EU’s official age verification app found exposing sensitive user data; also EU Age Verification can be bypassed using their own infrastructure (opens in new tab)

> Hacking the EU Age Verification app in under 2 minutes. > > During setup, the app asks you to create a PIN. After entry, the app encrypts it and saves it in the shared_prefs directory. > > 1. It shouldn’t be encrypted at all - that’s a really poor design. > 2. It’s not cryptographically tied to the vault which contains the identity data. > > So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app. > > After choosing a different PIN, the app p...