Story perspectives

EU Age-Verification App Hacked Within Minutes, Data Exposed

4/25/2026

Summary

**Paul Moore Hacks**

The European Union released an age-verification app on April 15 2026, calling it “technically ready.”
Security consultant Paul Moore hacked the app in under two minutes, exposing unencrypted biometric data.
A patched version appeared on April 17 2026, though Moore still found it easy to bypass.
Experts warned the design harms privacy, excludes undocumented users, and fails to address platform-driven risks.

Summary

**Moore Flags Patch**

The April 17th patch still uses deprecated Android libraries—androidx.security:security-crypto, EncryptedSharedPreferences and MasterKeys—despite being a hardening measure.
Security consultant Paul Moore and app specialist Milosz Gaczkowski clashed, with Gaczkowski saying the bypass only confirms age, not steals data.
The fix hashes PINs with PBKDF2-SHA256 at 210,000 iterations, below OWASP’s 600,000-iteration recommendation.
Root-detection checks only known su binaries, while Europe suffered breaches at Basic-Fit, Booking.com and a Bluesky DDoS attack.

1 of 2

**Paul Moore Hacks**

The European Union released an age-verification app on April 15 2026, calling it “technically ready.”
Security consultant Paul Moore hacked the app in under two minutes, exposing unencrypted biometric data.
A patched version appeared on April 17 2026, though Moore still found it easy to bypass.
Experts warned the design harms privacy, excludes undocumented users, and fails to address platform-driven risks.

1 / 2