17 ms·
Discord says 70k users may have had their government IDs leaked in breach
- lschueller 1y agoAsking this out of curiosity: is it a requirement, that such data is being stored once the verification process is completed?
- StanislavPetrov 1y agoRequirement by who? Discord isn't required to demand your ID, let alone store it.
- nomel 1y agoIt's required in the UK to access non-child friendly content: https://support.discord.com/hc/en-us/articles/33362401287959-What-s-Changing-for-UK-Users-Due-to-the-UK-Online-Safety-Act https://support.discord.com/hc/en-us/articles/33362401287959...
- deleted 1y ago[deleted]
- dathinab 1y agoin case of the EU it's more the opposite GDPR requires data minimalism and ~use case binding so if you submit data for age verification there is no technical reason to keep it after knowing your age so you _have to_ delete it.
- GJim 1y agoI've come a long way down for somebody to have finally said this! The GDPR is your friend. It makes retailing unnecessary personal data a liability. As it should be. Discord is idiotic for operating in the UK and Europe without complying. No excuses.
- itake 1y agoJust a guess, but they may store the original ID card to audit duplicate accounts. If their machine learning models, think that two people are the exact same, having the original image, especially a photo of the same ID card could confirm that.
- fuzzfactor 1y agoThe best years online were when it was universally recognized that government ID's are completely unsuitable for interaction with the internet in any way. Like it was since the beginning when government ID's first became a thing.
- selcuka 1y agoThere are image processing methods for hashing people's faces. They don't have to store the actual photo to do that.
- itake 1y agoModels have racial biases, can't support aged faces, or look-alike faces.
- heavyset_go 1y agoYou don't have to use ML models for this.
- itake 1y agoCan you elaborate more? Discord has 656m users. if 10% upload their ID, they'd have 65m ID photos to search through. There are 2 use-cases here: 1/ Safety Bans (lets pretend 0.01% of ID card users have been banned for safety reasons: 650k accounts) If a user submits their selfie/ID card, Discord needs to compare the new image with one of the 650k banned (but deleted?) images. I can't possible think how a human could remember the 650k photos well enough to declare a match. Even if such a human existed with this perfect recall, there can't be very many of them on this planet to hire. 2/ Duplicate account bans If a user registers, how can a support staff search the 65m photos without ML assistance to determine if this is a new user or a fraudster?
- 3eb7988a1663 1y agoThat is the bonkers thing about this story. Why take on the liability? Get what you need and toss the responsibility. If you must store it (which seems unlikely) put that extra-bad-if-leaked information behind a separate append only service for which read is heavily restricted.
- jpalawaga 1y agoBecause there is no liability. If they were fined $10k per leaked ID, then there is a serious liability there. Right now, they publish a press release, go 'oopsie poopsie', maybe have to pay for some anit-fraud things from equifax if someone asks, and call it day.
- ryandrake 1y ago> Right now, they publish a press release, go 'oopsie poopsie', maybe have to pay for some anit-fraud things from equifax if someone asks, and call it day. Don't forget the usual Press Release starting with "At [Company], we take security very seriously..."
- heavyset_go 1y agoBecause it's free training data and great for building profiles on users so you can make money showing them targeted ads
- tavavex 1y agoDiscord isn't really monetized through 'traditional' targeted advertising, though.
- fuomag9 1y agoDiscord no, but my credit card from Advanzia bank actually changed their TOS to allow AI training with your submitted documents for their anti-fraud model. I complained to the CNPD of Luxembourg and sent a GDPR request, as they defaulted to doing this WITHOUT asking for consent (super illegal as doing AI training with your data is definitely not the minimum required to offer the service)
- Spooky23 1y agoI’m in a different industry, but when I’ve had to collect identification for reasons we extracted metadata at the time of presentation, validated it, and discarded the image. We would never get clearance from counsel to store that in most scenarios, and I can’t think of a reason to justify it for a age or name verification.
- stravant 1y agoWhy are people assuming they did store it after the process was completed? With the relatively low number leaked here it could have been information collected actively during an ongoing breach, not a dump of some permanent database.
- imtringued 1y agoThere are only a handful of countries where you are legally mandated to dox yourself and it's a recent change. You'd expect the numbers to be "low" either way.
- neilv 1y agoThis is not OK, and the reporting is not OK. Opening with: > Discord has identified approximately 70,000 users that may have had their government ID photos exposed as part of a customer service data breach announced last week, spokesperson Nu Wexler tells The Verge. Then a big PR quote, letting a potential wrongdoer further spin it. Then closing with: > In its announcement last week, Discord said that information like names, usernames, emails, the last four digits of credit cards, and IP addresses also may have been impacted by the breach. This is awful corporate PR language, not journalism, on a big story about probable corporate negligence resulting in harm to tens of thousands people. Here's the bare minimum kind of lede I expect on this reporting: Discord may have leaked sensitive personal information about 70,000 users -- including (but not necessarily limited to) government IDs, names, usernames, email addresses, last 4 digits of SSN, and IP addresses. I'm ready to block both Discord and The Verge.
- Hikikomori 1y agoThis is what most of journalism has been for quite some time. Read some of Noam Chomskys work.
- zahlman 1y ago> Discord may have leaked sensitive personal information about 70,000 users -- including (but not necessarily limited to) government IDs, names, usernames, email addresses, last 4 digits of SSN, and IP addresses. Credit card numbers are not SSNs, and I can't fathom why Discord would have the latter (I certainly never gave them any government ID either). Not to mention, "last 4 digits" of a credit card number will commonly appear on, for example, store receipts that people commonly just leave behind. Usernames can hardly be called sensitive information, either. The point is all the other stuff being tied to the username.
- jay_kyburz 1y agoI think discord is one of the services that requires age verification in some countries.
- Spooky23 1y ago
- PaulKeeble 1y agoThe hackers claim they have data of 5.5 million, discord is saying 70k. Hmmmm
- tifik 1y agoI don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'. Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system. To make it clear - I don't particularly blame any one corporation, this is a systemic issue of governments not having/not enforcing serious security measures. I just completely dropped the expectation of my information being private, and for the very few bits that I do actually want to stay private, I just don't, or allow anyone to, digitalize or reproduce them at all in any way.
- L-four 1y agoDeveloper time is more valuable than user data. The market is being efficient.
- hulitu 1y agoNo.Just greedy.
- kalaksi 1y agoI think you're assuming an ideal world where there's no information asymmetry, all the market participants receive and understand all the information and the risks, and clients could realistically move to an alternative platform that provably handles things better.
- baobabKoodaa 1y agoExternalized costs aren't weighed in that calculation
- Gigachad 1y agoIt’s surprising that it happened to a big name like Discord in this day and age. Huge data breaches of large tech companies are becoming increasingly rare as security in general is getting better.
- fishmicrowaver 1y agoYou've got to be a complete moron uploading your gov ID to discord
- giancarlostoro 1y agoIt is specifically because you got banned for "being under 13" it comes from someone asking a question like "How many candles in this photo?" then you reply "7" then they edit the message to say "How old are you" and voila, underage ban. What you are overlooking is that Discord is the new MSN Messenger, YIM, etc your friends are not backed up in a meaningful way, nor the servers you're in, if you lose your account, you lose contact with basically your entire internet life and friends. Discord should not keep those IDs longer than a month at a time once the user is unbanned it should be deleted a week later, or removed from that panel altogether.
- ternera 1y agoThis hits the nail on the head. The big issue here is that the submitted photos were not deleted and that is quite concerning to me.
- giancarlostoro 1y agoThis should be a warning to anyone providing function in any way similar to what Discord is doing. Do not keep PII longer than you legally have to. Don't have to keep it at all? Delete it. Leave a redacted record such as "Image verified by x, removed on x after unban" or something simple if you must. Remove PII from ticketing systems especially on a platform like Discord where users want to be private by design.
- Culonavirus 1y agoYou can come up with all kinds of excuses, but Discord is not, and NEVER WAS a trustworthy company. > You've got to be a complete moron uploading your gov ID to discord ^ Still stands.
- 1y ago
- mikert89 1y agoWhen can people start going to jail for this kind of thing
- EarlKing 1y agoYes, good question: When can we start jailing CEOs and their employees for these blatant violations of the CPRA and GDPR?
- Imustaskforhelp 1y agoWas thinking the same exact thing!!
- JoshTriplett 1y agoAnd the politicians who mandate ID-checking requirements, without which the "government IDs" part of this wouldn't have happened. (To be explicit, not supporting jailing here, just removing from office.)
- krainboltgreene 1y agoImmediately if you move to China.
- rr808 1y agoYou know it'll be the IT pros going to jail not the execs right?
- sunaookami 1y agoGood, then they can stop the excuses for implementing the most shittiest things that ruined the web and just say no.
- heavyset_go 1y agoAfter a revolution
- f4uCL9dNSnQm 1y agoIt is UK. They find it hard to jail people that lied on purpose to jail innocent people, multiple times.
- elevation 1y agoI didn't feel comfortable giving discord my phone number when they demanded it, so I lost access to the open source communities that insist on collaborating there. I wish breaches like this would cause people to reconsider their choices but sadly, it's unlikely most users will move.
- giancarlostoro 1y agoThe issue is if you don't enforce the phone number requirement on your server you get all the trolls who don't use phone numbered accounts. I wish Discord would allow you to restrict known VPNs instead of requiring phone numbers. It would solve so many issues. I know a LOT of VPNs wont be caught, but if you block MOST non-residential IP blocks, you'll capture a lot of them.
- fishgoesblub 1y agoThe communities I'm in don't require a phone number and very rarely gets trolls. Proper moderation is the most important part. Occasionally there's a spambot, but they're just hacked accounts from pre-existing real users, and as someone that uses a VPN with Discord, I'd prefer to not be treated as an evil-doer please.
- giancarlostoro 1y agoSure, are the communities you're in tens of thousands of users or more? Because things change really quickly depending on how many users are active, if it's a community server, and the subject matter. Even a programming Discord is a hell hole. You cannot have enough mods ever. Things fall through the cracks and people get hurt. You can't moderate DMs or know the wellbeing of tens of thousands of your users who are being harassed in DMs and have no idea how to get help. Discords full of a lot of youth. Theres users who rotate community servers on a VPN / new spun up alts. They are relentless. I noticed the communities that are massive and do not have this problem to this extend all require phone number.
- elevation 1y ago
- ChrisArchitect 1y agoSource: https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service https://discord.com/press-releases/update-on-security-incide...
- hn1291378112 1y ago[dead]
- codedokode 1y agoCompanies usually promise that the ID would be used only for validation and then immediately deleted. How so many IDs could leak then? They verify millions of IDs per month?
- encrypted_bird 1y agoDo they actually say in the TOS that they will delete them? If they do, do they say immediately? How immediately? Right away or, perhaps, 1 month? Unless specified in contractual documentation, words like "immediately" or "soon" do not have any single definition, which allows them to stretch it without technically being in breach of contract. Not to mention that often times, governments mandate data retention for so-and-so amount of time, so the companies are legally required in such cases to keep the data even if they, miraculously, desire not to.
- o11c 1y agoLying is usually legal. And even if lying is illegal in a particular context, it's de-facto legal since nobody ever gets punished for it.
- schaefer 1y agofraud is not legal. There's a difference between lying on the playground and fraud in a business setting.
- oguz-ismail 1y ago[flagged]
- qwertytyyuu 1y agoWait already? I was hoping to hear about it next year. Maybe it’s a good thing that it happened early so they can fix?
- saagarjha 1y agoNo, it’s a good thing it happened early so they can remove it.
- EGreg 1y agoThose are rookie numbers. Time to pump up those numbers… we publish this every year or so: https://qbix.com/blog/ https://qbix.com/blog/
- quintes 1y agoWhy. I see Australia is intending on blocking YouTube and other platforms. Expect this more regularly
- whatever1 1y agoOh no! Anyway software engineers are not real engineers so nobody will be held accountable.
- driverdan 1y agoBring back IRC.
- amatecha 1y agoIt's still very much alive! Regularly active on a few channels spread across different IRC servers. Still works great.
- tiku 1y agoWhy is it still so hard to identify yourself online?
- missingrib 1y agoWhy haven't zero knowledge proofs shined in this area? Can anyone explain?
- tzs 1y agoThey are on the way. The EU is field testing such a system now.
- Nasrudith 1y agoAren't ZKPs useless for their paranoid 'children will die if they see boobies' crap because then they'd allow for a single common token to be shared willy nilly? Not to mention that surveillance is the clear government actual goal.
- jhasse 1y agoNo, Discord would create a new challenge for every user by creating a random nonce.
- maxlin 1y ago.... The government ID's they only started asking for as a bullshit requirement after running for like 10 years without needing them? At some point we'll start seeing companies that rotate your passwords automatically and integrate with your autologins, and send immediate reports of breaches / suddenly failing logins. Wait. Why isn't this a thing
- gradientsrneat 1y agohaveibeenpwned?
- maxlin 1y agoafaik they do not actually handle your logins
- rendall 1y agoI once accidentally set an incorrect birth year on Twitter. They locked me out of my account and insisted that I upload a government ID to unlock my account.
- kwar13 1y agoHow many times the same thing... most even tell you that they verify you and then delete your ID. ZK proofs cannot become mainstream fast enough.
- andsoitis 1y agoWhat is the use case for uploading your government ID to Discord?
- 0xfffafaCrash 1y agoAs the article says it’s used for age verification
- hmry 1y agoJoining "NSFW channels", which usually means porn. But some normal channel are also tagged NSFW to opt out of Discord's forced content filter on public servers, which has occasional baffling false positives.
- andsoitis 1y agoSo people are willing to upload their govt IDs to watch porn. Wow.
- miohtama 1y agoOnline Safety Act for the UK. You will be safe.
- tavavex 1y agoTwo of the other replies are wrong. This isn't actually about the new 18+ age verification stuff that countries seem to be ramming through right now - as far as I know, Discord uses third parties for that service. The link from Discord's statement in the article mentions that this is about appealing account bans of users who were suspected to be under the legal age to use Discord at all (<13 in most places). This is an older thing, which also explains the amount of data that was leaked.
- deleted 1y ago[deleted]
- geenat 1y agoWhy are they permanently storing government ID's?
- Anduia 1y agoDiscord uses Zendesk (1). However in the press release they don't name the third party that was compromised, and Zendesk denies that it was their service. What other third party was Discord using if not Zendesk? Who's reputation are they protecting? [1] https://www.zendesk.fr/customer/discord/ https://www.zendesk.fr/customer/discord/
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- Draiken 1y agoI don't understand how we allow these companies to protect each other even in the face of egregious malpractice. This might even be a PR move. They fucked up and can merely say "a third party" did it. Who's gonna verify this? Unless we have whistleblowers we will never know. What a disgrace.
- buckle8017 1y agoThe wording Discord used leaves open the possibility that a ZenDesk account was compromised through no fault of ZenDesk. Kinda feels like Discord is lying by omission. Edit: Actually my bet is their support staff just sold them out.
- Mattwmaster58 1y agovx-underground claims to have communication with the group, and this post of theirs adds to the support agent theory: https://xcancel.com/vxunderground/status/1976238815665856646 https://xcancel.com/vxunderground/status/1976238815665856646 > they were able to compromise Discord Zendesk by compromising a "BPO Agent" (outsourced support). > Of course, as is tradition, it is also entirely possible they're lying
- BryantD 1y agoDo you happen to have a link to Zendesk's denial?
- xaxaxa123 1y agoKYC is a bug
- miohtama 1y agoZenDesk boasts on this: ”Discord's investments in AI-driven self-service with the Zendesk CX platform have enabled the company to provide seamless support.”
- baby 1y agoWhy does discord have gov IDs? At this point we already have the tech to prove using zero knowledge that we have an ID
- Vipsy 1y agoOne important problem that's mostly ignored is the lack of transparency about the third-party providers handling such sensitive ID documents. When a breach occurs, public statements rarely name the exact vendor responsible, making it difficult for affected users to understand who actually had access and who might still have their data. This opacity delays accountability and creates ongoing risks, since users have no meaningful way to audit or assess the practices of these shadow providers. Unless this layer of the data-handling ecosystem is discussed and regulated, future breaches will remain inevitable and largely untraceable.
- eleveriven 1y agoThe third-party layer is basically the dark matter of data breaches like invisible to users, barely acknowledged by companies, and completely unaccountable when things go wrong
- wosined 1y agoThe biggest problem is giving data to people in the first place.
- teekert 1y agoI think it is nice that the GDPR forces companies to not keep too much data about people. And you can only have data that you need for the stated purpose (of course this leaves loopholes but it is good data hygiene to always consider). For example, if you state you want to verify age, you only need the ID for a couple of seconds. So why didn't they think about the risk of a hack before? They could have done the age verification and then immediately deleted the document. The cynical take is af course they did think about it but would take the fine if it came to that... Maybe it is good to make an example out of Discord? Don't keep stuff around if you don't need it should be common sense.
- deleted 1y ago[deleted]
- eleveriven 1y agoThe whole "it wasn't us, it was our third-party vendor" line is getting way too common. If you're collecting government IDs for age verification, the security bar should be extremely high... no matter who's handling the data
- baobabKoodaa 1y agoBut our subcontractor made a contractual promise to use only sub-subcontractors who use only sub-sub-subcontractors who promise to be secure!
- Spivak 1y agoAhh I see you've done work for the government.
- eternauta3k 1y agoMore governments should provide a system like the German electronic ID*, which lets you prove your age without revealing other information. * Tragically underused because impractical
- luplex 1y agonot just impractical, but also not easy and free to integrate with your service. Seems designed to push you to use a commercial product. https://www.ausweisapp.bund.de/so-werden-sie-diensteanbieter https://www.ausweisapp.bund.de/so-werden-sie-diensteanbieter
- OvbiousError 1y agoIn Belgium we have a service called "itsme". Had it for ages, works very well, used to be mainly for government but banks are also switching to it.
- consp 1y agoAs far as I have heard zero knowledge proofs have become optional (thus dead) in the EU wallet specification. I expect selective disclosure in all form to be completely axed next.
- jonplackett 1y agoWhy are they even storing these? Once they have verified them as old enough, why keep them? These companies should be forced to release a proper account of events - like Google/Cloudflare do when they mess something up
- deleted 1y ago[deleted]
- croes 1y agoWhy did they have them in the first place?
- miroljub 1y agoIt's great news. Introducing totalitarian laws and rushing companies to implement them, who would've thought something would go wrong? I hope this incident and future data breaches will finally raise awareness of which direction many regimes are going.
- armada651 1y agoDon't worry, the only thing governments will learn from this is that they need to exert even more control. They'll use this as a convenient excuse to centralize the age verification in the interest of security, which conveniently gives the government the final say over which web services you're allowed to use.
- miroljub 1y agoThe stricter the dictatorship is, the more likely people will resist the regime. That's why many of the traditional totalitarian regimes are populistic, they do what their people want them to do or what they can convince them is good for them. New Western hybrid regimes still didn't realize they can't rule against their own people forever.
- 11mariom 1y agoFirst problem is - they never should have such data. Why you are sending them IDs?
- neuronic 1y agoThis is why I am really looking forward to PIDs in the European Digital Identity ecosystem (EUDI) [1]. This works with the OpenID Verifiable Credentials spec built on top of Oauth2. There are open source solutions in the competition for building the EUDI Wallet and the architecture and reference framework is openly accessible [2]. All credentials are kept with the holder (you) at all times. Basically implementation of the EU eIDAS 2.0 regulation, obviously subject to GDPR. Mandated to be accessible to EU citizens by 2027 when all Member States have developed a Wallet solution. Not associated but learned through it at work recently, just awesome project and thought I'd share in this context. [1] https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity_en https://commission.europa.eu/strategy-and-policy/priorities-... [2] https://eu-digital-identity-wallet.github.io/eudi-doc-architecture-and-reference-framework/2.5.0/ https://eu-digital-identity-wallet.github.io/eudi-doc-archit... [3] https://github.com/openwallet-foundation/credo-ts https://github.com/openwallet-foundation/credo-ts
- Razengan 1y agoAnd how will they pay for it? How did we get to this state anyway? Isn't HN supposed to be populated by the people who work at these companies, the fuck are you guys doing??
- bell-cot 1y agoWhatever stereotypes you've read, about 0.01% of HNer's hold C-level jobs at huge tech companies, to be setting such policies. And even at modest-sized companies, those are decided by Legal Dept's and senior business managers. While you might find it cathartic, to angrily curse at some convenient Post Office employee for (say) the Postmaster General's latest postage stamp price increase - that is really not a classy move.
- Razengan 1y agoSo where do the people making those decision hang out so we can shame them
- bell-cot 1y agoShareholder meetings, if you're the right sort of wealthy or clever. Or, maybe try https://en.wikipedia.org/wiki/World_Economic_Forum https://en.wikipedia.org/wiki/World_Economic_Forum BUT - the "shame them" is only from your PoV. They really don't share that. Nor care what you think.
- Razengan 1y agoSo let us just vent here
- bArray 1y agoLooking forward to being forced to provide my government ID to access Discord [1], when they have only just suffered a major breach. Good stuff. [1] https://support.discord.com/hc/en-us/articles/30326565624343-How-to-Complete-Age-Verification-on-Discord https://support.discord.com/hc/en-us/articles/30326565624343...
- verytrivial 1y agoID checks, driven by prudishness, are an absolute gift to the big social media companies. They're the only entities whom (a) already know the check's answers, and (b) have the resources to keep hackers largely at bay. I am not surprised these laws are landing with such little resistence.
- MaxikCZ 1y agoIts as if the big social media companies lobbied for extra redtape, eh?
- spacebanana7 1y agoSurprisingly they've generally lobbied against it for ideological reasons despite their economic incentives.
- jMyles 1y agobrer rabbit and the briar patch.
- RobKohr 1y agoLarge companies love regulation and red tape because it usually kills smaller competitors.
- kat529770 1y ago[dead]
- timpera 1y agoI work at a company where we also store government IDs in Zendesk. I've alerted management multiple times but no one seems to care. It's a disaster waiting to happen…
- TavsiE9s 1y agoLeave paper trails (emails most likely) and keep hard copies.
- b00ty4breakfast 1y agoI understand I grew up in a different era but it is beyond absurd to me that a chat application requires government ID from it's users. I understand the rationale but I do not find it convincing in the least, especially with the way that security is treated at basically any entity that has this kind of info on file. I do not like this world that we have created and I would like to apply for a full refund
- jefozabuss 1y agoRationale is likely the requirements of age verification rules by UK, some US states, etc. We could likely see a bit more of these data leaks in the future I guess, due to how there are more and more countries/states adopting this.
- seydor 1y agonewer generations have been indoctrinated early
- buyucu 1y agoThis is why social media should never ever ask for an ID.
- ktosobcy 1y agoI kinda hope and root for EU's spec (https://ageverification.dev/Technical%20Specification/architecture-and-technical-specifications/ https://ageverification.dev/Technical%20Specification/archit...) with "Zero Knowledge Proof" that wouldn't require passing actual ID to the service…
- Bender 1y agoMy preference would be just requiring site operators to add the RTA header [1] for anything that could potentially be adult in nature or user contributed content and let parents decide if devices should have parental controls. Not perfect, nothing is but would protect most small children. Teens will easily bypass any method as many today watch porn together in rated-g/pg video games that allow setting up a streaming player in-game. [1] - https://www.rtalabel.org/index.php?content=howtofaq#single https://www.rtalabel.org/index.php?content=howtofaq#single
- ktosobcy 1y agoThat would be also nice, but given we can't make everyone to do the most basic interoperability I don't see it working… As for: > Teens will easily bypass any method as many today watch porn well, they do, but each obstacle discourage them to do that. It's like with chocolate while being on a diet - if you have it within reach next to you you are more likely to eat it; put it on a shelf which would require standing and walking - slighly less likely; put it in another room - even less; and if you don't have it in home and you would have dress up and take out the car and drive to the shop most likely you would just wave your hand at that :) So no - it won't prevent it completely but I'd argue that it would significantly decrease the use :)
- Bender 1y agoThat would be also nice, but given we can't make everyone to do the most basic interoperability I don't see it working… Many moons ago there were a couple browsers that looked for the ICRA PICS label but the adoption was low due to complexity of the header creation and a lack of laws requiring it. I expect it would take an intern an afternoon to create the code to look for the RTA header and probably a couple weeks to get through the QA/staging process. It only needs to initially get into Chrome, Safari, Edge and Firefox to protect small children on a tablet with kids using a normie account and parents retaining the super-user account. Should a law pass that has a timeline for the check to be mandatory I expect a majority of web agents to recognize and act on the RTA header long before the deadline. It would be 100% more than what we have today is nothing in the browser and privacy invading third parties that would not be involved in kids going to sites that do not force people into said third party sites which is most of them. To be a fly on the wall when someone tries to force the third party ID checks on 4chan...
- atbvu 1y agoEvery time I see a data breach caused by a third party vendor, I can't help but wonder why are these big companies so deeply reliant on outsourcing, yet so lax when it comes to controlling security?
- theknarf 1y agoUsually some regulation change that the company is not aware off, they have to run to find a fix as soon as possible, some business guy who don't know anything about tech find a vendor who are ready to sell a solution (they probably created their whole business last month on a gamble that the new regulation would be passed and that businesses would be rushing for a solution). Then they simply buy that solution "for compliance" as a top down decision, even when internal employees ring the warning bell.
- kevincox 1y agoBecause the consequences of events like this are minimal so why would they waste time and effort worrying about it?
- atbvu 1y agoI don't think incidents like this are minor. I believe personal information security is very important. Maybe they see the consequences as small, but I don't.
- kevincox 1y agoI don't meant the consequences to the people who had the data leaked. I mean the consequences to the companies that didn't take security seriously and leaked the data.
- pbohun 1y agoThe Principle of Least Privilege is one of the foundational aspects of security. Governments should be enforcing that not requiring companies to collect very sensitive information like they are currently doing. Things like "prove your age", digital ID, and Chat Control are actively malicious when it comes to safety, security, and privacy.
- laylower 1y agoWill the British Government be held liable for ID Thefts from this? If they hadn't created a honeypot with minimal security would this info now be out there? WTF were they thinking about?
- prmoustache 1y agowhy would one give their government ID to Discord?
- qwertox 1y agoPieces of shit. Do they need to look at them on a daily basis or isn't is enough to use them to confirm identity when received and then encrypt them and move them to an offline storage?
- jacquesm 1y agoSo many companies do not understand this simple principle. Blast radius reduction. But no, they need to have everything online, and instantly accessible all the time. Because they can't possibly be inconvenienced with a short delay in case they ever want to look at that piece of data that they will never want to look at anyway. It is going to take a long time before companies realize that data they don't need is a liability, not an asset.
- daveoc64 1y agoIt's just a standard helpdesk application. You submit a ticket to Discord with the ID attached when the automated ID verification didn't work for you. Once the ticket is dealt with, Discord could have a policy of deleting the IDs, but they don't.
- SuperSandro2000 1y agoIf only someone would have warned us
- kogasa240p 1y agoThis is the end result of forcing private companies enforce ID verification.
- lofaszvanitt 1y agoNo, this is the result that companies dngaf about your private data. Sue them to oblivion.
- quentindanjou 1y agoHard disagree. Companies could care about your data and still be subject to rbeach. ID verification is the source of the issue.
- gamerdonkey 1y agoEveryone, please, don't fight. It's both. The companies wouldn't have this specific data if it wasn't for the age verification laws. Companies also work to amass as much private data as possible about their users without any influence from government and are often not good stewards of it. Let's also not forget that companies like Discord often support and work with governments on these kind of laws because they prefer a consolidated regulatory structure and it has the added benefit of making life more difficult for smaller competitors that may enter the space.
- lofaszvanitt 1y agoAnyone with a semblance of security awareness wouldn't store photo ids in net accessible storage
- lofaszvanitt 1y agoDiscord always was a privacy nightmare. How come people upload ids there? And why do the service stores them in hot storage?
- rsynnott 1y agoAh, the thing that everyone warned would happen has happened.
- ratelimitsteve 1y agowe, uuuuhhhhhh, we still gonna make every E-Tom, Dick.com and HarryAPI collect people's identifying information?
- 1970-01-01 1y agoThe one approach that has never failed is to use a fake identity when signing up for online services. It is a violation of TOS but not a crime to do so. Only give your real information to the government. If companyX requires hard information but cannot protect this PII, then they don't deserve real data.
- Aerroon 1y agoThe problem is that the government has these leaks too.
- dwayne_dibley 1y agosure, but your reducing the likelihood of your real data getting out there if it's only stored in one place, rather than hundreds.
- 12345hn6789 1y agoRelevant name. How would you get around this verification though? Afaik this is nearly akin to KYC which is effective impossible to get around
- dwayne_dibley 1y agoI wonder how many people in the UK have actually got their passport out to sign into these services. I'm guessing the average HN user isn't likely to do this, but I'd love to see the numbers for the general populous.
- seydor 1y agoWe need more breaches, it will render that data unstorable
- intrasight 1y agoOne's government digital identity should be public. It's my public identity. If there's some risk to this being the case, the it's a bad implementation.
- HeavyStorm 1y agoIt will only get worse, of course.
- h4kunamata 1y agoSo it begins... Where there is smoke, there is a fire. Wait for more and wait for people to learn how identity theft is the worst problem you can have. Imagine you trying to prove that you are you, while somebody else with your passport details, driver license, address, DOB, phone SIM swap, etc, is acting like you causing all sort of financial disaster??? 1995 The Net movie, people in 2025 will learn the hard way that was not just a movie.
- stuaxo 1y agoMerely weeke ago before this law came in we said this would happen. It will keep happening as well. Their IDs given in the name of "online safety" how safe are they now their IDs are leaked?