Worked, hopefully Discord will retroactively discover this and ban my account.
Discord/Twitch/Snapchat age verification bypass
131–140 of 494 posts
Re: Discord/Twitch/Snapchat age verification bypass
#132I'm against workarounds. I'm pro "leaving them and only come back when Digital ID is not required anymore".
If only most people leave them and it affects their bottom line.
Re: Discord/Twitch/Snapchat age verification bypass
#133Hm, when attempting it I get redirected to https://age-verifier.kibty.town/webview?url=null , which says: {"error":"error parsing webview url"} Edit: Apparently my discord account is in some kind of A/B feature test that uses a different verification provider, Persona
Hopefully your comment gets pushed to the top. Would like the security guys from the blog to see it.
It only works because the other provider has a more private implementation compounded with bad security.
Re: Discord/Twitch/Snapchat age verification bypass
#134I suspected something along these lines was possible when I looked at this provider a couple months ago.
If I recall, I had a fairly decent view of their various checks because it was delivered completely unminified, including a couple amusing sections and unimplemented features. (A gesture detector with the middle finger gesture in the enumerable commented out, for example...)
Another attack vector that I speculated upon was intercepting and replacing their tflite model with ones own, returning whatever results required.
Additionally, I believe they had a check for virtual camera names in place, as checks would quietly fail with a generic message in the interface, but show the reason as being virtual camera within responses. (Camera names are mutable though, so...)
Re: Discord/Twitch/Snapchat age verification bypass
#135I don't understand why (mostly) young people put so much effort into remaining customers of a service that is actively hostile against them and that they do not like. Does the convenience of remaining on a service you don't like the management of outweigh the mild effort to find an alternative solution?
You’re ignoring the obvious reason, aside from the network effect: there are no alternative solutions. Some people are building Discord alternatives but they are far from production-ready, often lacking critical features (e.g. Matrix not being able to delete rooms, or still having trouble with decrypting messages). It is simply the case at this point in time that Discord is factually the least bad option for many many use cases.
Re: Discord/Twitch/Snapchat age verification bypass
#136Earlier quoted context omitted.
Doesn't work for places like Australia, where the social media ban applies only to under-16s. Teenagers rarely have ID, especially in countries where the minimum driving age is higher than 16 (read: most of the world outside the US).
The concept of identity doesn't necessarily have to be embodied by a piece of physical plastic that goes into a wallet. Ad-hoc identification can occur via other means like dynamic knowledge based authentication. The sources of this mechanism can be literally anything. Social media itself being one obvious source for the target cohort. You can walk into many US financial institutions without an ID and still get reall…
Knowledge-based authentication is a joke - it doesn't work at all.
This basically only gets used for businesses that need a fig leaf for regulatory purposes. You know, $30 loans for uber eats and tiny loans like that.
Re: Discord/Twitch/Snapchat age verification bypass
#137Hm, when attempting it I get redirected to https://age-verifier.kibty.town/webview?url=null , which says: {"error":"error parsing webview url"} Edit: Apparently my discord account is in some kind of A/B feature test that uses a different verification provider, Persona
Re: Discord/Twitch/Snapchat age verification bypass
#138Earlier quoted context omitted.
>You require a human to identity proof in real life and bind that to a digital identity That's going to be a no from me, dawg. I'm sympathetic to ID checks like if you're buying beer or whatever, but not linking my real life identity to discord or whatever.
You have to show ID to buy beer?
Store doesn't get to photograph your ID, share it with 548 of their advertising partners, and leak it to 7 different hacker groups.
Re: Discord/Twitch/Snapchat age verification bypass
#139Earlier quoted context omitted.
There is a way to do this, where nearly everyone is fine.[0] However, the orgs don’t get to capture verified adult user identity to pad the value of their user data profiles… [0] https://blog.google/company-news/inside-google/around-the-gl...
It seems unlikely that "is user adult" is not already easily modeled by any of these companies to within a very high degree of confidence. Even 15 or 20 years ago Google search could bracket your age pretty effectively. It doesn't seem like this adds metadata that wasn't already there.
Except that in the legal sense, "is user adult" flips from false to true overnight, and there isn't an easy way to account for that in any model that doesn't include verified ID. Same reason many liquor stores ID anyone who looks younger than 40.
Re: Discord/Twitch/Snapchat age verification bypass
#140Is this not easily patched by the provider encrypting and signing the whole payload? I would have thought that would be table stakes for an identity provider.
The identity provider is on-device and has to run on phones which don't do hardware attestation.