Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discord says 70k users may have had their government IDs leaked in breach

theverge.com

Post reply on HN
Print view View original

101–110 of 447 posts

Re: Discord says 70k users may have had their government IDs leaked in breach

#101

Post by ikkun »

Gigachad wrote: post #21
elevation wrote: post #15

I didn't feel comfortable giving discord my phone number when they demanded it, so I lost access to the open source communities that insist on collaborating there. I wish breaches like this would cause people to reconsider their choices but sadly, it's unlikely most users will move.

Discord doesn’t require a phone number. It’s individual community owners who opt to require it. You can create a server that doesn’t require one but it effectively means you can’t ban people since they can just sign up again on a new account.

I tried making an account once, technically my account was created but trying to log in only gets me a screen that requires I verify a phone number. I was never even able to attempt to join a server. I assume it's my browser's privacy settings and ad blocker but I'm not sure.

Re: Discord says 70k users may have had their government IDs leaked in breach

#104

Post by L-four »

tifik wrote: post #9

I don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'. Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system. T…

Developer time is more valuable than user data. The market is being efficient.

Re: Discord says 70k users may have had their government IDs leaked in breach

#105

Post by maxlin »

.... The government ID's they only started asking for as a bullshit requirement after running for like 10 years without needing them?

At some point we'll start seeing companies that rotate your passwords automatically and integrate with your autologins, and send immediate reports of breaches / suddenly failing logins.

Wait. Why isn't this a thing

Re: Discord says 70k users may have had their government IDs leaked in breach

#106

Post by SeanAnderson »

tifik wrote: post #9

I don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'. Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system. T…

ZK proofs for identity can't go mainstream quick enough. I agree with what you're saying completely. It's frustrating that we have the technology now to verify aspects of someone's identity without revealing it, but that it's going to take forever to become robust enough for mainstream use.

Re: Discord says 70k users may have had their government IDs leaked in breach

#107

Post by petre »

yibg wrote: post #98
tifik wrote: post #9

I don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'. Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system. T…

I blame companies (including discord) for collecting as much information as they can instead of as little as possible. More data collected -> more data that will eventually get sold / leaked / hacked.

Don't governments require them to chech people's IDs to make sure they aren't kids?

Re: Discord says 70k users may have had their government IDs leaked in breach

#108

Post by Podrod »

axus wrote: post #60
fishmicrowaver wrote: post #11

You've got to be a complete moron uploading your gov ID to discord

A bunch of UK users are blocked from the more "free speech" (over 13) channels unless they prove their identity to Discord, to comply with the Online Safety Act.

It's channels marked NSFW that you need verification for and it's also incredibly easy to bypass with a VPN.

Re: Discord says 70k users may have had their government IDs leaked in breach

#109

Post by cookiengineer »

tifik wrote: post #9

I don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'. Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system. T…

Honestly I don't understand why so many things are tied to one secret _that you have to share with others_ all the time.

Why is there no rotation possible? Why is there no API to issue a new secret and mark the previous one as leaked? Why is there no way to have a temporary validation code for travels, which gets auto revoked once the citizens are back in their home country?

It's like governments don't understand what identity actually means, and always confuse it with publicity of secrets.

I mean, more modern digital passports now have a public and private key. But they put the private key on the card, which essentially is an absolute anti pattern and makes the key infrastructure just as pointless.

If you as a government agency have a system in place that does not accommodate for the use case that passports are stolen all the time, you must be utterly out of touch with reality.

Re: Discord says 70k users may have had their government IDs leaked in breach

#110

Post by throwaway473825 »

SamDc73 wrote: post #87
01HNNWZ0MV43FF wrote: post #78

Earlier quoted context omitted.

I'm not willing, I just don't have a choice. The US should regulate it from the top down like Europe does

Not sure what you mean by "like europe" because in Europe they are trying to implement `European Digital Identity (EUDI)` for age verification, which will make stuff like this even worse ....

On the contrary, third parties will only get to know the age of the users, not their identities.
Post reply on HN