Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discord says 70k users may have had their government IDs leaked in breach

theverge.com

Post reply on HN
Print view View original

201–210 of 447 posts

Re: Discord says 70k users may have had their government IDs leaked in breach

#201

Post by robinsonb5 »

fourside wrote: post #57
codedokode wrote: post #45

Earlier quoted context omitted.

Also this is an issue with people willing to send important documents to some company with which they do not even have a written agreement.

A big problem is that the Silicon Valley playbook drives companies like Discord to be winner take all. It’s hard to avoid using them, but then they require that give up sensitive documents. I shouldn’t have to choose between keeping sensitive documents private and being able to participate in most gaming communities. Some open source projects have also starting adopting Discord to manage their communities.

> Some open source projects have also starting adopting Discord to manage their communities.

And I've chosen not to engage with more than one such community because I'm not perpared even to give Discord my phone number, let alone any kind of ID document. Luckily there's nothing on Discord I care about that much, so I'm not having to make too difficult a choice. I totally get why most people won't take such a stand.

Re: Discord says 70k users may have had their government IDs leaked in breach

#202

Post by beeflet »

raxxorraxor wrote: post #196
beeflet wrote: post #181

Earlier quoted context omitted.

>Think about it - the claim is that those systems can prove aspects of someone's identity (eg age), without the site where the proof is used obtaining any knowledge about the individual and without the proof provider knowing where the proof is used. That is not nessisarially true. There are ZK setups where you can tell when a witness is reused, such as in linkable ring signatures. Another simple example is blind sign…

The easy solution is the best one. Just don't collect the info. Any problems resulting from that need to be handled differently. Proven to work and we wouldn't be dependent on untrustworthy identity providers.

I agree. It is possible, but that does not mean it should be done.

The thing is with such a ZK system you are still collecting and compiling all this data, it's just done by some sort of (government?) notary and there is a layer of anonymity between the notary and the verifier (which they can cooperate to undo).

The real political problem is the concentration of personal information in one place. The ZK system just allows that place (notary) to be separate from the verifier.

Re: Discord says 70k users may have had their government IDs leaked in breach

#204

Post by OvbiousError »

eternauta3k wrote: post #184

More governments should provide a system like the German electronic ID*, which lets you prove your age without revealing other information. * Tragically underused because impractical

In Belgium we have a service called "itsme". Had it for ages, works very well, used to be mainly for government but banks are also switching to it.

Re: Discord says 70k users may have had their government IDs leaked in breach

#206

Post by eleveriven »

codedokode wrote: post #44

Companies usually promise that the ID would be used only for validation and then immediately deleted. How so many IDs could leak then? They verify millions of IDs per month?

Either the deletion promise is a lie, or the third-party vendor was storing the data anyway

Re: Discord says 70k users may have had their government IDs leaked in breach

#207

Post by consp »

SequoiaHope wrote: post #166
tifik wrote: post #9

I don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'. Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system. T…

It is a common misconception that facts are reported because they are surprising. Facts are reported because they are important. More and more governments are passing age verification laws which put exactly this data in to the hands of even more shady private companies. This breach serves as evidence that those laws are misguided, and spreading news of this event may help build public support for those efforts.

In the example you give there is no needed provision to store the id or all information in the document. Only extracting the date of birth, name and document number is sufficient.

Yes I know this a utopia and it won't happen.

Edit: afaik storing the photo is only needed in medical cases to alternatively asses having the correct person. Bit much for something simple as age verification.

Re: Discord says 70k users may have had their government IDs leaked in breach

#208

Post by michaelt »

Terr_ wrote: post #124
mindslight wrote: post #111

Earlier quoted context omitted.

That does not work without treacherous locked-down hardware. The marketing by Google et al is leaving out that fact to privacy-wash what is ultimately a push for digital authoritarianism. Think about it - the claim is that those systems can prove aspects of someone's identity (eg age), without the site where the proof is used obtaining any knowledge about the individual and without the proof provider knowing where th…

If I had my 'druthers, there would be a kind of physical vending machine installed at local city hall or whatever, which leverages physical controls and (dis-)economies of scale. The trusted machine would test your ID (or sometimes accept cash) and dispense single-use tokens to help prove stuff. For example, to prove (A) you are a Real Human, or (B) Real and Over Age X, or (C) you Donated $Y On Some Charity To Show S…

> 2. Suspicion, if someone is using the machine dozens of times per month—who needs that many social-media signups or whatever?

Anyone who visits pornhub and doesn't want to open an account?

Re: Discord says 70k users may have had their government IDs leaked in breach

#209

Post by beeflet »

mindslight wrote: post #190
beeflet wrote: post #181

Earlier quoted context omitted.

>Think about it - the claim is that those systems can prove aspects of someone's identity (eg age), without the site where the proof is used obtaining any knowledge about the individual and without the proof provider knowing where the proof is used. That is not nessisarially true. There are ZK setups where you can tell when a witness is reused, such as in linkable ring signatures. Another simple example is blind sign…

Sure, but making use of that introduces new problems. Fundamentally it limits a person to one account/nym per site. This itself removes privacy. An individual should be able to have multiple Discord nyms, right? Then if someone gets their one-account-per-site taken/used by someone else, now administrative processes are required to undo/override that. Then furthermore it still doesn't prevent someone from selling acce…

>An individual should be able to have multiple Discord nyms, right?

Yeah, I think so. I mean this is like my 20th hacker news account. I am using my 5th discord account right now.

But at the same time it would be an interesting to see how anonymous yet sybil-proof social media would work out.

I get the feeling that it's already pretty easy to buy and sell fake IDs, so I don't think it would pan out in practice. I also had the same idea as you: if such a system were to exist, you could sell proofs for all the services you don't use.

Usually, these zero-knowlege proofs are backed by some sort of financial cost, not the bureaucratic cost of acquiring an ID. All of these "linkable" ZK proofs are aimed at money systems or voting systems.

In the blind-signature based money systems, a big problem used to be dealing with change; you had to go back and spend your unblinded signature at the signatory to get a new one. In a similar fashion, maybe you could make it so that users could produce a new ZK proof by invalidating an old one? So you could retire an old nym if you get banned, and create a new nym but you could only have one at a time? IDK if that is a reasonable tradeoff.

Re: Discord says 70k users may have had their government IDs leaked in breach

#210

Post by dangus »

doikor wrote: post #151
xyzzy123 wrote: post #112

Earlier quoted context omitted.

It's an interesting litmus test because regulators would not accept ZK age proofs unless the stated purpose of age verification laws (reduce harm to minors) is the _actual_ purpose of those laws. Not some different unstated goal, such as ending online anonymity.

That is exactly what EU is doing with its age verification law. Basically the service provider just has to accept the certificate and check that it is valid and all the cert says is "is over X years old". https://ageverification.dev/ And the fact that the companies have to implement the system themselves is just crazy. It is very obvious that if the government require such a check it has to provide the proof/way of c…

> And the fact that the companies have to implement the system themselves is just crazy.

Isn’t this how most industry regulations work? It’s not like the government provides designs to car companies to reduce emissions or improve crash safety.

Post reply on HN