5 ms·
Discord hack shows risks of online age checks
- dbg31415 1y agoI don’t understand why we need age verification in Discord. Why should people who play games have to prove they’re old enough to talk to others? It’s not like anyone ever forced anybody else to join your Discord community, it’s all opt in! If parents don’t want their kids playing certain games, or if a community is more adult in nature, then don’t buy those games for them. If they don’t want their kids exposed to bad influences, they can move the computer into a shared space or—better yet—just engage with their kids on a human level. That’s called parenting. Politicians shouldn’t be meddling in this kind of personal interaction. It didn’t work when Nancy Reagan or Tipper Gore tried to police music, and it’s not working now. Modern authoritarians are just running the same tired playbook. Age verification doesn’t make kids safer. It adds bureaucracy, harvests private data, and pretends to solve a problem that only families can actually fix. The result is more surveillance, less trust, and the illusion of protection.
- maccard 1y agoI agree with you but; > I don’t understand why we need age verification in Discord. Why should people who play games have to prove they’re old enough to talk to others? It’s not like anyone ever forced anybody else to join your Discord community, it’s all opt in! Discord doesn't require age verirication for voice chat, it requires it for access to "sensitive media", or when yuo try to access a channel that has self opted in as age restricted [0]. [0] https://support.discord.com/hc/en-us/articles/30326565624343-How-to-Complete-Age-Verification-on-Discord#h_01K0FVFH1KWK3TDGFXBBSDQBM0 https://support.discord.com/hc/en-us/articles/30326565624343...
- idle_zealot 1y ago> Politicians shouldn’t be meddling in this kind of personal interaction. Broadly I agree. I think there is room for good regulation here, though. Specifically, a legal obligation to hook into parental control systems to enable effective parenting in our increasingly complex digital world. While it would be nice if everyone were individually responsible enough to put in the effort to figure out the specifics of what their kids might be exposed to and the control mechanisms available to them, realistically that's probably expecting too much. There's no perfect solution, but intervention focused on obligating (especially large) organizations to empower users and make safety easy to understand and act on is infinitely preferable to obligating companies to restrict and police their users.
- debo_ 1y agoA lot of servers have the equivalent of a #nsfw channel where you post dank stuff. I don't agree with the age verification approach, but I see why it concerns people. Discord naturally attracts a very diverse crowd, of which many are quite young. Walking into a random channel in your random all-ages jrpg server and finding horse porn might concern a parent. (This is a concrete example that I have experienced, not a theoretical one.)
- deleted 1y ago[deleted]
- squigz 1y agoAnd almost all of those servers have those channels marked as such. But when I set it as an NSFW channel, I didn't agree to demand my users' privacy be invaded. Now, I just remove the NSFW flag from those channels. ¯\_(ツ)_/¯
- debo_ 1y agoYeah. I did the same.
- mulmen 1y agoThe random porn in a JRPG chat is concerning but how does age verification prevent that? Channels have to opt in and participants have to follow the rules, right? Isn’t the real issue that you don’t know and trust all the participants personally?
- charcircuit 1y agoIt's similar to needing ID for purchasing alchohol. You could use the same excuse that parents shouldn't buy alcohol for their kids, but there is the obvious workaround of kids buying it themselves.
- mulmen 1y agoYes it’s similar, which is the point. Age restrictions have been normalized regardless of effectiveness.
- awesome_dude 1y ago> Age restrictions have been normalized regardless of effectiveness. For the record. A law doesn't stop anything. All a law does is says "If some behaviour meets definition X AND the state becomes aware of it, then consequence Y will be applied by the state" The hope is that people will see that and make a choice that ensures that they aren't liable for the consequence. It's also, like everything, as effective as the enforcement. If it's not enforced well, nobody will abide by it.
- mulmen 1y ago> All a law does is says "If some behaviour meets definition X AND the state becomes aware of it, then consequence Y will be applied by the state" Might be applied, and the terms are negotiable.
- deleted 1y ago[deleted]
- bramhaag 1y agoThe thing that everybody expected to happen, happened. At least the kids are safe. Why were these images not encrypted, and why were they retained for longer than was necessary?
- miohtama 1y agoWhy the files were asked in the first place?
- deleted 1y ago[deleted]
- naldb 1y agoEncrypted? Encrypted how? How would the employees tasked with age verification access them if they were encrypted?
- jvanderbot 1y agoBy decrypting them with a hardware token or passphrase or memorized password or timeboxed token of another kind. But honestly just delete them ASAP, that's the issue
- Dylan16807 1y agoAnd if all the employees have access to this hardware token or passphrase or memorized password or timeboxed token of some kind, does that actually prevent a hack, or does it just let you bullet point "encrypted"? The main thing encryption prevents is someone that steals a physical device getting access to the data inside. It doesn't do much about unauthorized access to live servers.
- awesome_dude 1y agoI mean, this is the problem for all companies with sensitive data (ensuring that "ex" employees no longer have access to <stuff>). Generally it's done via accessing some 3rd party secret storage system where employees need to verify themselves to get access (eg. Vault, or AWS secrets or what have you)
- LelouBil 1y agoRelated : https://www.youtube.com/watch?v=NnuyT8FgSpA https://www.youtube.com/watch?v=NnuyT8FgSpA The hacker contacted some well known youtuber that talks about discord, they provided contents of support tickets of the YouTuber to prove they were really the hacker
- luxuryballs 1y agoAnyone with insight into this kind of thing know if it’s reasonable to doubt Discord’s claims about what the hackers have? I can see motives for both parties to stretch the truth in opposite directions. But maybe there’s some legal risk for Discord to lie about what was compromised, in the event they get found out?
- onetokeoverthe 1y ago[dead]
- guerrilla 1y agoI'm grateful for the timing.
- nomilk 1y ago> The hacker claims an outsourced worker was compromised through a $500 bribe Also interesting: > The hacker claims government IDs were just sitting there for months or even years... I have spoken to people familiar with Discord's Age Verification system, and they said after some period of time Discord will delete (the copies of IDs), but they should be deleting them the second they're done Source (pinned comment, and 7m20s respectively): https://www.youtube.com/watch?v=NnuyT8FgSpA https://www.youtube.com/watch?v=NnuyT8FgSpA
- deleted 1y ago[deleted]
- ndriscoll 1y agoDidn't they only start doing age verification this summer? Why do they have years worth of IDs?
- like_any_other 1y agoI don't understand. Weren't we told that these age checks are "privacy-preserving"? So why was there anything for hackers to steal? Or do they mean "privacy-preserving" only against other random users of a service, but not against the service itself, the corporation running it, it's subsidiaries and parent conglomerate, their "trusted partners", the process of legal discovery if that corporation ever gets sued, legal subpoena by the police and intelligence agencies of every jurisdiction that conglomerate conducts business in, local councils [1], every government agency you can think of including ambulance service providers [2], and of course data breaches? "Privacy." [1] https://www.ibtimes.co.uk/british-councils-used-ripa-conduct-mass-surveillance-people-over-5-years-report-1598090 https://www.ibtimes.co.uk/british-councils-used-ripa-conduct... [2] https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016#Authorities_allowed_to_access_Internet_connection_records https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016#...
- techjamie 1y agoPrivacy preserving unless someone gives a support agent in a third world country a $500 bribe. Then you get unfettered access to download the entire ticket database and attachments.
- aucisson_masque 1y agoIt's only the beginning, right ? I already bought a vps in turkey and installed a vpn on it, cost 10€ a year but it's a small price to pay to not have his ID stolen.
- hiprob 1y agoLike this would actually stop any politician from pushing actively malicious legislation just because their kid doesn't love them and it's all the damn phone's fault.