John Z Black

John Z Black Apr 21, 2026 Policy, Law & Governance #eu #age-verification #identity #privacy #child-safety

When government PR-cycles outpace engineering rigor, you get Security Theater. The European Commission recently launched a high-profile age verification app. It was cracked in under two minutes.

This was not exactly an Oceans Eleven style heist. UK security consultant Paul Moore demonstrated that he could bypass PIN protection, biometric checks, and lockout mechanisms by simply editing a local configuration file on the device.

Think about that for a second. An app built to verify identity and protect minors has no basic client-side isolation for its own secrets. Within hours of the release, the Safe by Design claims were gone.

The response from the Commission has been even more fascinating. Regulators are reportedly calling the failure a demo or prototype problem. That ignores the massive political weight this tool was supposed to carry for future legislation. Calling it a prototype after it fails is a classic move to avoid accountability for poor technical due diligence.

The lesson here is simple. Do not trust Official App stickers for sensitive data if the local storage can be manipulated with a 2-minute text edit. Security theatre does not protect anyone. It just creates a false sense of safety until a real person looks at the config files.

Read the full breakdown of how biometrics were bypassed with a text buffer.