Post

Oh wow, the exact thing everyone with 2 brain cells to rub together knew was gonna happen the second people found out it would be required. Seriously, security is on the defensive with a disadvantage most of the time so this was always going to happen no matter what.

I give it a week or so before Discord tells us we don't need to use ID anymore after this, and the people trying to make online ID happen immediately back pedal their stance on it. All it takes is one breach like this for it to become apparent that online ID is not the path forward.

I can only hope that this causes enough of a stir that it's a wakeup call to governments for corporations. The people already knew this was stupid. Now the people that make the decisions need to make the RIGHT decisions and do away with this joke of a requirement.

compulsory age verification is an invasion of privacy at the best of times, but if you have no choice then at the very least you should treat people's real names and faces with some basic shred of rigour

looks like it’s specifically pictures from people who appealed the verification, so presumably they were saved because they needed manual review I guess? and… hopefully they delete them after but I don’t know if it’s smart to be that generous

This isn't just gonna be a discord problem, this is gonna be a whole ass problem for every service that uses ID services just cause the UK wanted to be anal about online. This won't be the last time this happens and I have warned anyone that will listen that my fear was more related to security.

Same here. Cause I am sorry, I do not trust the security of these third-party *trusted* companies. You are only as good as; A: Your own cyber security at these companies B: Praying that none of the employees aren't moles put in by organised crime or get threatened by said organised crime.

In the UK they implemented the "Upload your ID to verify you're over 18" bs to "Protect the children" and more countries are still pushing for this crap.

Like I've always said, tech corporations do not really care about the security nor privacy of their users. Security is often an after thought to them, especially for consumer level services where they know the punishment for a breach will be a wrist slap, if that.

Woah, the thing everyone saw coming, that's so crazy. Don't worry, I just copied a sitting senator's ID when I verified mine, so maybe someone will actually want to crack down on this and maybe put the kibosh on verification laws.

This is often a missing part of the debate I find when it comes to online ID verification. It's not just that your government is spying on you, it's the fact that your government is not capable of keeping your data to themselves, and it will fall into the hands of whoever wants it.

(I had to block the person who was initially arguing with me here because they seemed to want to argue with me over nothing whatsoever, there's plenty of horrible shit going on and I'm not dealing with nitpicking contrarians)

it is FASCINATING to me how we have literally gotten to the point of completely ignoring the fundamentals we as a society have learned in the 2000-2010s... its honestly INFURIATING how everyone has literally devolved to becoming completely unable to properly use the web nowadays

If we want to do age verification then we need a government provided API for doing that so services just make a call and get logical adult or not value. Anything else is ripe for abuse and is negligent.

For the record, in the USA at least it's actually legally unenforceable to waive your right to a trial by jury. They can blow as much smoke as they want about it in their TOS/EULA but certain basic rights (such as full access to the legal system) cannot be signed away by contract.

We don't know for sure that's what happened here, but the timeline looks pretty bad regardless. Fundamentally they should be getting raked anyway for demanding people send government ID scans via email, then not securing that data, and they should be getting raked over the forced arbitration.

They're not even trying to claim it's secure. They demand the information and don't give any assurances that they'll keep it safe, or remove it, or anything. Just "send us an email of your passport"...

It's gonna be horrible for the people involved, but honestly if enough companies are just wildly negligent with the ID's and enough data is stolen, they may just retconn the whole thing. There will be a tipping point when the government can't just keep letting all it's citizens get robbed.

I think it's unlikely with this government. They got 550,000 signatures on an official government petition to repeal the OSA, and just turned around and responded with "we're committed to the OSA!", then didn't schedule a debate. I've lost any faith in this government to listen to reason on this.

It doesn’t have to be at 10 pm, but sometime soon could you please provide an update on discussion of S-209? I understand you recently heard from the privacy commissioner and there are more discussions coming up next week.

In my defense it was 4am and I'm an idiot. But hey, getting tagged into something completely unrelated to you is probably more annoying, which is what I was really going for, so who can say if I'm a bad poster or not.

I'm skeptical of their claim it is one of their 3rd party companies. I got an email about being affected, and I do not remember ever contacting customer service about anything. Going through my messages and my email i can't find any record. Maybe I did and forgot /deleted email, but feels unlikely.

I can confirm, I've been going around with discord's customer service for a month, trying to talk to a human. Their bots keep demanding I scan a passport and email it to them. (I've not done this) They just emailed me to say they've had a security breach and leaked the contents of the entire ticket

it's incredibly ironic that their email about leaking all the data in their support ticket is a no-reply email address that tells you to raise a support ticket if you need help regarding the leak.

(In case anyone is worried, I explicitly did not do this, because I did not trust that their system was secure. They do not give any assurances that the data will be removed from their servers after it's used.)