11 ms·
Discord cuts ties with identity verification software, Persona
- embedding-shape 8mo agoAh man, just tried to submit this with the title "Discord cuts ties with Peter Thiel-backed SaaS once code tied to US spying found" which is slightly better I think, and fits exactly within 80 characters :) I think the whole "after its code was found tied to U.S. surveillance efforts" part is new and wasn't known before, so feels important to have in the title too. Although most of us probably assumed it was true before too.
- crimsoneer 8mo agoIs this actually a thing that is true?
- deleted 8mo ago[deleted]
- embedding-shape 8mo agoI don't think HN titles are judged by "is it true?" but rather how close the submission title is to the original title and otherwise represents the content of the submission.
- blitzar 8mo ago> once code tied to US spying found New and also should be the big story. "Butcher cuts ties with supplier when steaks found to be human meat" shouldnt be a story about changing suppliers ...
- robtherobber 8mo agoThat would have been a better title, I agree.
- zer00eyz 8mo ago> "after its code was found tied to U.S. surveillance efforts" part is new ... Although most of us probably assumed it was true before too. This makes me feel VERY old. 641A: https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A Retroactive telecom immunity: https://www.eff.org/press/archives/2008/10/17 https://www.eff.org/press/archives/2008/10/17 The government spying on what you do has been old news for 20 years. Snowden should not have been a shocking revelation to any one but it was, and that was 13 years ago. Its less of a "assumed it was true" and more of a "oh look another one, not shocking".
- bigyabai 8mo ago> The government spying on what you do has been old news for 20 years. The methodology has evolved dramatically in those 20 years, what we've seen from Snowden is almost certainly obsolete in the light of new surveillance tactics. Even as a pessimist myself, I'm still routinely shocked by the lengths that American tech has been bugged. Salt Typhoon is really the icing on this cake; "lawful" intercept turned against the state that implemented it. There are more twists left in this story no matter how jaded you might feel.
- rapnie 8mo agoYou might email @dang and request a title change. hn@ycombinator.com is the email address.
- venturator 8mo ago[dead]
- jyscao 8mo agoSo does this mean Discord is scrapping its new face verification requirement for users, or imply they’re no longer using this 3rd party service (Persona) to do it? The article wasn’t too clear on that.
- Macha 8mo agoK-id is the vendor they were proposing which did on device processing. They were trying to downplay the initiative by saying all the k-id data stayed on device. This was undermined by the fact they were also trialling a switch to Persona (the vendor in the story), which did not uphold that guarantee. It was horrific optics to be reassuring people that it was ok because you didn’t save data but also be trialling a switch to a vendor which did save data, which I guess is a lot of the reason this vendor switch was cancelled. (Though it does call into question discord’s judgment that they thought this was a good idea). Anyway, Persona was also breached which is how the government links were discovered and also probably a part of this decision. This is not to be confused with the breach in November of 5CA, _another_ vendor they used in the initial UK and Australia roll outs. The fact that two vendors were breached in four months is a good example of why this is a bad idea
- m4rtink 8mo agoI don't think you can ever trust closed source software that also requires network for other features that it really does on-device processing for something specific. It might not even send the sensitive data immediately but bundle it with other traffic once it goes online.
- Aurornis 8mo ago> So does this mean Discord is scrapping its new face verification requirement for users, No, they’re outsourcing the verification to an external company. Just not this one. Side note: The verification is only if you want to remove content filters, join adult-themed servers and a couple other features. If you only want to chat with your friends and use voice then no verification is required.
- 8mo ago
- ta9000 8mo agoToo fucking late, eat shit Discord. We’re all moving to E2E encrypted platforms.
- squeefers 8mo agowhere we definitely will not be moaning about the same thing in 18 months time
- alphawhisky 8mo agoJoke's on you, once I finish setting up my P2P tin can network I'll be invisible.
- dgxyz 8mo agoI just nuked it and didn’t replace it. Bloated piece of shit full of misery. We decided to just meet up in person twice a month and play board games instead.
- encom 8mo agoWhat's the point of E2E on a chatroom/channel/"""server""" that anyone can join? Yes, I'm making (another) argument in favour of IRC. IRC has optional client-server encryption, and you can set channel modes to only allow encrypted clients access. So that way you at least prevent eavesdropping.
- josefritzishere 8mo agoThis does not cure the face scanning nonsense. I deleted and am not going back.
- john_strinlai 8mo ago>Nearly 2,500 accessible files were found sitting on a U.S. government-authorized endpoint, researchers pointed out on X. The files showed Persona conducted facial recognition checks against watchlists and screened users against lists of politically exposed persons. >Persona performs 269 distinct verification checks, including screening for “adverse media” im sure everyone assumed this, but its good to know it. >And the information was openly available. “We didn’t even have to write or perform a single exploit, the entire architecture was just on the doorstep,” it is kind of scary how often these types of situations are only found out because of wild incompetence. you have to imagine that most similar situations dont suffer from the same incompetence (and thus arent known) >“At Discord, protecting the privacy and security of our users is a top priority. please, i wish companies would just stop saying this obvious lie. you know that you dont care. we know that you dont care. >It’s dystopian that we want people to facedox themselves to everyone to be real online. .... says the ceo of the company that you have to send your face ("facedox", if you will) to
- navbaker 8mo agoThat last quote, buried at the end of the article, absolutely killed me. I cannot believe he had the nerve to say that doing what he does everyday
- midtake 8mo ago> According to Discord, only a small number of users were part of this test, in which any information submitted could be stored for up to seven days before it would be deleted. Ah yes, we only store it for 7 days. During those 7 days, we pass it to Persona, and who knows how long they keep it!
- AlexandrB 8mo agoDiscord's previous statement: > "Identity documents submitted to our vendor partners are deleted quickly— in most cases, immediately after age confirmation" So now it's not "immediately" but 7 days? I don't know how anyone can trust any statement from these guys.
- jandrese 8mo agoThe way I read that is Discord would delete your data, but they were taking an intentionally hands off approach to the data broker they subcontracted to identify you.
- jcgrillo 8mo agoThe one thing you can trust is this: If a tech company says something to you, and they don't give you the means to verify it on your own, they are lying to you. Do not trust anything they say, ever.
- rocketpastsix 8mo ago"I don't know how anyone can trust any statement from these guys." this is the fun part, you can't!
- mkesper 8mo agoRelated: I Verified My LinkedIn Identity. Here's What I Handed Over https://news.ycombinator.com/item?id=47098245 https://news.ycombinator.com/item?id=47098245
- bri3d 8mo agoThe referenced write-up based on the Persona front end code is here: https://vmfunc.re/blog/persona https://vmfunc.re/blog/persona I definitely recommend reading this primary source before drawing conclusions about the code as most of the secondary reporting is quite low quality.
- dunder_cat 8mo agoSeems to be down for me. https://web.archive.org/web/20260220192124/https://vmfunc.re/blog/persona/ https://web.archive.org/web/20260220192124/https://vmfunc.re...
- beacon294 8mo agoIt's up.
- bondarchuk 8mo agoSubmitted 6 days ago but flagged https://news.ycombinator.com/item?id=47059129 https://news.ycombinator.com/item?id=47059129 @dang can this get a second chance?
- vincnetas 8mo agodamn. why did the website stole my audio?
- pavel_lishin 8mo agoSome of the most interesting authors in tech on the internet have just absolute awful websites. Blinking animations everywhere, weird sounds, "cute" little javascript animations like it's 1999 again.
- john_strinlai 8mo agothe last time the website was submitted, over half the comments talked about website design instead of the actual content. we can probably skip doing it again. different people have different tastes. people complain about boring websites, people complain about websites with animations or colors. the only guarantee is that the conversation isnt interesting. if you are on the side that doesnt like music, animations, whatever, i recommend a combination of noscript and using reader mode.
- mikkupikku 8mo agoFor some reason, discord has never asked more from me than a verified email address. No phone number or anything else. Maybe I'm being monitored and they don't want to spook me off the honeypot? Half joking..
- harrisoned 8mo agoSame for me, and my account is almost a decade old. I think it depends a lot where are you from and the kind of activity, as i read stories of people being asked to register a number out of nowhere. Many servers requires you to have it tho, due to spam protection. I just don't talk on those.
- pram 8mo agoIt’s tragic but I have the “verified” setting turned on my public server because it’s literally impossible to stop a determined spammer with the tools Discord has. They can make new accounts faster than you can ban them, and there’s no like “IP ban” equivalent
- ronsor 8mo agoDiscord bans are IP bans by default, but new IP addresses are cheap. Even phone numbers are cheap for a determined spammer.
- grayhatter 8mo agoIf your account is a decade old, and you registered at 13, you're now 23 and they don't need to verify you're older than 18. If you were younger than 13, they might be required to delete your account.
- HWR_14 8mo agoEach discord server can decide whether they only will allow people with a phone number on. When you hit one of those, Discord will ask you for your number.
- 8mo ago
- rideontime 8mo agoI'm glad to see "Peter Thiel-backed" becoming a widely-recognized epithet.
- metalliqaz 8mo agoit is truly amazing how much damage one person is able to do to civilized society if you expand the scope to a handful of adjacent figures, the catastrophe is truly amazing
- pphysch 8mo agoThiel is one of the more public faces of what is now known as the "Epstein class" of societal predators. But one of many and certainly not the epicenter.
- SilverElfin 8mo agoYep Epstein class. It’s a great phrase for the billionaire elites who have corrupted our society through their wealth. We need heavy taxes on them now to preserve our democracy. And also, Thiel is literally in the Epstein files. Meeting with Russian officials repeatedly on the island. One is said to be his handler so he may just be an asset tasked with destabilizing America.
- timacles 8mo agoThere is certainly a shadow cabal of these elite billionaire types that avoid all public exposure yet are working very hard to destroy society and profit
- verdverm 8mo agoSome people are trying to use a different word than "cabal" because of the racial associations and history. Oligarchs/y are among my choices, but I have supplanted that with Epstein Class now, to be more accurate to whom I refer
- rvz 8mo agoDo not believe them.
- mentalgear 8mo agoEveryday someone cuts ties with Palentier's Peter Thiel (or the rest of the digital mafia), it's a good day for society as a whole.
- Devasta 8mo agoThey really should be a proscribed organization.
- throawayonthe 8mo agoafaik the term "proscribed organization" is used nigh-exclusively in the imperial core, so i'm not sure how that applies here
- stephc_int13 8mo agoThis name is turning radioactive. Not a bad thing.
- jacquesm 8mo agoDiscord? Or Thiel? Or both?
- stephc_int13 8mo agoThiel.
- dgares 8mo agoAt this rate, both.
- outside1234 8mo agoWho IS still using this verification software?
- jkestner 8mo agoGood question. Quite a few, publicly. https://withpersona.com/customers https://withpersona.com/customers
- outside1234 8mo agoOoof. So no more OpenAI, Twilio, Lime, Square, ...
- rocketpastsix 8mo agothe damage is already done though. Discord just burned years of goodwill and trust. Im in a few discord communities and while they aren't moving Im not looking to join any more right now because of this whole thing.
- dcchambers 8mo agoDiscord is a cancer on the open internet anyway. Real time chat? Great. But entire communities, forums, and wikis moving behind the locked walled of Discord has been a disaster for information discovery. Don't replace Discord with a similar alternative. Return to open forums and wikis!
- jacquesm 8mo agoYes. And likewise for all those other walled gardens. I shouldn't need a Facebook or a Twitter account to read what some politician wrote.
- ronsor 8mo agoThe problem is forum UX on mobile is mediocre, and people have to create an account for each forum. Most people are using mobile devices now, like it or not, so convenience of rich text chat wins out.
- bsza 8mo agoI would have agreed 5 years ago, but not this day and age, when AI is raping open source projects and killing platforms like Stack Overflow. We need a safe space from web crawlers and surveillance, and open forums ain't it. (Neither is Discord, but a sufficiently secure alternative might be.)
- SpaceManNabs 8mo agoAI is what??
- bsza 8mo ago
- IgorPartola 8mo ago> politically exposed persons I do not know what this euphemism means. Is this like the modern trend of calling inmates “justice involved individuals”?
- parrellel 8mo agoTranslate: People who are likely to be attacked by (Putin|Orban|Erdogan|Trump) or similar.
- IgorPartola 8mo agoApparently that’s not what Wikipedia defines it as. More like potentially shady high level government official.
- parrellel 8mo agoInteresting, I've mostly heard it referring to individuals like Navalny or the mayor of Istanbul. I suppose it makes sense for it to refer to any random political critter.
- john_strinlai 8mo agoits not some new/modern trend just because you have not seen the term. its been a term for nearly 3 decades. https://en.wikipedia.org/wiki/Politically_exposed_person https://en.wikipedia.org/wiki/Politically_exposed_person
- IgorPartola 8mo agoI mean today I am one of the 10,000 people learning this for the first time. But it does seem like an awkward term which seems to mean “high level government official who is likely to be corrupt” or just “politician”. Don’t really see the need for this wordplay to be honest.
- krunger 8mo ago[dead]
- _slih 8mo agodiscord already had 70k government IDs breached through age verification last year. their fix was handing the next batch to a vendor with 2500 files sitting on a government endpoint.
- motbus3 8mo agoThey should never even started doing businesses with that labeled figure. Like ring recently, they just try to see it the thing sticks and that pisses me off. They should have that as a starting point.
- kittikitti 8mo agoThere were a few popular Discord channels where moderators would regularly suspend or ban me. They were toxic communities that advocated for doxxing for mundane reasons. The idea that Discord moderators (even worse than Reddit mods) could have access to verified identities from Palantir related databases sounds so atrocious. Who exactly in their right minds thought this was a good idea in the first place?
- istillcantcode 8mo agoThese guys need to spend a few million on helping them be cool because its fucking their money up. Zuck was headed in the right direction for a minute there. Thiel and Altman are still too weird for most people. Karp is probably in the middle to me. Tasteless, sauceless, billionaires.
- shevy-java 8mo agoI am not convinced. Teter Piel (don't want to use the other name) kind of purchased a LOT of influence power via lobbyists. One lobbyist is Sebastian Lurz (also not going to use the real name here; the letter "l" is an in-country humourous take on Lüssel, Lasser and so forth - ex-politicians). The superrich buy influence and worsen the situation for the rest of us. This has to stop. The USA is currently under direct control of them - this also has to stop. I do not buy into Discord's attempt here though - they 100% knew what they were doing. The only reason they respond in this way is because they alienated and scared their user base with their idea to sniff-invade everyone. It was never about protecting kids in the first place - it was to spy.
- rogerrogerr 8mo agoThis refusal to use people’s names comes across as childish and distracts from your intended point.
- deleted 8mo ago[deleted]
- amingilani 8mo agoTo me it feels pragmatic. I find it more concerning that mass surveillance has come to the point where someone can’t safely express their frankly-not-that-controversial opinions without obfuscating the subject’s name.
- rogerrogerr 8mo agoSo you think that the state has massive surveillance systems (definitely) that it is willing to use maliciously (maybe), but in the age of LLMs is fooled by swapping some letters around? Seems like the threat model is unlikely to line up with reality.
- distortionfield 8mo agoIt’s not a “maybe”. This administration was collecting lists of people who spoke negatively about ICE from social media like a week ago. you really think they’re going to send them gift baskets or something?
- ethin 8mo agowhat is such a shame is, well, two things: first, that these companies even do this kind of thing at all (i.e., age verification); and second, that it takes the kind of backlash this event has generated for them to cut ties with these companies. Apparently, it is too much to ask for any corporation to even give a damn about who runs or backs another corporation that they want to associate themselves with these days.
- CivBase 8mo agoThe bigger shame is that it took Peter Theil's name to get people's outraged about this. Discord handed over their users' identifications to a third party without regard for how it would be used or secured. I don't care if it was backed by Peter Theil or Mother Theresa - it's a huge problem either way. And they'll do it again too. They'll find a new partner - one with less baggage - to do the exact same thing and few people will bat an eye.
- JohnMakin 8mo agoEarly 2024 if you had speculated about this about Persona's broader goals you would have been called nuts. It has become increasingly obvious though.
- aylmao 8mo agoFor anyone interested, they published the post-mortem of the referenced incident: https://withpersona.com/blog/post-incident-review-source-map-exposure-non-production-subdomain https://withpersona.com/blog/post-incident-review-source-map...
- literallyroy 8mo agoThanks. I was curious if someone was going to address the weird use of “CATASTROPHIC” to describe source maps being available for front-end code. It’s already public. Minified is better for the regular user, and should be in production, but it’s like by far the least problematic thing in this article.
- ramon156 8mo agoRight, and in June they'll try it again. Small setbafk
- nottorp 8mo agoSo what? They'll just outsource it to somewhere else. Only question is who's going to lose the data first, Discord or the subcontractors?
- Bender 8mo agoDoes cutting ties with Persona actually take them out of the picture? Whomever they move to can then relay or sell data to Persona. Third party turtles all the way down. inb4 but they pinky promised... The appropriate solution would be to send an RTA header [1] from the servers and the client must check to see if parental controls are enabled on the device or in the application. Not perfect, but likely sufficient to protect small children assuming the account is a child account and the parent enabled parental controls. Teens will always be able to bypass controls whether local or third party. Teens can share porn, warez, movies and more in rated-G video games with one another and small children. Or over SFTP/FTP/P2P/S3/HTTPS. Or a million other ways. Have fun playing whack-a-mole. [1] - https://news.ycombinator.com/item?id=46152074 https://news.ycombinator.com/item?id=46152074
- OutOfHere 8mo agoMatrix works. You don't need Discord.
- ms170888 8mo ago[flagged]
- tempodox 8mo agoWhat the hell does Discord need identity verification for in the first place?
- deleted 8mo ago[deleted]
- SV_BubbleTime 8mo ago“For The Children”!
- Duplicake 8mo agoFinally
- squigz 8mo agoWhy was the title changed from its original that mentioned it's owned by Peter Thiel?
- tomhow 8mo agoBecause it's clickbait. The company has several major VC investors, and Thiel is one partner at one of them.
- dmitrygr 8mo agoIs there a problem with Peter Thiel or is their problem that somebody accidentally leaked the front end source code? The first I would understand, though I would find it silly. The second I don’t understand. Front end code is neither meant to be secret nor meant to be trusted. Who the hell cares if your users can see it?
- Beijinger 8mo agoIs this the same provider that linkedin uses? I was never able to pass this succefully.
- yuppiepuppie 8mo agoDo you resemble a Moldovan Finance Minister?
- Beijinger 8mo agoI am not sure since I don't know how the Moldovan Finance Minister looks.
- Grisu_FTP 8mo agoEven if I disregard all the shady connections that are obviously total coincidences, it still wouldnt feel better they worked together at all. You should only partner with a company if you are 100% certain it fits.