9 ms·

Guess I'm Done with Discord

86 points by stargrave 7y ago

rpgraham84 7y ago
Writes weird posts about how some pedophilia is okay, uses tor with tails compulsively? 10 bucks says this dude goes to prison for child porn within the next 10 years.
- wowaname 7y ago
  You do this with every privacy-conscious, freethinking person who comments on this site?
  - berbec 7y ago
    The amount of flak you are getting from a supposedly informed audience is discouraging to me. The fact you value your privacy has turned you into a pedo in some people's views. Stick to your guns - discord has the right to be just another data-mining operation and you have the right to draw a line and say, no more.
    - wtfwhateven 7y ago
      >The fact you value your privacy has turned you into a pedo in some people's views. No, it wasn't that. It's https://wowana.me/blog/the-grey-area-of-paedophilia.xht https://wowana.me/blog/the-grey-area-of-paedophilia.xht probably.
ChuckMcM 7y ago
I am more and more thinking of this as a symptom of the "Data wars." I define that as the conflict between how much data someone is willing to share in exchange for a 'free' service. The services aren't free of course, they pay their overhead and costs by re-selling the data they collect about their users. And as other sources of revenue (like ads) have lost value the data service has filled in. And since the data buyers know that the service provider is in a weak negotiating position they keep pressing on them to get more and more datamilk out of their data cows for the same amount of money. The pressure is on to create a low friction pay as you go service for these things that don't extract data.
- cpdt 7y ago
  Since the OP is specifically talking about Discord, it’s worth mentioning that what you’re talking about doesn’t seem to be the case for them - they make money from Nitro subscriptions and their game store, and state in their privacy policy that they are “not in the business of selling your information” (https://discordapp.com/privacy https://discordapp.com/privacy, in the section ‘Our Disclosure of Your Information’). So relating back to the post, their justification doesn’t necessarily make it right, but I think it’s incorrect to attribute it to a malicious cause.
Prohias 7y ago
If the only deal breaker is your phone number, this is going to be an issue for you moving into the future with many service providers. Consider leasing a number through Twilio, it will save you from frustration.
- wowaname 7y ago
  I'm probably going to leave phone companies entirely, when I'm no longer on my family's plan, and set up a VoIP number because it'd give me hands-on experience with how VoIP works and it seems more cost-effective for my use case. I'll remember Twilio if I need it for any verification purposes, but it's definitely a sad state of affairs that phone numbers are seen as a mandatory identification step in this day and age. I understand that it's an easy choice for some companies to make, but it doesn't mean I have to be happy with it.
ricardbejarano 7y ago
A private company has the right to choose where its traffic comes from, nothing surprising here. There are legitimate reasons to block TOR traffic, and even if there where none, they'd still have the right to block anyone of their users. There are plenty of alternatives, simply remember not to choose one ran by a private company again.
- wowaname 7y ago
  Luckily I never had all my eggs in Discord's basket, and thankfully so. I will remember this, and I know they are welcome to discriminate against Tor or any other traffic, but that just means they opt for lazy solutions and don't care about false positives. I host websites and online services (at a much smaller scale than Discord, at that) and I know how people use Tor to abuse services. But, I also know that there's a comparable number of incidents coming from traditional ISPs, hosting ranges, dynamic home IP addresses, public proxies... you name it. This is extremely apparent in the form of E-mail SPAM. I just believe that placing bans or flags on IP addresses is not the answer, and I will work on my own software and services with this ideology in mind. Ironically, Discord did have what I believe to be a stellar answer to guild moderation: invite links. They allowed a whitelisting model for private guilds, as well as varied forms of controlled access for more-public guilds. I'd like to see this kind of control everywhere.
elmerfud 7y ago
This is a typical response from service companies in the Internet age. They don't care about truth, or what actually happened, the algorithm says you're bad then you're bad. There's no human to appeal to, no human oversight of if their algorithm is right or wrong. They use another algorithm to check it, which tells them that you must be a bad actor. I've had my own issues with Lyft that are similar. Banned from using their service even though I've never actually ordered a ride from them. Banned upon sign up. No review, no appeal, they don't even follow their own terms of service. I'm not one to normal advocate for government regulations and oversight, but there's way to much consumer abuse for these Internet age services. Consumer protections can't come soon enough.
- Judgmentality 7y ago
  Assuming you're willing to share, how did you get banned from Lyft without ever ordering a ride?
  - scrollaway 7y ago
    Dunno about GP but I had a similar experience with Lyft, which had to do with the type of card I registered to Lyft. I don't remember the specifics but my case wasn't particularly weird… I was using an EU mastercard of some kind and they decided it was a bad one so they banned me. This all happened without ordering a ride. Had a similar experience with Uber, except that Uber actually eventually fixed it. Lyft was… unhelpful.
  - pedrocx486 7y ago
    I had a similar experience with two other services. Digital Ocean banned be as soon as I registered. I verified my email, then was asked to confirm some personal info, as I was filling their form, I got an email telling me my account was disabled permanently and it was final. (I went on to use Linode and Scaleway after that.) And Pokemon Go, which I never installed on any of my phones, I got an email saying my account was banned. I wonder what account, since I never signed up to their services.
  - elmerfud 7y ago
mostlysimilar 7y ago
I understand the frustration on the part of the user and I dislike that we're all being forced to give up our anonymity to use these platforms... but also the tone of both emails was quite antagonistic. They may have had slightly better luck if they'd been friendlier and not attempted to school the Discord staff on how their app should behave.
- throwaway2048 7y ago
  You know what else is antagonistic? removing you from the service. https://thebaffler.com/salvos/critique-of-pure-niceness-whyman https://thebaffler.com/salvos/critique-of-pure-niceness-whym...
- jacquesm 7y ago
  > but also the tone of both emails was quite antagonistic The customer is always right. > They may have had slightly better luck if they'd been friendlier and not attempted to school the Discord staff on how their app should behave. Or not. Besides, it should not matter, either they did something bad or they did not, the tone of the message may upset the recipient but when you ban someone just like that you can expect them to be upset and your first line support people should be able to take that sort of heat in stride. Sucking up to support staff when your account has been banned for no particular reason should not be a pre-requisite for having it dealt with professionally, in fact a good first line support worker will be able to de-escalate such a situation quickly by showing some competence and making sure the user is dealt with as they should.
  - Pfhreak 7y ago
    > The customer is always right. This meme needs to go away. The customer is not always right, and it's deeply unhealthy for businesses to adopt this attitude. Even very customer centric businesses do not adopt this mantra.
    - Spivak 7y ago
      I mean the statement has never been about infallibility or anything it just means “the customer’s feelings are always valid” but was coined before such language was common.
Havoc 7y ago
I've been waiting for this in a way. This surge in adopt is pretty classic. It feels artificially hot / running at too high temps if that makes sense. I don't see a superior product so don't see this crashing, but Discord is going down only from here
esotericn 7y ago
It's frustrating to be a power user in general with these sort of 'automated lockout detection' mechanisms. I've lost count of the number of times I've tried to log in to, I dunno, eBay or whatever, and computer says no, and I have to call some bloody line and speak to someone who hates their job and doesn't understand what I mean when I talk about IP addresses. I wish that these services had a way to check some box and say "look, I really know what I'm doing, let anyone with the correct password/SSH key/whatever in". If it gets hacked, _then_ I can go through all of that shit. In this case we're talking about a bloody chat server for christ's sake.
- Pfhreak 7y ago
  You think the right set of people will check that box? And that if they do get hacked they won't cost the company a ton of resources in support/lawsuits/etc?
  - esotericn 7y ago
    I mean, in practice, the 'right set of people' just don't use the service, so you're probably right. I've probably made about ten discord accounts with random names to join some one off server, then gone back to IRC, because it just works.
  - wowaname 7y ago
    I think the "check box" in this case should be the act of opting into 2FA. I've expressed this to Discord before when asking why they require reCAPTCHA upon login, even for an 2FA-enabled account like mine.
- krick 7y ago
  Yeah, you wish for too much. I remember losing MAL account (yeah, don't judge me) which I had for like 10 years (probably longer, really), not because I didn't have the correct password — I did, but because they fucked up with security not long before that and I suddenly needed to verify it was me via some email account I didn't use for the same 10 years. I mean, really, somebody stealing my MAL account? Why anybody would need that, even I don't need that, it was just silly losing my account I had for so long, because they care so much about me not losing my stupid account. So, fuck MAL. And fuck twice any service, that needs to verify my email/phone/passport name more, than it needs my money I am ready to pay for pizza delivery or whatever.
steve19 7y ago
I like that for privicy reasons they won't tell you why you were banned. Whose privicy? Does that just mean "our black box NN has banned you and we won't know or care why" ?
- giancarlostoro 7y ago
  For privacy reasons implies either what you are suggesting or that they are contacting Discord from an email address not affiliated with the account in question.
  - kadoban 7y ago
    The user specifically said they were using the email address associated with the account.
- buckminster 7y ago
  Many companies have a policy of not explaining how their abuse detection works because the information aids abusers. The stuff about privacy is just nonsense from a clueless support person.
- ljm 7y ago
  Their own privacy most likely. Don't want to reveal the techniques used to identify the accounts they ban, so the scammers can't learn from it.
  - cynoclast 7y ago
    This has nothing to do with privacy and everything to do with harvesting personal information to sell.
Pfhreak 7y ago
> I refuse to provide phone verification as I believe it is Discord's fault for flagging my account... > I will be communicating with a couple communities with which I'm involved to explain that I am unable to use Discord Does this person not have a phone? 'Unable' seems like a stretch. If this person said, "I don't want to provide my phone number to Discord, so I'm going to stop using it" I'd understand. Their opening email also strikes a pretty aggressive tone -- calling Discord anal, insulting, "spit in my face" then goes on to make a number of demands of the company? I'm not super surprised the customer service rep on the other side didn't go out of their way to help.
- chrisseaton 7y ago
  I don't know any of the specifics of what's going on here, but phone verification is sometimes very tricky even for willing people, with a phone, and from western countries. I can't get a Lyft even when in the US because their verification system only works for US phone numbers and I have a British one!
- lidHanteyk 7y ago
  Discord's been an abusive member of the community for a long time. They distort nomenclature, mislead about their intentions, and aren't able to show that they protect personal information. As a light and funny example, Discord doesn't comply with the OpenSSL license.
  - Pfhreak 7y ago
    > Discord doesn't comply with the OpenSSL license. In what way? Have you reached out to Discord to make them aware? They seem fairly committed to open source from everything I've read.
    - lidHanteyk 7y ago
      The OpenSSL license for Discord's bundled versions of OpenSSL [0] has two conditions which are being violated. When they advertise the features of their client, or offer binaries of their client for download, they do not include the verbatim text, "This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)" http://www.openssl.org/)" They know that they are violating this license; they don't care. They are free to clean up their act at any time. [0] https://www.openssl.org/source/license-openssl-ssleay.txt https://www.openssl.org/source/license-openssl-ssleay.txt
Havoc 7y ago
Point 2 in particular rings true. ...If you can't filter out your core user base with 2FA (!!!) from bullshit like recaptch then you've got real problems
- snek 7y ago
  2FA is account security, not proof of being a good human user. TOTP is a very simple algorithm (python impl: https://github.com/pyauth/pyotp https://github.com/pyauth/pyotp) that can be easily automated. After all, your phone telling you the code to type in has automated it.
  - Havoc 7y ago
    Yeah That risk is acceptableness to me though
nullandvoid 7y ago
Strange I was just thinking about this issue the other day Discord is a bit of a haven for spammers / scammers with my own account having received messages from several hundred random accounts ( to be fair the user is normally deleted before I read the message ) As a discussion / personal curiosity point how would the HN community reccomend discord handle this level of spam going forward?
- giancarlostoro 7y ago
  It becomes extremely obvious when someones sharing a link to thousands of users they have never spoken to before. Idk about how you use Discord but I can only send so many messages to so many people in a few minutes.
pfisch 7y ago
1)You're not a paying user 2)You use proxies/tor which probably makes your concerns the concerns of 0.01% of the user-base. Why should a company whose primary motive is to be profitable go so far out of their way for you, a non-paying client whose concerns represent basically none of the legitimate user-base?
- wowaname 7y ago
  The post is entitled "Guess I'm done with Discord", not "I'm entitled to my Discord account and everyone who disagrees with me is an idiot." As I said in another comment, my post was purely informative and not even in a format that would be digestible by people who do not know me.
  - ncmncm 7y ago
    Thank you for the informative posting. I have had no contact with Discord, so I learned something.
- yjftsjthsd-h 7y ago
  > you, a non-paying client whose concerns represent basically none of the legitimate user-base? You seem to be implying that they are not a legitimate user. What makes them any less legitimate than everybody else?
  - pfisch 7y ago
    I am saying that the far majority of users that use tor or proxies are fraudsters.
- throwaway2048 7y ago
  Trust me when i say paying users of discord are treated equally as flippantly.
buboard 7y ago
I want to be done with discord. The only value i find is the notifications when you have an @reply. Isn't there someone that has done this for freenode or other IRC ?
- kadoban 7y ago
  I used to use a bouncer, vnc, which there's a plugin for push notifications. Now I use matrix.org, which bridges to freenode and many (all?) other IRC servers and does notifications well. Quite happy with it, personally.
  - banger180 7y ago
    Yep, I wished matrix would replace discord and all other proprietary crap. Unfortunately the UX is still a bit lacking, but if you somewhat know what you are doing it's great.
- throwanem 7y ago
  Use a bouncer like ZNC and an app that supports it, and you can get push notifications on mentions.
- scrollaway 7y ago
  https://www.irccloud.com/ https://www.irccloud.com/ does what you want (they have an app). If you use IRC heavily, I do recommend paying for it - it's useful and they fund IRCv3 among other things.
- lightedman 7y ago
  mIRC has trigger words. Just input your username as one and when it comes up from someone else mentioning it your window blinks. Been like that for over 20 years.
kart23 7y ago
Tor breaks a lot of shit for me, and I dont even bother with captchas becuase it usually just flags me as a bot. So I dont think this is particularly surprising or out of the ordinary. But yeah, discord used to be held in high standards by me and plenty of other gamers, but they have made it clear that they cannot handle tough situations, and dont really care about their userbase. Someone should start a privacy focused phone number as a service, acces to texts online and through an app. Allow people to basically have a spam phone number that they can give out to online services, but make people pay for it obviously. Like 10minutemail but long term and for texts only.
- throwaway2048 7y ago
  Google captcha is particularly egregious because it will flag you as "never allow in, ever" but not give any indication of this, and still will happily have you solving captchas (that is, working for Google, for free) for 30+ minutes, until you catch on that they aren't ever going to let you past. Captcha v3 is even worse in this regard, because it silently flags you while appearing to let you in...
  - VectorLock 7y ago
    I like this idea since it puts a lot of effort onto bad actors and exhausts their resources.
    - throwaway2048 7y ago
      Cool, lets hope it doesn't consistently consider you a "bad actor" for reasons that it wont ever tell you.
      - VectorLock 7y ago
        I never said the system was flawless, simply that the idea of continuing to present checks instead of explicitly saying "you're blocked" was a clever idea.
mieses 7y ago
Silicon Valley internet services should just relocate to China. Then they wouldn't have to deal with Trump, privacy advocates, or libertarians.
jrockway 7y ago
Discord's phone verification is awful. They are using some super old database of what provider is associated with your phone number. I ported a Google Voice number to Verizon and they said I can't use it for phone verification because it's Grand Central, a company that went out of business before Discord even came into existence. I pay them $99 a year, and their customer service treated me like shit for this. What do I care if someone hacks my account and destroys the large community that I moderate? That's their problem, not mine. But I doubt they care.
- snek 7y ago
  That's Twilio's database, not Discord's. Maybe it's fair to be upset at Discord for using Twilio if Twilio can't keep their database up to date, but I don't think there are that many alternatives to Twilio.
simonblack 7y ago
Social media gets less and less "social" every day. My last remaining social media with input from me is HN. But I accept that, sooner or later, HN will be just as intrusive, aggressive, just plain nasty and censoring as the rest of them. And then it will be time for me to "go completely dark" as far as my contribution to the internet is concerned.
jhgg 7y ago
Hey. I work at Discord - and actually, this system is a thing I work on - and code my team wrote caused your account to be locked. If my team is doing a good job, you won't notice us. If we're doing a bad job, you might get some spam, or your account may be blocked for false positives. Discord gets a lot of spam. We've disabled, and/or challenged millions of accounts for trying to use our platform for unsolicited spam (trying to advertise their service, sex bots, crypto spam, etc...). Our anti-spam systems continue to evolve - just as the spammers who target our platform continue to evolve. The spam attacks against our platform vary in terms of how elaborate and skilled they are. Some are very obvious in terms of a detection perspective, and some are not. As such, we use a blend of signals, heuristics and machine learning algorithms to determine whether someone is spamming on our platform. Additionally, we look at where spam is originating from as an input to our heuristic. One such source is TOR exit nodes - and as such, our system considers content created (DMs opened, etc..) from people using TOR exit nodes with more stringency than other sources. As such, if you are using TOR, it is definitely more likely that you may get challenged either via captcha, or phone verification. The system is definitely not perfect - and unfortunately in OP's case, it flagged the account for phone verification. To address the 3 demands in OP's email: > 1. Discord's anti-spam isn't so anal, I'm not entirely sure what this means, nor what actionable steps I can take. You are using TOR, a source of a great amount of spam/attempted spam on our network. > 2. my account (and other accounts in good standing and with proper 2FA) is exempt from such checks Having 2fa is not a strong signal as to whether or not an account is legitimate. It is very trivial to automate setting up 2fa on an account. https://github.com/pyauth/pyotp https://github.com/pyauth/pyotp can be used to both generate and validate 2fa codes. It'd be trivial to hook that up to the registration flow to enable 2fa - and if that was a way to 'bypass' our anti-spam measures, it'd surely be exploited. > 3. I don't have to solve a Google reCAPTCHA for an account I have taken every step to protect against bruteforcing. Using Tor is not a crime; don't treat it as such. Malicious actors constantly attempt to brute-force logins on our system - generally from public password dumps or other leaks. A lot of these brute-force attempts come from TOR, and other public proxies. In order to avoid information disclosure, we always captcha logins from these kinds of IPs, regardless of whether or not an account exists with the e-mail in question, whether the login credentials are correct, or there is 2fa enabled on the account. So, the "captchas" you notice are not really specific to your account, but rather, the origin of the login. Using TOR is not a crime, you are right - but - it's also our responsibility to our users to make it reasonably hard for their accounts to get compromised on our platform (even if they don't employ the best security practices - and reuse their passwords across the internet.) Finally, I'd like to address: "Discord has shown to be hostile toward FOSS and privacy for a while now" and understand why that is. As a company, we have tried to give back to open source software (either by financial sponsorship, or by contributing our bugfixes/changes upstream.) We also attribute all open source projects we use in our software here: https://discordapp.com/licenses https://discordapp.com/licenses. Additionally, we host many open source communities on our platform: https://discordapp.com/open-source https://discordapp.com/open-source. And finally, we try to open source software we make which may be useful to the eco-system in general: https://github.com/discordapp/ https://github.com/discordapp/. As for privacy, we've stated that we don't sell your data. When you verify your phone number, we ONLY use it for the purpose of anti-spam, and it is never shared with anyone (aside from twilio, which sends you the SMS), especially for the purpose of financial gain. We're pretty up front about how we make money (freemium model: https://discordapp.com/nitro https://discordapp.com/nitro, in-app commerce: https://discordapp.com/sell-your-game https://discordapp.com/sell-your-game). We provide privacy controls: https://support.discordapp.com/hc/en-us/articles/360004109911 https://support.discordapp.com/hc/en-us/articles/36000410991..., and allow you to request an export of all the data we have stored on your account: https://support.discordapp.com/hc/en-us/articles/360004027692-Requesting-a-Copy-of-your-Data https://support.discordapp.com/hc/en-us/articles/36000402769... I know this reply won't satisfy everyone, but hopefully, being truthful and upfront about this will help!
gigel82 7y ago
Why the insistence on Tor? Just use a normal VPN. Tor exit nodes are limited in number, and the same IP probably ends up being used by thousands of people... I assume a lot of them use it for nefarious reasons so you just end up in the same bucket. To some extent VPN providers can get hit by this too, but it's easy to just switch outbound IPs (for most of them). And if you want more than that, get a cheap VPS and install OpenVPN on it (you get your own unique exit IP address) - pay with bitcoin for the privacy aspect, also a good place to install an ad-filter, a secure DNS proxy (DOH) and so on. I also don't understand the 2FA point, that says nothing about your accounts' intentions. The account history is an interesting point... if you have a long-standing history with no reports of inappropriate actions, they should factor that in somehow into their algos.
- wowaname 7y ago
  >Why the insistence on Tor? Short answer: I'm a privacy activist. That should be a valid enough reason for this context. >I also don't understand the 2FA point, that says nothing about your accounts' intentions. No, but it shows my account is secured from intruders, which means reCAPTCHA is just an additional nuisance to me, the legitimate account holder. >The account history is an interesting point Yeah, and they just glance right over it. It doesn't mean anything for my case that I've been an active user with this account for almost two years (I had a previous account for a bit and then left Discord because I was not in any communities worth sticking around for). Never have I done anything wrong on Discord's platform; haven't uploaded any lolis or evaded any bans (I believe I was only banned from one guild, even). They just don't seem to want me as a user, and that's fine.

86 points by stargrave 7y ago

Writes weird posts about how some pedophilia is okay, uses tor with tails compulsively? 10 bucks says this dude goes to prison for child porn within the next 10 years.

wowaname 7y ago
You do this with every privacy-conscious, freethinking person who comments on this site?
- berbec 7y ago
  The amount of flak you are getting from a supposedly informed audience is discouraging to me. The fact you value your privacy has turned you into a pedo in some people's views. Stick to your guns - discord has the right to be just another data-mining operation and you have the right to draw a line and say, no more.
  - wtfwhateven 7y ago
    >The fact you value your privacy has turned you into a pedo in some people's views. No, it wasn't that. It's https://wowana.me/blog/the-grey-area-of-paedophilia.xht https://wowana.me/blog/the-grey-area-of-paedophilia.xht probably.

ChuckMcM 7y ago

I am more and more thinking of this as a symptom of the "Data wars." I define that as the conflict between how much data someone is willing to share in exchange for a 'free' service. The services aren't free of course, they pay their overhead and costs by re-selling the data they collect about their users. And as other sources of revenue (like ads) have lost value the data service has filled in. And since the data buyers know that the service provider is in a weak negotiating position they keep pressing on them to get more and more datamilk out of their data cows for the same amount of money. The pressure is on to create a low friction pay as you go service for these things that don't extract data.

cpdt 7y ago
Since the OP is specifically talking about Discord, it’s worth mentioning that what you’re talking about doesn’t seem to be the case for them - they make money from Nitro subscriptions and their game store, and state in their privacy policy that they are “not in the business of selling your information” (https://discordapp.com/privacy https://discordapp.com/privacy, in the section ‘Our Disclosure of Your Information’). So relating back to the post, their justification doesn’t necessarily make it right, but I think it’s incorrect to attribute it to a malicious cause.

Prohias 7y ago

If the only deal breaker is your phone number, this is going to be an issue for you moving into the future with many service providers. Consider leasing a number through Twilio, it will save you from frustration.

wowaname 7y ago
I'm probably going to leave phone companies entirely, when I'm no longer on my family's plan, and set up a VoIP number because it'd give me hands-on experience with how VoIP works and it seems more cost-effective for my use case. I'll remember Twilio if I need it for any verification purposes, but it's definitely a sad state of affairs that phone numbers are seen as a mandatory identification step in this day and age. I understand that it's an easy choice for some companies to make, but it doesn't mean I have to be happy with it.

ricardbejarano 7y ago

A private company has the right to choose where its traffic comes from, nothing surprising here. There are legitimate reasons to block TOR traffic, and even if there where none, they'd still have the right to block anyone of their users. There are plenty of alternatives, simply remember not to choose one ran by a private company again.

wowaname 7y ago
Luckily I never had all my eggs in Discord's basket, and thankfully so. I will remember this, and I know they are welcome to discriminate against Tor or any other traffic, but that just means they opt for lazy solutions and don't care about false positives. I host websites and online services (at a much smaller scale than Discord, at that) and I know how people use Tor to abuse services. But, I also know that there's a comparable number of incidents coming from traditional ISPs, hosting ranges, dynamic home IP addresses, public proxies... you name it. This is extremely apparent in the form of E-mail SPAM. I just believe that placing bans or flags on IP addresses is not the answer, and I will work on my own software and services with this ideology in mind. Ironically, Discord did have what I believe to be a stellar answer to guild moderation: invite links. They allowed a whitelisting model for private guilds, as well as varied forms of controlled access for more-public guilds. I'd like to see this kind of control everywhere.

elmerfud 7y ago

This is a typical response from service companies in the Internet age. They don't care about truth, or what actually happened, the algorithm says you're bad then you're bad. There's no human to appeal to, no human oversight of if their algorithm is right or wrong. They use another algorithm to check it, which tells them that you must be a bad actor. I've had my own issues with Lyft that are similar. Banned from using their service even though I've never actually ordered a ride from them. Banned upon sign up. No review, no appeal, they don't even follow their own terms of service. I'm not one to normal advocate for government regulations and oversight, but there's way to much consumer abuse for these Internet age services. Consumer protections can't come soon enough.

Judgmentality 7y ago
Assuming you're willing to share, how did you get banned from Lyft without ever ordering a ride?
- scrollaway 7y ago
  Dunno about GP but I had a similar experience with Lyft, which had to do with the type of card I registered to Lyft. I don't remember the specifics but my case wasn't particularly weird… I was using an EU mastercard of some kind and they decided it was a bad one so they banned me. This all happened without ordering a ride. Had a similar experience with Uber, except that Uber actually eventually fixed it. Lyft was… unhelpful.
- pedrocx486 7y ago
  I had a similar experience with two other services. Digital Ocean banned be as soon as I registered. I verified my email, then was asked to confirm some personal info, as I was filling their form, I got an email telling me my account was disabled permanently and it was final. (I went on to use Linode and Scaleway after that.) And Pokemon Go, which I never installed on any of my phones, I got an email saying my account was banned. I wonder what account, since I never signed up to their services.
- elmerfud 7y ago

mostlysimilar 7y ago

I understand the frustration on the part of the user and I dislike that we're all being forced to give up our anonymity to use these platforms... but also the tone of both emails was quite antagonistic. They may have had slightly better luck if they'd been friendlier and not attempted to school the Discord staff on how their app should behave.

throwaway2048 7y ago
You know what else is antagonistic? removing you from the service. https://thebaffler.com/salvos/critique-of-pure-niceness-whyman https://thebaffler.com/salvos/critique-of-pure-niceness-whym...
jacquesm 7y ago
> but also the tone of both emails was quite antagonistic The customer is always right. > They may have had slightly better luck if they'd been friendlier and not attempted to school the Discord staff on how their app should behave. Or not. Besides, it should not matter, either they did something bad or they did not, the tone of the message may upset the recipient but when you ban someone just like that you can expect them to be upset and your first line support people should be able to take that sort of heat in stride. Sucking up to support staff when your account has been banned for no particular reason should not be a pre-requisite for having it dealt with professionally, in fact a good first line support worker will be able to de-escalate such a situation quickly by showing some competence and making sure the user is dealt with as they should.
- Pfhreak 7y ago
  > The customer is always right. This meme needs to go away. The customer is not always right, and it's deeply unhealthy for businesses to adopt this attitude. Even very customer centric businesses do not adopt this mantra.
  - Spivak 7y ago
    I mean the statement has never been about infallibility or anything it just means “the customer’s feelings are always valid” but was coined before such language was common.

Havoc 7y ago

I've been waiting for this in a way. This surge in adopt is pretty classic. It feels artificially hot / running at too high temps if that makes sense. I don't see a superior product so don't see this crashing, but Discord is going down only from here

esotericn 7y ago

It's frustrating to be a power user in general with these sort of 'automated lockout detection' mechanisms. I've lost count of the number of times I've tried to log in to, I dunno, eBay or whatever, and computer says no, and I have to call some bloody line and speak to someone who hates their job and doesn't understand what I mean when I talk about IP addresses. I wish that these services had a way to check some box and say "look, I really know what I'm doing, let anyone with the correct password/SSH key/whatever in". If it gets hacked, _then_ I can go through all of that shit. In this case we're talking about a bloody chat server for christ's sake.

Pfhreak 7y ago
You think the right set of people will check that box? And that if they do get hacked they won't cost the company a ton of resources in support/lawsuits/etc?
- esotericn 7y ago
  I mean, in practice, the 'right set of people' just don't use the service, so you're probably right. I've probably made about ten discord accounts with random names to join some one off server, then gone back to IRC, because it just works.
- wowaname 7y ago
  I think the "check box" in this case should be the act of opting into 2FA. I've expressed this to Discord before when asking why they require reCAPTCHA upon login, even for an 2FA-enabled account like mine.
krick 7y ago
Yeah, you wish for too much. I remember losing MAL account (yeah, don't judge me) which I had for like 10 years (probably longer, really), not because I didn't have the correct password — I did, but because they fucked up with security not long before that and I suddenly needed to verify it was me via some email account I didn't use for the same 10 years. I mean, really, somebody stealing my MAL account? Why anybody would need that, even I don't need that, it was just silly losing my account I had for so long, because they care so much about me not losing my stupid account. So, fuck MAL. And fuck twice any service, that needs to verify my email/phone/passport name more, than it needs my money I am ready to pay for pizza delivery or whatever.

steve19 7y ago

I like that for privicy reasons they won't tell you why you were banned. Whose privicy? Does that just mean "our black box NN has banned you and we won't know or care why" ?

giancarlostoro 7y ago
For privacy reasons implies either what you are suggesting or that they are contacting Discord from an email address not affiliated with the account in question.
- kadoban 7y ago
  The user specifically said they were using the email address associated with the account.
buckminster 7y ago
Many companies have a policy of not explaining how their abuse detection works because the information aids abusers. The stuff about privacy is just nonsense from a clueless support person.
ljm 7y ago
Their own privacy most likely. Don't want to reveal the techniques used to identify the accounts they ban, so the scammers can't learn from it.
- cynoclast 7y ago
  This has nothing to do with privacy and everything to do with harvesting personal information to sell.

Pfhreak 7y ago

> I refuse to provide phone verification as I believe it is Discord's fault for flagging my account... > I will be communicating with a couple communities with which I'm involved to explain that I am unable to use Discord Does this person not have a phone? 'Unable' seems like a stretch. If this person said, "I don't want to provide my phone number to Discord, so I'm going to stop using it" I'd understand. Their opening email also strikes a pretty aggressive tone -- calling Discord anal, insulting, "spit in my face" then goes on to make a number of demands of the company? I'm not super surprised the customer service rep on the other side didn't go out of their way to help.

chrisseaton 7y ago
I don't know any of the specifics of what's going on here, but phone verification is sometimes very tricky even for willing people, with a phone, and from western countries. I can't get a Lyft even when in the US because their verification system only works for US phone numbers and I have a British one!
lidHanteyk 7y ago
Discord's been an abusive member of the community for a long time. They distort nomenclature, mislead about their intentions, and aren't able to show that they protect personal information. As a light and funny example, Discord doesn't comply with the OpenSSL license.
- Pfhreak 7y ago
  > Discord doesn't comply with the OpenSSL license. In what way? Have you reached out to Discord to make them aware? They seem fairly committed to open source from everything I've read.
  - lidHanteyk 7y ago
    The OpenSSL license for Discord's bundled versions of OpenSSL [0] has two conditions which are being violated. When they advertise the features of their client, or offer binaries of their client for download, they do not include the verbatim text, "This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)" http://www.openssl.org/)" They know that they are violating this license; they don't care. They are free to clean up their act at any time. [0] https://www.openssl.org/source/license-openssl-ssleay.txt https://www.openssl.org/source/license-openssl-ssleay.txt

Havoc 7y ago

Point 2 in particular rings true. ...If you can't filter out your core user base with 2FA (!!!) from bullshit like recaptch then you've got real problems

snek 7y ago
2FA is account security, not proof of being a good human user. TOTP is a very simple algorithm (python impl: https://github.com/pyauth/pyotp https://github.com/pyauth/pyotp) that can be easily automated. After all, your phone telling you the code to type in has automated it.
- Havoc 7y ago
  Yeah That risk is acceptableness to me though

nullandvoid 7y ago

Strange I was just thinking about this issue the other day Discord is a bit of a haven for spammers / scammers with my own account having received messages from several hundred random accounts ( to be fair the user is normally deleted before I read the message ) As a discussion / personal curiosity point how would the HN community reccomend discord handle this level of spam going forward?

giancarlostoro 7y ago
It becomes extremely obvious when someones sharing a link to thousands of users they have never spoken to before. Idk about how you use Discord but I can only send so many messages to so many people in a few minutes.

pfisch 7y ago

1)You're not a paying user 2)You use proxies/tor which probably makes your concerns the concerns of 0.01% of the user-base. Why should a company whose primary motive is to be profitable go so far out of their way for you, a non-paying client whose concerns represent basically none of the legitimate user-base?

wowaname 7y ago
The post is entitled "Guess I'm done with Discord", not "I'm entitled to my Discord account and everyone who disagrees with me is an idiot." As I said in another comment, my post was purely informative and not even in a format that would be digestible by people who do not know me.
- ncmncm 7y ago
  Thank you for the informative posting. I have had no contact with Discord, so I learned something.
yjftsjthsd-h 7y ago
> you, a non-paying client whose concerns represent basically none of the legitimate user-base? You seem to be implying that they are not a legitimate user. What makes them any less legitimate than everybody else?
- pfisch 7y ago
  I am saying that the far majority of users that use tor or proxies are fraudsters.
throwaway2048 7y ago
Trust me when i say paying users of discord are treated equally as flippantly.

buboard 7y ago

I want to be done with discord. The only value i find is the notifications when you have an @reply. Isn't there someone that has done this for freenode or other IRC ?

kadoban 7y ago
I used to use a bouncer, vnc, which there's a plugin for push notifications. Now I use matrix.org, which bridges to freenode and many (all?) other IRC servers and does notifications well. Quite happy with it, personally.
- banger180 7y ago
  Yep, I wished matrix would replace discord and all other proprietary crap. Unfortunately the UX is still a bit lacking, but if you somewhat know what you are doing it's great.
throwanem 7y ago
Use a bouncer like ZNC and an app that supports it, and you can get push notifications on mentions.
scrollaway 7y ago
https://www.irccloud.com/ https://www.irccloud.com/ does what you want (they have an app). If you use IRC heavily, I do recommend paying for it - it's useful and they fund IRCv3 among other things.
lightedman 7y ago
mIRC has trigger words. Just input your username as one and when it comes up from someone else mentioning it your window blinks. Been like that for over 20 years.

kart23 7y ago

Tor breaks a lot of shit for me, and I dont even bother with captchas becuase it usually just flags me as a bot. So I dont think this is particularly surprising or out of the ordinary. But yeah, discord used to be held in high standards by me and plenty of other gamers, but they have made it clear that they cannot handle tough situations, and dont really care about their userbase. Someone should start a privacy focused phone number as a service, acces to texts online and through an app. Allow people to basically have a spam phone number that they can give out to online services, but make people pay for it obviously. Like 10minutemail but long term and for texts only.

throwaway2048 7y ago
Google captcha is particularly egregious because it will flag you as "never allow in, ever" but not give any indication of this, and still will happily have you solving captchas (that is, working for Google, for free) for 30+ minutes, until you catch on that they aren't ever going to let you past. Captcha v3 is even worse in this regard, because it silently flags you while appearing to let you in...
- VectorLock 7y ago
  I like this idea since it puts a lot of effort onto bad actors and exhausts their resources.
  - throwaway2048 7y ago
    Cool, lets hope it doesn't consistently consider you a "bad actor" for reasons that it wont ever tell you.
    - VectorLock 7y ago
      I never said the system was flawless, simply that the idea of continuing to present checks instead of explicitly saying "you're blocked" was a clever idea.

mieses 7y ago

Silicon Valley internet services should just relocate to China. Then they wouldn't have to deal with Trump, privacy advocates, or libertarians.

jrockway 7y ago

Discord's phone verification is awful. They are using some super old database of what provider is associated with your phone number. I ported a Google Voice number to Verizon and they said I can't use it for phone verification because it's Grand Central, a company that went out of business before Discord even came into existence. I pay them $99 a year, and their customer service treated me like shit for this. What do I care if someone hacks my account and destroys the large community that I moderate? That's their problem, not mine. But I doubt they care.

snek 7y ago
That's Twilio's database, not Discord's. Maybe it's fair to be upset at Discord for using Twilio if Twilio can't keep their database up to date, but I don't think there are that many alternatives to Twilio.

simonblack 7y ago

Social media gets less and less "social" every day. My last remaining social media with input from me is HN. But I accept that, sooner or later, HN will be just as intrusive, aggressive, just plain nasty and censoring as the rest of them. And then it will be time for me to "go completely dark" as far as my contribution to the internet is concerned.

jhgg 7y ago

Hey. I work at Discord - and actually, this system is a thing I work on - and code my team wrote caused your account to be locked. If my team is doing a good job, you won't notice us. If we're doing a bad job, you might get some spam, or your account may be blocked for false positives. Discord gets a lot of spam. We've disabled, and/or challenged millions of accounts for trying to use our platform for unsolicited spam (trying to advertise their service, sex bots, crypto spam, etc...). Our anti-spam systems continue to evolve - just as the spammers who target our platform continue to evolve. The spam attacks against our platform vary in terms of how elaborate and skilled they are. Some are very obvious in terms of a detection perspective, and some are not. As such, we use a blend of signals, heuristics and machine learning algorithms to determine whether someone is spamming on our platform. Additionally, we look at where spam is originating from as an input to our heuristic. One such source is TOR exit nodes - and as such, our system considers content created (DMs opened, etc..) from people using TOR exit nodes with more stringency than other sources. As such, if you are using TOR, it is definitely more likely that you may get challenged either via captcha, or phone verification. The system is definitely not perfect - and unfortunately in OP's case, it flagged the account for phone verification. To address the 3 demands in OP's email: > 1. Discord's anti-spam isn't so anal, I'm not entirely sure what this means, nor what actionable steps I can take. You are using TOR, a source of a great amount of spam/attempted spam on our network. > 2. my account (and other accounts in good standing and with proper 2FA) is exempt from such checks Having 2fa is not a strong signal as to whether or not an account is legitimate. It is very trivial to automate setting up 2fa on an account. https://github.com/pyauth/pyotp https://github.com/pyauth/pyotp can be used to both generate and validate 2fa codes. It'd be trivial to hook that up to the registration flow to enable 2fa - and if that was a way to 'bypass' our anti-spam measures, it'd surely be exploited. > 3. I don't have to solve a Google reCAPTCHA for an account I have taken every step to protect against bruteforcing. Using Tor is not a crime; don't treat it as such. Malicious actors constantly attempt to brute-force logins on our system - generally from public password dumps or other leaks. A lot of these brute-force attempts come from TOR, and other public proxies. In order to avoid information disclosure, we always captcha logins from these kinds of IPs, regardless of whether or not an account exists with the e-mail in question, whether the login credentials are correct, or there is 2fa enabled on the account. So, the "captchas" you notice are not really specific to your account, but rather, the origin of the login. Using TOR is not a crime, you are right - but - it's also our responsibility to our users to make it reasonably hard for their accounts to get compromised on our platform (even if they don't employ the best security practices - and reuse their passwords across the internet.) Finally, I'd like to address: "Discord has shown to be hostile toward FOSS and privacy for a while now" and understand why that is. As a company, we have tried to give back to open source software (either by financial sponsorship, or by contributing our bugfixes/changes upstream.) We also attribute all open source projects we use in our software here: https://discordapp.com/licenses https://discordapp.com/licenses. Additionally, we host many open source communities on our platform: https://discordapp.com/open-source https://discordapp.com/open-source. And finally, we try to open source software we make which may be useful to the eco-system in general: https://github.com/discordapp/ https://github.com/discordapp/. As for privacy, we've stated that we don't sell your data. When you verify your phone number, we ONLY use it for the purpose of anti-spam, and it is never shared with anyone (aside from twilio, which sends you the SMS), especially for the purpose of financial gain. We're pretty up front about how we make money (freemium model: https://discordapp.com/nitro https://discordapp.com/nitro, in-app commerce: https://discordapp.com/sell-your-game https://discordapp.com/sell-your-game). We provide privacy controls: https://support.discordapp.com/hc/en-us/articles/360004109911 https://support.discordapp.com/hc/en-us/articles/36000410991..., and allow you to request an export of all the data we have stored on your account: https://support.discordapp.com/hc/en-us/articles/360004027692-Requesting-a-Copy-of-your-Data https://support.discordapp.com/hc/en-us/articles/36000402769... I know this reply won't satisfy everyone, but hopefully, being truthful and upfront about this will help!

gigel82 7y ago

Why the insistence on Tor? Just use a normal VPN. Tor exit nodes are limited in number, and the same IP probably ends up being used by thousands of people... I assume a lot of them use it for nefarious reasons so you just end up in the same bucket. To some extent VPN providers can get hit by this too, but it's easy to just switch outbound IPs (for most of them). And if you want more than that, get a cheap VPS and install OpenVPN on it (you get your own unique exit IP address) - pay with bitcoin for the privacy aspect, also a good place to install an ad-filter, a secure DNS proxy (DOH) and so on. I also don't understand the 2FA point, that says nothing about your accounts' intentions. The account history is an interesting point... if you have a long-standing history with no reports of inappropriate actions, they should factor that in somehow into their algos.

wowaname 7y ago
>Why the insistence on Tor? Short answer: I'm a privacy activist. That should be a valid enough reason for this context. >I also don't understand the 2FA point, that says nothing about your accounts' intentions. No, but it shows my account is secured from intruders, which means reCAPTCHA is just an additional nuisance to me, the legitimate account holder. >The account history is an interesting point Yeah, and they just glance right over it. It doesn't mean anything for my case that I've been an active user with this account for almost two years (I had a previous account for a bit and then left Discord because I was not in any communities worth sticking around for). Never have I done anything wrong on Discord's platform; haven't uploaded any lolis or evaded any bans (I believe I was only banned from one guild, even). They just don't seem to want me as a user, and that's fine.