measure can always be bypassed with “download t…

But laws against selling/giving alcohol to minors are moderately successful at curbing teen alcohol use because they carry with them a risk of punishment that grows with the scale of the operation. If all it took was one adult who thought "kids should be allowed to drink if they want" to provide all the kids in the country with free booze and that adult had no meaningful fear of repercussions, the laws would be nothi…

That one adult could also just download and serve the content without an age gate. The security system on the original download seems irrelevant.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#84

Post by deminature »

Sweepi wrote: post #10

These are the sources cited by the article: [1] https://xcancel.com/Paul_Reviews/status/2044502938563825820 [2] https://xcancel.com/paul_reviews/status/2044723123287666921 [3] https://csa-scientist-open-letter.org/ageverif-Feb2026 | "The saga is turning into a PR disaster for Brussels. " imo: mostly because the Author wants it be a disaster. The App has not launched, they published the source code in order to invite…

Not immediately deleting the selfie is a pretty fundamental and egregious mistake to make. People are particularly sensitive to selfies not being handled correctly after Discord lost thousands of them, despite promising to delete them after age verification occurred (and then not doing so) https://www.bbc.com/news/articles/c8jmzd972leo

The damage is limited because the selfie is only retained on device, but it still does not signal competency from the EU to fail at the most basic hurdle of disposing of the selfie once verification is complete.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#86

Post by somenameforme »

JimDabell wrote: post #3

Note that this is an implementation of eIDAS: https://www.eudi-wallet.eu/ The point of this is that you can use the credentials on your phone to prove that you are an adult to a website using zero-knowledge proofs to avoid disclosing your identity to anybody. If somebody who has access to your unlocked phone can access the data in the app, then this is something that should be tightened up but it’s a substantial priv…

Can you give a brief explanation of how this is done with a zero-knowledge proof? That site is low information and painful to navigate, and it seems quite surprising to me that this is possible. ID verification, in the government sense, is ostensibly going to require matching an ID against a some other resource. If done locally then you can trivially spoof the result, akin to hacking a game, but if done remotely then it's not zero-knowledge.

I think a zero-knowledge system here would be quite desirable. But a centralized repository that is e.g. maintaining tabs on every single adult-authorization for every single person with verifiable details of them is, by contrast, a dystopic disaster waiting to happen because it will be hacked, leaked, and abused, sooner or later.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#87

Post by saghm »

JimDabell wrote: post #55
kdheiwns wrote: post #47

Earlier quoted context omitted.

Then just get rid of the age gating and verification entirely because it's useless.

Other parents have different opinions to you about the value of this.

Okay, so those parents can just not give their kids their phones, and everyone else can continue living life as usual without needing a fancy new way of telling websites how old they are

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#88

Post by grey-area »

nalekberov wrote: post #77
Sweepi wrote: post #12

Earlier quoted context omitted.

Well, reality called and says: Like ID, drivers license, credit cards and guns: Phones are sth. you dont just "share" with your kids. Also there is an option to guard the ID App with an additional PIN/Biometric.

In theory, maybe yes. But in practice people do share their phones with their kids.

Sure and when they do that they share unfiltered access to their banking apps, email, messages, the entire intent including unwholesome bits etc.

Not much the government should or could do about that - it’s a parental decision.

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#89

Post by michelb »

Sweepi wrote: post #10

These are the sources cited by the article: [1] https://xcancel.com/Paul_Reviews/status/2044502938563825820 [2] https://xcancel.com/paul_reviews/status/2044723123287666921 [3] https://csa-scientist-open-letter.org/ageverif-Feb2026 | "The saga is turning into a PR disaster for Brussels. " imo: mostly because the Author wants it be a disaster. The App has not launched, they published the source code in order to invite…

>The App has not launched, they published the source code in order to invite external review.

I read that from many reactions in discussions, but not from their own channels? (Maybe I missed that)

It is ready for deployment: https://commission.europa.eu/news-and-media/news/european-ag...

The message is that it is ready, 'ticks all the boxes' (the published code does not) and that is now ready for integration by other countries. https://xcancel.com/vonderleyen/status/2044340323120193595#m

Then in the article I read that what we see now is a 'demo' version. So the code on Github is not the current code?

Re: Brussels launched an age checking app. Hackers took 2 minutes to break it

#90

Post by bkmq »

HWR_14 wrote: post #83
snackbroken wrote: post #66

Earlier quoted context omitted.

But laws against selling/giving alcohol to minors are moderately successful at curbing teen alcohol use because they carry with them a risk of punishment that grows with the scale of the operation. If all it took was one adult who thought "kids should be allowed to drink if they want" to provide all the kids in the country with free booze and that adult had no meaningful fear of repercussions, the laws would be nothi…

That one adult could also just download and serve the content without an age gate. The security system on the original download seems irrelevant.

That would require all the infrastructure to serve the content, compared to just serving the file ”proving” you are an adult.
Post reply on HN