▲ 606 ▼ Discord customer service data breach leaks user info and scanned photo IDs (www.theverge.com) submitted 1 year ago by QuantumSpecter@lemmy.world to c/technology@lemmy.world 83 comments fedilink hide all child comments
[–] AfricanExpansionist@lemmy.ml 49 points 1 year ago (9 children) Do people really have to scan an ID to us Discord? permalink fedilink source hideshow 9 child comments replies: [–] Manjushri@piefed.social 60 points 1 year ago (2 children) No. According to an article the IDs were from people who were challenging an age determination. Still bullshit, but you don't need ID to use Discord as a general rule. The unauthorized party also accessed a “small number” of images of government IDs from “users who had appealed an age determination.” Small is, of course, a relative term. I would consider a small number to be 2 or 3. They may feel that 10,000 users is a small number. Who can say? permalink fedilink source parent hideshow 2 child comments replies: [–] 14th_cylon@lemmy.zip 39 points 1 year ago (1 child) as a very minimum, it would make sense to demand safe-deleting the photo immediately after the verification process, with fucking prison time to someone if it is found they did not comply with that. but that is clearly not the direction the society is going 🤷♂️ permalink fedilink source parent hideshow 1 child comment replies: [–] CosmoNova@lemmy.world 6 points 1 year ago You are absolutely right. This is a huge violation of user privacy on Discord‘s side which of course is as outrageous as it was to be expected from Discord. Like, Discord is the first company I would suspect to not care about any of this. They probably think lower of consumers than video game companies do. permalink fedilink source parent [–] beejjorgensen@lemmy.sdf.org 41 points 1 year ago Apparently if they get flagged as underage when they aren't. Yet another example of how requiring ID is a shit idea. permalink fedilink source parent [–] pathief@lemmy.world 18 points 1 year ago* When I use the linux or web client it asks for a selfie with my ID card when I try to enter a server. Works fine on Android. Contacted support, they say my account is not flagged as underage but I have to submit the photo anyway. I told them i won't. permalink fedilink source parent [–] ErmahgherdDavid@lemmy.dbzer0.com 9 points 1 year ago In the United Kingdom yes because of our authoritarian Online Safety Act that came into power earlier this year. If I join a discord channel marked as nsfw I get a prompt for id which I bypass with a VPN in another country. permalink fedilink source parent [–] JohnEdwa@sopuli.xyz 2 points 1 year ago* Normally, no. And this data breach wasn't technically to Discord either, it was to a third party company that does some part of customer support for them and the data and IDs leaked were from people who had contacted support because they were flagged underaged, and sent their ID to verify they weren't. Which also kinda explains why they weren't deleted as they should be, they were just attatchements to support tickets, and not a "proper" verification system. permalink fedilink source parent [+] ITeeTechMonkey@lemmy.world -13 points 1 year ago (1 child) It's used by some Discord communities to prevent spam/bots. This would be inconjunction with other measures like how some communities require a verified email or to have a phone number associated with your account. permalink fedilink source parent hideshow 1 child comment replies: [–] Warl0k3@lemmy.world 12 points 1 year ago While those exist, those wouldn't have been affected by this breach (or if they were it was only incidentally) - those communities are not using Discord's age verification but are doing it through DMs (or a 3rd party service). Discord communities do not have access to age or ID verification tools, nor do they have the ability to impose restrictions based off age or ID verification (yet, there is rumored to be an age-verification access restriction beta going out, but it apparently doesnt use ID) permalink fedilink source parent
[–] Manjushri@piefed.social 60 points 1 year ago (2 children) No. According to an article the IDs were from people who were challenging an age determination. Still bullshit, but you don't need ID to use Discord as a general rule. The unauthorized party also accessed a “small number” of images of government IDs from “users who had appealed an age determination.” Small is, of course, a relative term. I would consider a small number to be 2 or 3. They may feel that 10,000 users is a small number. Who can say? permalink fedilink source parent hideshow 2 child comments replies: [–] 14th_cylon@lemmy.zip 39 points 1 year ago (1 child) as a very minimum, it would make sense to demand safe-deleting the photo immediately after the verification process, with fucking prison time to someone if it is found they did not comply with that. but that is clearly not the direction the society is going 🤷♂️ permalink fedilink source parent hideshow 1 child comment replies: [–] CosmoNova@lemmy.world 6 points 1 year ago You are absolutely right. This is a huge violation of user privacy on Discord‘s side which of course is as outrageous as it was to be expected from Discord. Like, Discord is the first company I would suspect to not care about any of this. They probably think lower of consumers than video game companies do. permalink fedilink source parent
[–] 14th_cylon@lemmy.zip 39 points 1 year ago (1 child) as a very minimum, it would make sense to demand safe-deleting the photo immediately after the verification process, with fucking prison time to someone if it is found they did not comply with that. but that is clearly not the direction the society is going 🤷♂️ permalink fedilink source parent hideshow 1 child comment replies: [–] CosmoNova@lemmy.world 6 points 1 year ago You are absolutely right. This is a huge violation of user privacy on Discord‘s side which of course is as outrageous as it was to be expected from Discord. Like, Discord is the first company I would suspect to not care about any of this. They probably think lower of consumers than video game companies do. permalink fedilink source parent
[–] CosmoNova@lemmy.world 6 points 1 year ago You are absolutely right. This is a huge violation of user privacy on Discord‘s side which of course is as outrageous as it was to be expected from Discord. Like, Discord is the first company I would suspect to not care about any of this. They probably think lower of consumers than video game companies do. permalink fedilink source parent
[–] beejjorgensen@lemmy.sdf.org 41 points 1 year ago Apparently if they get flagged as underage when they aren't. Yet another example of how requiring ID is a shit idea. permalink fedilink source parent
[–] pathief@lemmy.world 18 points 1 year ago* When I use the linux or web client it asks for a selfie with my ID card when I try to enter a server. Works fine on Android. Contacted support, they say my account is not flagged as underage but I have to submit the photo anyway. I told them i won't. permalink fedilink source parent
[–] ErmahgherdDavid@lemmy.dbzer0.com 9 points 1 year ago In the United Kingdom yes because of our authoritarian Online Safety Act that came into power earlier this year. If I join a discord channel marked as nsfw I get a prompt for id which I bypass with a VPN in another country. permalink fedilink source parent
[–] JohnEdwa@sopuli.xyz 2 points 1 year ago* Normally, no. And this data breach wasn't technically to Discord either, it was to a third party company that does some part of customer support for them and the data and IDs leaked were from people who had contacted support because they were flagged underaged, and sent their ID to verify they weren't. Which also kinda explains why they weren't deleted as they should be, they were just attatchements to support tickets, and not a "proper" verification system. permalink fedilink source parent
[+] ITeeTechMonkey@lemmy.world -13 points 1 year ago (1 child) It's used by some Discord communities to prevent spam/bots. This would be inconjunction with other measures like how some communities require a verified email or to have a phone number associated with your account. permalink fedilink source parent hideshow 1 child comment replies: [–] Warl0k3@lemmy.world 12 points 1 year ago While those exist, those wouldn't have been affected by this breach (or if they were it was only incidentally) - those communities are not using Discord's age verification but are doing it through DMs (or a 3rd party service). Discord communities do not have access to age or ID verification tools, nor do they have the ability to impose restrictions based off age or ID verification (yet, there is rumored to be an age-verification access restriction beta going out, but it apparently doesnt use ID) permalink fedilink source parent
[–] Warl0k3@lemmy.world 12 points 1 year ago While those exist, those wouldn't have been affected by this breach (or if they were it was only incidentally) - those communities are not using Discord's age verification but are doing it through DMs (or a 3rd party service). Discord communities do not have access to age or ID verification tools, nor do they have the ability to impose restrictions based off age or ID verification (yet, there is rumored to be an age-verification access restriction beta going out, but it apparently doesnt use ID) permalink fedilink source parent