# content
On April 15, Ursula von der Leyen announced that the European age verification app is “technically ready” and meets “the highest privacy standards in the world.” Within hours, Paul Moore, a British security consultant and founder of Privacy Protocol, published two analyses of the application’s source code on X, flagging what he claims are significant issues with PIN handling and the collection of images during verification.

A necessary caveat: what follows are observations Moore shared on X, not a formal security advisory, and the Commission hasn’t publicly responded yet. Moore isn’t just anyone in this field, though. In 2022, he documented how Eufy cameras were uploading biometric data and facial images to the manufacturer’s AWS servers without encryption or consent, leading him to file a GDPR violation lawsuit. Previously, he’d demonstrated a PIN bypass in RoboForm’s Android password manager app, using a mechanism remarkably similar to what he’s describing now for the European app.

The PIN bypass Moore describes

According to the researcher, during setup the app asks users to create a PIN, encrypts it, and saves it in the shared_prefs directory. Moore argues that the PIN shouldn’t be encrypted at all, and more importantly, it isn’t cryptographically tied to the vault containing identity data. As a result, an attacker could remove the PinEnc and PinIV values from the file, restart the app, set a new PIN, and gain access to the previous profile’s verification data, ready to be presented as valid.

Moore adds that rate limiting appears to be implemented as a simple numeric counter in the same config file, resettable manually, and that the biometric authentication option is a boolean flag modifiable the same way. He closed his post with a direct reference to von der Leyen, claiming the product will be, in his view, the catalyst for a major data breach sooner or later.

Biometric images and selfies written to disk

The second report, published the day before, concerns how the app handles collected images. Moore writes that data extracted from verification, such as is_over_18: true, is properly protected with AES-GCM. The problem, according to him, lies in the original images from which that data is extracted, namely the document photo and the user’s selfie.

When reading an NFC document, the app extracts the DG2 file (containing the passport’s biometric photo) and writes a lossless PNG to the filesystem, deleting it only if the read succeeds. If something goes wrong, a crash, a back button tap, or a scanning error, the image remains in the cache. For selfies, the scenario he describes is worse: PNGs get written to external storage and never deleted, stored long-term rather than as temporary cache. On Android, “external storage” doesn’t necessarily mean an SD card, but rather a shared memory area subject to different protections than the app’s private storage. In both cases, Moore contends, the files are protected by Android’s keys, but the app adds no encryption of its own.

Support Yoota · affiliate link

Suggestion The Swiss alternative to Google Drive
Hover / Tap

The researcher compared it to taking a photo of a document with the camera app and keeping it in the gallery “just to be safe,” adding that since these are biometric data (a special category under GDPR), unjustified retention could constitute a substantial violation of the regulation.

Context behind the EU announcement

The app, developed by Scytáles and T-Systems, is currently in pilot phase in Italy, France, Spain, Denmark, and Greece, and is built on the same technical specifications as the future European digital identity wallet. The fact that the code is open source was presented by the Commission as a transparency guarantee, based on the assumption that anyone can review it, which is exactly what Moore claims to have done.

Moore’s findings aren’t the first concerns to emerge about the application. In March, an independent analysis identified an architectural weakness in the issuer component, unable to verify that passport validation actually occurred on the user’s device. For now, the Commission’s claims and the researcher’s observations stand, pending a substantive response from Brussels.

For your information: X links can also be viewed using xcancel.com or nitter.net in place of x.com in the URL.

SOURCE:// x.com

SOURCE:// x.com

SOURCE:// commission.europa.eu

SOURCE:// reclaimthenet.org

# contentMap.en
On April 15, Ursula von der Leyen announced that the European age verification app is “technically ready” and meets “the highest privacy standards in the world.” Within hours, Paul Moore, a British security consultant and founder of Privacy Protocol, published two analyses of the application’s source code on X, flagging what he claims are significant issues with PIN handling and the collection of images during verification.

A necessary caveat: what follows are observations Moore shared on X, not a formal security advisory, and the Commission hasn’t publicly responded yet. Moore isn’t just anyone in this field, though. In 2022, he documented how Eufy cameras were uploading biometric data and facial images to the manufacturer’s AWS servers without encryption or consent, leading him to file a GDPR violation lawsuit. Previously, he’d demonstrated a PIN bypass in RoboForm’s Android password manager app, using a mechanism remarkably similar to what he’s describing now for the European app.

The PIN bypass Moore describes

According to the researcher, during setup the app asks users to create a PIN, encrypts it, and saves it in the shared_prefs directory. Moore argues that the PIN shouldn’t be encrypted at all, and more importantly, it isn’t cryptographically tied to the vault containing identity data. As a result, an attacker could remove the PinEnc and PinIV values from the file, restart the app, set a new PIN, and gain access to the previous profile’s verification data, ready to be presented as valid.

Moore adds that rate limiting appears to be implemented as a simple numeric counter in the same config file, resettable manually, and that the biometric authentication option is a boolean flag modifiable the same way. He closed his post with a direct reference to von der Leyen, claiming the product will be, in his view, the catalyst for a major data breach sooner or later.

Biometric images and selfies written to disk

The second report, published the day before, concerns how the app handles collected images. Moore writes that data extracted from verification, such as is_over_18: true, is properly protected with AES-GCM. The problem, according to him, lies in the original images from which that data is extracted, namely the document photo and the user’s selfie.

When reading an NFC document, the app extracts the DG2 file (containing the passport’s biometric photo) and writes a lossless PNG to the filesystem, deleting it only if the read succeeds. If something goes wrong, a crash, a back button tap, or a scanning error, the image remains in the cache. For selfies, the scenario he describes is worse: PNGs get written to external storage and never deleted, stored long-term rather than as temporary cache. On Android, “external storage” doesn’t necessarily mean an SD card, but rather a shared memory area subject to different protections than the app’s private storage. In both cases, Moore contends, the files are protected by Android’s keys, but the app adds no encryption of its own.

Support Yoota · affiliate link

Suggestion The Swiss alternative to Google Drive
Hover / Tap

The researcher compared it to taking a photo of a document with the camera app and keeping it in the gallery “just to be safe,” adding that since these are biometric data (a special category under GDPR), unjustified retention could constitute a substantial violation of the regulation.

Context behind the EU announcement

The app, developed by Scytáles and T-Systems, is currently in pilot phase in Italy, France, Spain, Denmark, and Greece, and is built on the same technical specifications as the future European digital identity wallet. The fact that the code is open source was presented by the Commission as a transparency guarantee, based on the assumption that anyone can review it, which is exactly what Moore claims to have done.

Moore’s findings aren’t the first concerns to emerge about the application. In March, an independent analysis identified an architectural weakness in the issuer component, unable to verify that passport validation actually occurred on the user’s device. For now, the Commission’s claims and the researcher’s observations stand, pending a substantive response from Brussels.

For your information: X links can also be viewed using xcancel.com or nitter.net in place of x.com in the URL.

SOURCE:// x.com

SOURCE:// x.com

SOURCE:// commission.europa.eu

SOURCE:// reclaimthenet.org

# name
EU age verification app flagged for security issues hours after launch announcement

# nameMap.en
EU age verification app flagged for security issues hours after launch announcement

# preview.content
Security researcher Paul Moore flags critical PIN and biometric image handling vulnerabilities in the EU's age verification app, just hours after the Commission announced it meets the world's highest privacy standards.

# summary
Security researcher Paul Moore flags critical PIN and biometric image handling vulnerabilities in the EU's age verification app, just hours after the Commission announced it meets the world's highest privacy standards.

# summaryMap.en
Security researcher Paul Moore flags critical PIN and biometric image handling vulnerabilities in the EU's age verification app, just hours after the Commission announced it meets the world's highest privacy standards.