>Compliance Week
Sounds like a fun and entertaining publication.
Discord fined €800k
11–20 of 45 posts
Re: Discord fined €800k
#12This is less than cost of compliance.
That doesn't quite hold for gdpr fines. It's a fine + you're going to comply, or we'll start stacking more fines. By definition this is a fine on top of the cost of compliance.
There are a lot of different ways to measure this. You could look at this as renting time for non-compliance. What they were able to work on by kicking this can down the road I don't know.
Re: Discord fined €800k
#13The comments by CNIL (EN): https://www.cnil.fr/en/discord-inc-fined-800-000-euros
A non-paywalled (but not great) article (use an ad blocker): https://www.bankinfosecurity.com/discord-fined-by-french-cni...
Re: Discord fined €800k
#14Possibly a better resource for those unable to access because of the paywall: https://www.cnil.fr/en/discord-inc-fined-800-000-euros
> At the time of the online investigation, when creating an account on DISCORD, a password of six characters including letters and numbers was accepted. > The restricted committee considered that DISCORD's password management policy was not sufficiently strong and restrictive to ensure the security of users' accounts. Ahh yes, finally, government-enforced password policies. They have lost their mind. > However, in Mi…
The password thing is silly, but the actual complaint with "X minimizes to tray" is that it doesn't disconnect ongoing voice calls, which _could_ be confusing.
Re: Discord fined €800k
#15Earlier quoted context omitted.
> “The amount of the fine was decided regarding the breaches identified, the number of people concerned, but also taking into account the efforts made by the company throughout the procedure to reach compliance and the fact that its business model is not based on the exploitation of personal data,” the regulator said.
> the fact that its business model is not based on the exploitation of personal data Is it? I suppose you can take their turning down of Microsoft as a token of good faith, but it's also possible that they just think they can cash out for more in the future. If that's the case, then accumulating a massive user dataset is very much the business model, because the business model is to eventually sell the company for as…
Isn’t Discord’s primary monetisation strategy Nitro?
Re: Discord fined €800k
#16Earlier quoted context omitted.
> At the time of the online investigation, when creating an account on DISCORD, a password of six characters including letters and numbers was accepted. > The restricted committee considered that DISCORD's password management policy was not sufficiently strong and restrictive to ensure the security of users' accounts. Ahh yes, finally, government-enforced password policies. They have lost their mind. > However, in Mi…
The password thing is silly, but the actual complaint with "X minimizes to tray" is that it doesn't disconnect ongoing voice calls, which _could_ be confusing.
Yep. Full section:
When a user logged into a voice room closes the DISCORD application window by clicking on the "X" icon at the top right of the window in Microsoft Windows, they actually just put the application in the background and stay logged into the voice room. However, in Microsoft Windows, clicking on the "X" at the top right of the last visible application window will exit the application for the vast majority of applications.
DISCORD's behavior is different and may lead to users being heard by other members in the voice room when they thought they had left. The restricted committee considered that DISCORD should specifically inform users by making them aware that their words are still being transmitted and heard by others.
However, as part of the procedure, DISCORD INC.set up a pop-up window to alert people connected to a voice room, when the window is closed for the first time, that the DISCORD application is still running and that this setting can be changed directly by the user.
Re: Discord fined €800k
#17Possibly a better resource for those unable to access because of the paywall: https://www.cnil.fr/en/discord-inc-fined-800-000-euros
> At the time of the online investigation, when creating an account on DISCORD, a password of six characters including letters and numbers was accepted. > The restricted committee considered that DISCORD's password management policy was not sufficiently strong and restrictive to ensure the security of users' accounts. Ahh yes, finally, government-enforced password policies. They have lost their mind. > However, in Mi…
Getting fined for the the system tray behavior is a little much, that's how all chat apps have behaved going all the way back to at least AIM (and Trillian, Pidgin, etc) and I'm assuming before then as well, and its good UX that's why it's been copied for so long. I'm actually annoyed that WhatsApp desktop doesn't have this feature.
Re: Discord fined €800k
#18Add three to six more zeros and these breaches will be taken seriously.
Re: Discord fined €800k
#19The complaints boil down to
>Discord not deleting inactive accounts
I personally don't want my old accounts to be deleted. Just because I don't sign on to a site that doesn't mean I want everything to be deleted.
>Closing the Discord window doesn't quit the entire application and just closes the window
This is normal behaviour of programs. In fact most macos programs work this way. Windows still shows Discord in the bottom right no people can access it if they need it even if they don't want a window for it.
>Discord's password requirements were not what they wanted
Most people's discords accounts are stolen via token stealers and not by having their passwords guessed. They had proper rate limiting so this isn't a big deal.
>They didn't create various paperwork
Legal compliance is annoying.
I hate how foreign governments can trample over US products.
Re: Discord fined €800k
#20Possibly a better resource for those unable to access because of the paywall: https://www.cnil.fr/en/discord-inc-fined-800-000-euros
> At the time of the online investigation, when creating an account on DISCORD, a password of six characters including letters and numbers was accepted. > The restricted committee considered that DISCORD's password management policy was not sufficiently strong and restrictive to ensure the security of users' accounts. Ahh yes, finally, government-enforced password policies. They have lost their mind. > However, in Mi…
This is especially daft considering the vast majority of credit and debit card PINs are four or six numerical-only digits. At least the discord password could be alphanumeric plus symbols. Why is a Discord password being held to higher standards than a bank card PIN?