18 ms·
Discord/Twitch/Snapchat age verification bypass
- hackersk 8mo ago[dead]
- semiquaver 8mo agoThe governments making laws which mandate it feel otherwise.
- k12sosse 8mo agoGuess we'll have to change the laws.. or the government.
- rockskon 8mo agoNo law mandates Discord impose this globally. To be clear - this is a wholly discretionary act on their part to implement this in jurisdictions that have no such legal requirement.
- FMecha 8mo agoThey are doing this pre-emptively since it will be the global law trend sooner or later.
- rockskon 8mo agoThat's not for Discord or you to decide nor is that guaranteed!
- semiquaver 8mo agoYeah, the decision to do it pre-emptively obviously is discord’s to make. How could it be otherwise?
- rockskon 8mo agoI meant mandatory age verification becoming "global law" is not for Discord to decide.
- engelo_b 8mo ago[dead]
- tentacleuno 8mo agoIt was never going to be perfect. I suspect the goal with things like these is to add additional friction to the process, to make it much harder for the general population to bypass them.
- consumer451 8mo agoThere is a way to do this, where nearly everyone is fine.[0] However, the orgs don’t get to capture verified adult user identity to pad the value of their user data profiles… [0] https://blog.google/company-news/inside-google/around-the-globe/google-europe/age-assurance-europe/ https://blog.google/company-news/inside-google/around-the-gl...
- brian-armstrong 8mo agoIt seems unlikely that "is user adult" is not already easily modeled by any of these companies to within a very high degree of confidence. Even 15 or 20 years ago Google search could bracket your age pretty effectively. It doesn't seem like this adds metadata that wasn't already there.
- chatmasta 8mo agoGoogle prompts me to verify my age on my account I created in 2004. They’re not trying too hard.
- digiown 8mo agoIf they admit this, they wouldn't be able to advertise to children anymore without breaking many rules.
- Dusseldorf 8mo agoExcept that in the legal sense, "is user adult" flips from false to true overnight, and there isn't an easy way to account for that in any model that doesn't include verified ID. Same reason many liquor stores ID anyone who looks younger than 40.
- relma2 8mo agoAlright, how long until they patch this? Anyone takin' bets?
- Springtime 8mo agoSounds like it may already have been[1]. Edit: might only be a minor API call issue[2] [1] https://github.com/xyzeva/k-id-age-verifier/issues/7 https://github.com/xyzeva/k-id-age-verifier/issues/7 [2] https://github.com/xyzeva/k-id-age-verifier/pull/6 https://github.com/xyzeva/k-id-age-verifier/pull/6
- cocoto 8mo agoThe real and robust method will be generating artificial video input instead of the real webcam. I really don’t think any platform will be able to counter this. If they start requiring to use a phone with harder to spoof camera input, you will simply be able to put the camera in front of a high resolution screen. The cat and mouse game will not last long.
- jsheard 8mo agoThey already support ID checks as an alternative to face scanning, if the latter proves to be untenable then it's literally a case of flipping a switch to mandate ID instead.
- Forgeties79 8mo agoMost people under the driving age don’t have ID’s, at least in the US.
- airstrike 8mo agoAnd lose every user in the process
- dark-star 8mo agoI think you massively overestimate how many people actually care. My guess is that 95% or more of all Discord users do not care and simply upload their selfie or ID card and be done with it. I know I will (although they did say that they expect 80%+ to not require verification since they can somehow infer their age from other parameters)
- bee_rider 8mo agoThose 5% are the unusual sorts that separate Discord from Facebook.
- esseph 8mo ago> I know I will Are you a minority, LGBTQ+, etc or of a "different" political persuasion that might have any reason to be distrustful of the US government? If so, you probably wouldn't just "be done with it".
- syntaxing 8mo agoWow that was a fun read, I never thought about the technical implementation of these verification systems.
- whh 8mo agoThat was fast.
- Retr0id 8mo agoHm, when attempting it I get redirected to https://age-verifier.kibty.town/webview?url=null https://age-verifier.kibty.town/webview?url=null, which says: {"error":"error parsing webview url"} Edit: Apparently my discord account is in some kind of A/B feature test that uses a different verification provider, Persona
- 0x1ch 8mo agoHopefully your comment gets pushed to the top. Would like the security guys from the blog to see it.
- internetter 8mo agoIt only works because the other provider has a more private implementation compounded with bad security.
- joeevans1000 8mo agoPersona is the same company oftentimes used for the "show your ID to get in the bar and also we'll data harvest you... and share your data with various people if asked". Go ahead and google search on them for more insight.
- daniel31x13 8mo agohttps://x.com/xyz3va/status/2021734252505604108 https://x.com/xyz3va/status/2021734252505604108
- ThePowerOfFuet 8mo agohttps://xcancel.com/xyz3va/status/2021734252505604108 https://xcancel.com/xyz3va/status/2021734252505604108
- deleted 8mo ago[deleted]
- taesu 8mo agodoesn't work - request times out.
- kotaKat 8mo agoworked here - as soon as i did it i heard a dm ping from the 'official' discord account... "We determined you're in the adult age group."
- scarygliders 8mo agoIt does appear to work. I received a message from Discord saying "We determined you're in the adult group. <learn more>" narrator> And that's when he discovers his account has now been hacked... ;)
- 0x1ch 8mo agoWorked for me as well. Hopefully my account of 11+ years isn't penalized because of this. Not like it matters because I'll quit anyways if forced to send my face or ID.
- dark-star 8mo agoYou probably won't even have to validate then. I guess they can safely assume that you didn't create your account when you were 7 years or younger. They said they expect 80% of users or so to be auto-verified by some other means (account age, typing statistics, whatever)
- Retr0id 8mo agoMy account is almost a decade old and discord is still asking me to complete age verification.
- poly2it 8mo agoAre they rolling this out in stages? I haven't been asked to prove the age of my account.
- Retr0id 8mo agoI'm in the UK (where the law allows them to use heuristics).
- rationalist 8mo agoSo VPN to the UK?
- thephotonsphere 8mo agotoo late: I have already deleted my Discord account; Twitch is also going to enforce this? hmmm...
- dark-star 8mo agoif you don't actively use discord, then this is probably the best solution, I agree
- GaryBluto 8mo agoI don't understand why (mostly) young people put so much effort into remaining customers of a service that is actively hostile against them and that they do not like. Does the convenience of remaining on a service you don't like the management of outweigh the mild effort to find an alternative solution?
- Anonbrit 8mo agoI don't control most of the discord communities I'm in. Some have been going a long time, and every platform migration sheds and shreds members. The 'mild effort' to move an old community to a new platform more often than not killed the community
- GaryBluto 8mo ago> and every platform migration sheds and shreds members. What's the problem? You're filtering out people who don't really care about participation in whatever group or society is there. People who want to participate will move to an acceptable service and those who feel that is too much effort probably weren't participating much (if at all) anyway - in that case the only difference is the visible list of people with accounts going down, not the actual "users".
- KittenInABox 8mo agoI disagree with this sentiment. It is entirely possible that there will be people who are regulars on one platform who are just unable (actually unable or perceives themselves unable) to migrate and the morale lost from losing their regulars is huge. Or a subset who insist on staying, forming their own sub-community, and neither the migrating group nor the people who insist on staying produce enough engagement for the members and so the community as a whole fizzles out. This is all squishiness. There is a reason why deplatforming appears to work in reducing the effectiveness of political groups, even if the people who remain in the community post-deplatforming are hardened in their loyalty to the political policy of the group.
- Gigachad 8mo ago
- lelandfe 8mo agoLove that hackers are still using "greetz"
- electrotype 8mo agoI'm against workarounds. I'm pro "leaving them and only come back when Digital ID is not required anymore".
- monksy 8mo agoThis project is something that we would want to archive pretty quickly. I can see those service being upset over that being exposed.
- digiown 8mo agoYou're assuming discord or twitch actually care. I doubt they actually do. It's there to preempt the regulatory hammer, and the presence of clunky workarounds like this doesn't affect it if it doesn't reach the mainstream. If it does, they can just patch it.
- chii 8mo agothe hammer of the gov't works slowly, but such bypasses will eventually be worked around - it doesn't matter if twitch/discord/etc actually care or not, because their care is irrelevant. > the presence of clunky workarounds like this doesn't affect it if it doesn't reach the mainstream. i suspect that mainstream would eventually find it - like how VPNs suddenly became very popular in the UK.
- nirav72 8mo agoThat worked for me. Got a response on desktop discord client once it was done. Wonder how long before they lock this down.
- idontwantthis 8mo agoIs this not easily patched by the provider encrypting and signing the whole payload? I would have thought that would be table stakes for an identity provider.
- arcologies1985 8mo agoThe identity provider is on-device and has to run on phones which don't do hardware attestation.
- idontwantthis 8mo agoThat’s only for selfies. If they use and id I’m pretty sure it is getting sent to a k-id server.
- lemoncookiechip 8mo agoAny chance this can be used to token-log people's accounts?
- mzajc 8mo agoIt looks like only k-id's session token is transmitted back to the site, which can't be used to authenticate to Discord. You can also self-host the backend from https://github.com/xyzeva/k-id-age-verifier https://github.com/xyzeva/k-id-age-verifier.
- extraduder_ire 8mo agoAccording to discord, there's an 11/10 chance you're being scammed by doing this.
- zerebos 8mo agoThat code snippet for Discord is pretty brittle and will likely break with future updates.
- deleted 8mo ago[deleted]
- k33n 8mo agoAge verification itself isn't such a bad thing. I feel most people are more angry about having to verify their actual identity. Every ad provider knows your address and complete identity every time you log into anything though. I guess its the illusion of anonymity that's so popular.
- tbrownaw 8mo agoAge verification is an excuse for identity checking.
- k33n 8mo agoI remember when people who used this site were rational experts. The emotional outbursts here are a bit disappointing.
- rockskon 8mo agoHorseshit. There's often a degree of uncertainty with the data advertisers have. This would heavily reduce that uncertainty and enable worse behavior on the part of advertisers.
- Namidairo 8mo agoI suspected something along these lines was possible when I looked at this provider a couple months ago. If I recall, I had a fairly decent view of their various checks because it was delivered completely unminified, including a couple amusing sections and unimplemented features. (A gesture detector with the middle finger gesture in the enumerable commented out, for example...) Another attack vector that I speculated upon was intercepting and replacing their tflite model with ones own, returning whatever results required. Additionally, I believe they had a check for virtual camera names in place, as checks would quietly fail with a generic message in the interface, but show the reason as being virtual camera within responses. (Camera names are mutable though, so...)
- zb3 8mo agoWorked, hopefully Discord will retroactively discover this and ban my account.
- brokenmachine 8mo agoOn Discord, I got the captcha, but then after it redirected, I got a page saying: {"error":"failed to execute k-id privately action (status=404)"} I'm very much an adult, this whole thing is ridiculous. Ban me, I don't care.
- paularmstrong 8mo agoI got this, but then refreshing that page made it work for me
- diogenes_atx 8mo agoThe text with the code shows another step.
- brokenmachine 8mo agoI tried it a couple more times, and it worked on the third try and showed me the green successfully verified message.
- deleted 8mo ago[deleted]
- Fnoord 8mo agoYour browser is not currently supported. Please use a recommended browser or learn more here. Apparently Twitch doesn't like Mozilla Firefox...
- jheriko 8mo ago[dead]
- r2vcap 8mo agoWell, it’s a clever idea. Discord seems to have intentionally softened its age-verification steps so it can tell regulators, “we’re doing something to protect children,” while still leaving enough wiggle room that technically savvy users can work around it. But in practice, this only holds if regulators are either inattentive or satisfied with checkbox compliance. If a government is competent and motivated, this approach won’t hold up—and it may even antagonize regulators by looking like bad-faith compliance. I’ve also heard that some governments are already pushing for much stricter age-verification protocols, precisely because people can bypass weaker checks—for example, by using a webcam with partial face covering to confuse ID/face matching. I can’t name specific vendors, but some providers are responding by deploying stronger liveness checks that are significantly harder to game. And many services are moving age verification into mobile apps, where simple JavaScript-based tricks are less likely to work.
- tyre 8mo ago> Discord seems to have intentionally softened its age-verification steps so it can tell regulators, “we’re doing something to protect children,” while still leaving enough wiggle room that technically savvy users can work around it. ...source? I sincerely doubt that Discord's lawyers advocated for age verification that was hackable by tech savvy users. It seems more likely that they are trying to balance two things: 1. Age verification requirements 2. Not storing or sending photos of people's (children's) faces Both of these are very important, legally, to protect the company. It is highly unlikely that anyone in Discord's leadership, let alone compliance, is advocating for backdoors (at least for us.)
- hananova 8mo agoUsually in cases like this, there is no source, there can’t be. Long long ago, long enough to be past the statute of limitations, I was involved in a similar regulatory compliance situation. We specifically communicated in such a way that “actual effectiveness” wasn’t talked about, and we set that up with a single, verbal only and without recording, meeting between the team and one of the lawyers. Point is, these kinds of schemes where internal communication is deliberately hobbled to comply maliciously with requirements while still being completely in the clear as far as any actual recorded evidence goes. And there’s always at least one person piping in with a naïve “source?” as if people would keep recorded evidence of their criminal conspiracies.
- nubinetwork 8mo agoNever trust user input wins again... on one hand, discord never sees your picture, on the other, you get this. :)
- brandonb927 8mo agoHighly recommend wrapping the code to drop into the console in a immediately-invoked function expression; as it stands, it doesn't work in macOS Safari without an IIFE because top-level await is not supported in any version of Safari yet https://caniuse.com/wf-top-level-await https://caniuse.com/wf-top-level-await.
- MallocVoidstar 8mo agoWhy bother supporting Safari when they aren't interested in supporting the modern web? They're five years behind.
- reddalo 8mo agoIn a way I agree with you; but practically 100% of iOS/iPad users are forced to use Safari. Plus, it's nice to have a browser engine that's not Chromium.
- ethanrutherford 8mo agoIf that browser engine is safari, I have to seriously question the validity of that final sentence. The fact that safari refuses to support modern features and is forced on ios devices makes it even worse.
- dang 8mo agoRecent and related: Discord will require a face scan or ID for full access next month - https://news.ycombinator.com/item?id=46945663 https://news.ycombinator.com/item?id=46945663 - Feb 2026 (1999 comments) Discord Alternatives, Ranked - https://news.ycombinator.com/item?id=46949564 https://news.ycombinator.com/item?id=46949564 - Feb 2026 (456 comments) Discord faces backlash over age checks after data breach exposed 70k IDs - https://news.ycombinator.com/item?id=46951999 https://news.ycombinator.com/item?id=46951999 - Feb 2026 (21 comments)
- areoform 8mo agoThe comments so far assume that Discord / Twitch / Snapchat don't care as entities that people will start bypassing their age verification systems. I believe the rank-and-file think that's the case. I think even the engineers and PMs think that's the case. But that's not the game. There are many ways in which such a system could be implemented. They could have asked people to use a credit card. Adult entertainment services have been using this as a way to do tacit age verification for a very long time now. Or, they could have made a new zero-knowledge proof system. Or, ideally, they could have told the authorities to get bent. Tech is hardly the first industry to face significant (justifiable or unjustifiable) government backlash. I am hesitant to use them as examples as they're a net harm, whereas this is about preventing a societal net harm, but the fossil fuel and tobacco industries fought their governments for decades and straight up changed the political system to suit them. FAANG are richer than they ever were. Even Discord can raise more and deploy more capital than most of the tobacco industry at the time. It's also a righteous cause. A cause most people can get behind (see: privacy as a selling point for Apple and the backlash to Ring). But they're not fighting this. They're leaning into it. Let's take a look at what they're asking from people for a second, the face scan, If you choose Facial Age Estimation, you’ll be prompted to record a short video selfie of your face. The Facial Age Estimation technology runs entirely on your device in real time when you are performing the verification. That means that facial scans never leave your device, and Discord and vendors never receive it. We only get your age group. Their specific ask is to try and get depth data by moving the phone back and forth. This is not just "take a selfie" – they're getting the user to move the device laterally to extract facial structure. The "face scan" (how is that defined??) never leaves the device, but that doesn't mean the biometric data isn't extracted and sent to their third-party supplier, k-Id. From the article, k-id, the age verification provider discord uses doesn't store or send your face to the server. instead, it sends a bunch of metadata about your face and general process details. The author assumes that "this [approach] is good for your privacy." It's not. If you give me the depth data for a face, you've given me the fingerprint for that face. A machine doesn't need pictures; "a bunch of metadata" will do just fine. Discord is also doing profiling along vectors (presumably behavioral and demographic features) which the author describes as, after some trial and error, we narrowed the checked part to the prediction arrays, which are outputs, primaryOutputs and raws. turns out, both outputs and primaryOutputs are generated from raws. basically, the raw numbers are mapped to age outputs, and then the outliers get removed with z-score (once for primaryOutputs and twice for outputs). Discord plugs into games and allows people to share what they're doing with their friends. For example, Discord can automatically share which song a user is listening on Spotify with their friends (who can join in), the game they're playing, whether they're streaming on Twitch etc. In general, Discord seems to have fairly reliable data about the other applications the user is running. Discord also has data about your voice (which they say they may store) and now your face. Is some or all of this data being turned into features that are being fed to this third-party k-ID? https://www.k-id.com/ https://www.k-id.com/ https://www.forbes.com/sites/mattgardner1/2024/06/25/k-id-closes-45-million-series-a-in-quest-for-child-safety-in-gaming/ https://www.forbes.com/sites/mattgardner1/2024/06/25/k-id-cl... https://www.techinasia.com/a16z-lightspeed-bet-singapore-parent-tech-startup https://www.techinasia.com/a16z-lightspeed-bet-singapore-par... k-ID is (at first glance) extracting fairly similar data from Snapchat, Twitch etc. With ID documents added into the mix, this certainly seems like a very interesting global profiling dataset backstopped with government documentation as ground truth. :)
- boca_honey 8mo ago[flagged]
- piperswe 8mo agoI’ll comply with a police officer because of their threat of violence. I will not comply with online bullshit, because Discord can’t shoot me.
- kmoser 8mo agoNever underestimate the ability of a corporation to send the feds to your door.
- boca_honey 8mo agoCold you give an example of corporation sending someone to someones door?
- kmoser 8mo agoMPAA complaint kicks off Pirate Bay raid: https://en.wikipedia.org/wiki/The_Pirate_Bay_raid https://en.wikipedia.org/wiki/The_Pirate_Bay_raid RIAA tips off authorities: https://archive.is/CbZZq https://archive.is/CbZZq
- deleted 8mo ago[deleted]
- vimda 8mo agoNeat that this exists, but priming children to copy/paste random JavaScript into their Dev consoles feels like a recipe for disaster. Bets on how long before malware starts buying up "discord age verification bypass" ad spots?
- lemfireferral 8mo ago[dead]
- neilv 8mo agoThree problems with this: 1. Removes the pain of age verification, encouraging some people to stay in the proprietary walled garden when everyone would be better served by open platforms (and network effects). 2. Provides a pretext for more invasive age verification and identification, because "the privacy-respecting way is too easily circumvented". 3. Encourages people to run arbitrary code from a random Web site in connection with their accounts, which is bad practice, even if this one isn't malware and is fully secure.
- rippeltippel 8mo agoProving that something is possible doesn't mean encouraging it. This was a beautiful work of reverse engineering, that shows how hard it can be to verify personal data without invading privacy. I prefer this awareness to blind trust. The code was released, therefore it is not arbitrary (problem #3). Should companies react with more invasive techniques (problem #2), users can always move to other platforms (problem #1).
- FMecha 8mo ago>users can always move to other platforms (problem #1) Until the cycle restarts again with new platforms. Also, I am convinced self-hosting or getting a new platform (including return to traditional forums) to run might as well be bureaucratically harder at this point, given the case of lfgss' shutdown: https://news.ycombinator.com/item?id=42433044 https://news.ycombinator.com/item?id=42433044
- jen729w 8mo ago> everyone would be better served by open platforms Oh cool, which ones?! …aaaand there's the problem.
- unethical_ban 8mo agoThis suggests that the immediate availability of a drop-in replacement today means there is no utility in encouraging that growth. There are multiple open-source tools that do everything Discord does. There are few-to-none that offer everything Discord does, and certainly none that are centralized, network-effect-capture-ready. Short term: * Small group chats with known friends: Signal, whatsapp, IRC, Matrix * Community chat: Zulip, Rocket.chat * Community voice: Mumble, Teamspeak * Video / screen sharing and voice chat: Zoom, BigBlueButton, Jitsi I've heard about Stoat but haven't read up on it.
- shevy-java 8mo ago"k-id, the age verification provider discord uses doesn't store or send your face to the server. instead, it sends a bunch of metadata about your face and general process details." I think the primary issue is not the "send your face" (face info) to a server. The problem is that private entities are greedy for user data, in this case tying facial recognition to activities related to interacting with other people, most of them probably real people. So this creates a huge database - it is no surprise that greedy state actors and private companies want that data. You can use it for many things, including targeted ads. For me the "must verify" is clearly a lie. They can make it "sound logical" but that does not convince me in the slightest. Back in the age of IRC (I started with mIRC in the 1990s, when I was using windows still), the thought of requiring others to show their faces never occurred to me at all. There were eventually video-related formats but to me it felt largely unnecessary for the most part. Discord is (again to me) nothing but a fancier IRC variant that is controlled by a private (and evidently greedy) actor. So while it is good to have the information how to bypass anything there, my biggest gripe is that people should not think about it in this way. Meaning, bypassing is not what I would do in this case; I would simply abandon the private platform altogether. People made Discord big; people should make Discord small again if they sniff after them.
- pests 8mo ago> the thought of requiring others to show their faces never occurred to me at all I know you meant as a service provider, but as a avid IRC (and an online game that conventionally alt-tabbed into a irc-like chat window) chatter as a young preteen in the 90s and 00s, I made a lot of online friends that I would not discover what they looked like IRL for decades, some never. People I was gaming with in the 90s, for the first time, I would see what they looked like over FB in a group made for the now-almost-dead game in the 10s. It was like "swordfish - man, where are you now? I don't even know your real name to find ya. shardz - you look exactly like I would picture ya!." Just some musings.
- onetokeoverthe 8mo ago[dead]
- 8mo ago
- shocker321 8mo ago[dead]
- 999900000999 8mo agoWith the way things are going, just go back to email. CC everyone.
- ryan-c 8mo agoDoesn't appear to be working, at least for UK purposes. Tool claimed to have worked, I dropped my VPN and my account is not age verified.
- kelvinjps10 8mo agoWhy people act like this never has been implemented like the gigs and financial apps already validate indetity
- asutekku 8mo agoIt's slightly different to access your bank account vs chatting with your friends.
- NackerHughes 8mo agoLooks like it may already have been patched, it's not working for me. Seems I'm not the only one either: https://github.com/xyzeva/k-id-age-verifier/issues/7 https://github.com/xyzeva/k-id-age-verifier/issues/7
- jdthedisciple 8mo agoIt worked for me (I got the green success message) however I did not get a confirmation DM from the "official Discord account" like others said they did. Anyone got a clue what that means?
- cedws 8mo agoUK user here, it still shows my account as Unverified after running :(
- extraduder_ire 8mo agoCheck the issues/PRs on their github.
- jfaganel99 8mo ago[flagged]
- adjfasn47573 8mo agoYou forgot one (the sane one, which is coming soon anyway): Using a government issued eID system. The EU is going to rollout eID in a way that a site can just ask “is this person > age xy?”. The answer is cryptographically secure in the sense that this person really is this age, but no other information about you has to be known by the site owner. Which is the actual correct way to do it. I don’t understand why all the sites go crazy with flawed age verification schemes right now, instead of waiting a until the eID rollout is done. EDIT: I forgot to mention that it’s only the correct way if the implementation doesn’t give away to your government on which sites you browse… Which I believe is correctly done in the upcoming EU eID but I could be wrong about it.
- stubish 8mo agoSites need to deal with Australia, which punted all responsibility to the platforms and provided no real assistance (like say the government half of the eID system that manages all the keys and metadata)
- latexr 8mo ago> Sites need to deal with Australia Do they? The UK’s population is more than double of Australia’s and some websites (e.g. imgur) are outright blocking the UK.
- ChocolateGod 8mo agoimgur blocking the UK is not due to ID verification, but because they refused to stop making money off childrens data.
- latexr 8mo agoThe reason is irrelevant. The point is websites don’t need to deal with <insert country>.
- petterroea 8mo agoI pray the status quo is good enough for legal requirements and the hacks like these don't mean the end of on-device verification (or the requirement of chain of trust from boot)
- extraduder_ire 8mo agoWorth noting when you open up the developer tools console in discord (facebook and some other sites do it too), you get a regular message printed with "If someone told you to copy/paste something here, there’s an 11/10 chance you’re being scammed." and then "Pasting anything in here could give attackers access to your Discord account." in bold+red text. It used to also mention "free nitro" as an example of a scam you may be falling for. I've heard, but haven't confirmed, they also detect you opening developer tools using various methods and remove your auth keys from localstorage while you have it open to make account takeovers harder. (but not impossible) Opening the browser console in a separate window mitigates some of that detection.
- miki123211 8mo agoYes, Google does this, and it is infurriating. Every time I open the dev tools on Safari (to reverse-engineer some random broken website that doesn't let me do what I need to and forces me to write yet another Python script using Beautifulsoup4), Google logs me out of all of my accounts. To add insult to injury, Google's auth management is so broken that if I log in to the "wrong" account first by accident (E.G. when joining a work meeting from Calendar.app), that account now becomes primary for Google Search / Youtube, and there's no way to change that without logging back out from all accounts and then logging into them again.
- 71bw 8mo ago>I've heard, but haven't confirmed, they also detect you opening developer tools using various methods and remove your auth keys from localstorage while you have it open to make account takeovers harder. (but not impossible) No, they just keep moving it between updates. It's still there. It just gets harder to extract.
- Starlevel004 8mo ago> I've heard, but haven't confirmed, they also detect you opening developer tools using various methods and remove your auth keys from localstorage while you have it open to make account takeovers harder. (but not impossible) You can open the network tab, click an API requesst, and copy the token from the Authorization header.
- gorgoiler 8mo agoThis is an abhorrent threat to the safety of our children and just another example of how the [Red / Blue]* party are failing in online safety. That is why we, the [Blue / Red] party are announcing today a manifesto pledge to outlaw all computers that allow unsigned booting of unauthorized platforms, to outlaw all browsers that do not participate in the chain of trust this provides, and to outlaw all websites that do not verify the code path from boot to browser. Only with complete trust and authorization will we be able to sleep safe in the knowledge our children’s faces are being scanned by law abiding patriots and not subverted by evil hackers like xyzeva and Dziurwa. — General Secretary gorgoiler .. .. .. *What do you do, btw, if you extend your political machine into another country by subsuming their party into yours, but when their colour is traditionally X and yours is traditionally Y? Mixed light: the White party? Mixed paint: the Brown party?
- extraduder_ire 8mo agoTangentially, it's kind of weird how most of the sites' systems to verify your age try to get you to do it on a phone. I've never used twitter on a phone, yet that's the only official way to go through the age verification process. Youtube too. I attempted to get through the youtube one on a new account to see an age-gated video, but couldn't finish the process and gave up. At the time, I remember thinking it would be easier for me to buy an age verified google account from someone.
- JustSkyfall 8mo agoMy theory is that the vast majority of users won't have an Android with root access/a jailbroken iPhone, which reduces the risk of using a virtual camera? Then they can just block emulators/rooted/jailbroken devices which increases the barrier to entry.
- miav 8mo agoThe reaction to Discord age verification fiasco once again makes me believe that HN users just don’t have friends. There is no alternative for Discord for bigger groups. If there was, I still couldn’t move multiple social circles to it, no matter how much I evangelised. The “just don’t use the less morally aligned platform” argument has always been valid only for those without a strong need for it, whether it’s X or Discord.
- tim1994 8mo agoWell, someone has to start. It's ok if you use the alternative with a subset of your contacts.
- moring 8mo agoUsing whatever platform you prefer with a subset of people is fine and doable, but you're lying to yourself if you think that it is the "start" of anything.
- hackable_sand 8mo agoIt has to overcome some critical mass, i.e. political inertia.
- gzread 8mo ago[dead]
- dominicq 8mo agoTelegram, WhatsApp, Signal? I have friends and I don't use Discord or understand why I would want to use it.
- Kelteseth 8mo agoSelf hosted TeamSpeak for communication & gaming and a signal group for chatting.
- sva_ 8mo agoI mostly use Telegram with my friends circle. You can have groups with individual topics. But we don't do group calls. I don't really see the appeal of group calls unless you are a gamer maybe. If I want to talk to them, I go meet them. Signal for direct messaging and calls
- T3RMINATED 8mo ago[dead]
- matips 8mo agoI hope that Discord, Twitch and Snapchat will die soon after introducing verification of adult persons. I hope it will be replace by more open and privacy respecting services.
- micromacrofoot 8mo ago> doesn't store or send your face to the server. instead, it sends a bunch of metadata about your face we really need to teach people to stop being fooled by this, a "bunch of metadata" is often enough to fully reconstruct a face
- artisin 8mo agoNOTE: The script is broken, DO NOT ATTEMPT TO USE THE SCRIPT NOW. Attempting to run it may get your account flagged stopping you from trying face verification either temporarily or permanently, forcing you to use your ID. pr: https://github.com/xyzeva/k-id-age-verifier/pull/12 https://github.com/xyzeva/k-id-age-verifier/pull/12
- CivBase 8mo agoThe implementation doesn't matter. Current options for bypassing it don't matter. The nature of the content being blocked doesn't matter. The root problem is that Discord is asking users for their real identity in exchange for accessing social media content. That is a line that simply should not be crossed. They can change the implementation later. They can make it harder to bypass. They can identify users who bypassed it and start them over from square one. They can change what type of content is blocked. They can alter the deal, but users cannot take back their identity once it is handed over. Discord has become a platform that is outwardly adversarial to its users. Don't try to fight it. Don't keep investing in a platform that's actively hostile to you. Cut your losses now and find something else.
- myself248 8mo agoAs always, motivated minors will trivially bypass things. Only annoyed adults, who don't see the point in pursuing a bypass, will supply their actual ID, which is what will eventually get breached in the inevitable yet-another-breach. These schemes only place the honest at risk.