Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discord says 70k users may have had their government IDs leaked in breach

theverge.com

Post reply on HN
Print view View original

291–300 of 447 posts

Re: Discord says 70k users may have had their government IDs leaked in breach

#291

Post by ajsnigrutin »

consp wrote: post #207
SequoiaHope wrote: post #166

Earlier quoted context omitted.

It is a common misconception that facts are reported because they are surprising. Facts are reported because they are important. More and more governments are passing age verification laws which put exactly this data in to the hands of even more shady private companies. This breach serves as evidence that those laws are misguided, and spreading news of this event may help build public support for those efforts.

In the example you give there is no needed provision to store the id or all information in the document. Only extracting the date of birth, name and document number is sufficient. Yes I know this a utopia and it won't happen. Edit: afaik storing the photo is only needed in medical cases to alternatively asses having the correct person. Bit much for something simple as age verification.

But why? I mean... this data might be valueable at some time, if nothing else, when the company is sold to some other data-gathering company... and the punishment for such a breach will be less than the data is worth.

I mean.. if the governments did their jobs and multipled the punishment for a single breach by 70.000 (in this case) and cause the company to go bankrupt.... well, only then would the companies reconsider. But until then, they won't.

Re: Discord says 70k users may have had their government IDs leaked in breach

#292

Post by johndhi »

tifik wrote: post #9

I don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'. Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system. T…

You really think governments could write rules that would help this?

The only rule I can imagine is big penalties for data being breached, no matter the cause, but do we actually think it's a multi million dollar problem for 70k photos to be released? Hard problem.

Re: Discord says 70k users may have had their government IDs leaked in breach

#293

Post by monooso »

SequoiaHope wrote: post #166
tifik wrote: post #9

I don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'. Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system. T…

It is a common misconception that facts are reported because they are surprising. Facts are reported because they are important. More and more governments are passing age verification laws which put exactly this data in to the hands of even more shady private companies. This breach serves as evidence that those laws are misguided, and spreading news of this event may help build public support for those efforts.

I don't think there was any suggestion that the story should not have been reported, or that only "surprising" facts should be considered news.

Re: Discord says 70k users may have had their government IDs leaked in breach

#294

Post by monooso »

boriskourt wrote: post #199
SequoiaHope wrote: post #166

Earlier quoted context omitted.

It is a common misconception that facts are reported because they are surprising. Facts are reported because they are important. More and more governments are passing age verification laws which put exactly this data in to the hands of even more shady private companies. This breach serves as evidence that those laws are misguided, and spreading news of this event may help build public support for those efforts.

This is the essential point, and why it’s always a bit frustrating seeing ‘is anyone surprised’ take come up so often here. It lowers the quality of the possible discussion by trivialising it.

It's a valid question, which speaks to the frequency with which these things happen. That's isn't trivialising the problem.

Re: Discord says 70k users may have had their government IDs leaked in breach

#296

Post by iinnPP »

SequoiaHope wrote: post #166
tifik wrote: post #9

I don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'. Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system. T…

It is a common misconception that facts are reported because they are surprising. Facts are reported because they are important. More and more governments are passing age verification laws which put exactly this data in to the hands of even more shady private companies. This breach serves as evidence that those laws are misguided, and spreading news of this event may help build public support for those efforts.

Things that cease to be surprising can also cease being important. Which is made clear reading the remainder of the post.

It's my take as well, frankly.

Re: Discord says 70k users may have had their government IDs leaked in breach

#297

Post by pbohun »

The Principle of Least Privilege is one of the foundational aspects of security. Governments should be enforcing that not requiring companies to collect very sensitive information like they are currently doing. Things like "prove your age", digital ID, and Chat Control are actively malicious when it comes to safety, security, and privacy.

Re: Discord says 70k users may have had their government IDs leaked in breach

#298

Post by jjulius »

Aachen wrote: post #142
zahlman wrote: post #65

Earlier quoted context omitted.

[dead]

If it doesn't rain one day, that's not evidence there exists no rain That's about the level of evidence that your specific user account offers to you about whether phone verification is a thing their anti-spam algorithms can trigger...

The funny thing about evidence is that Discord even has a page stating exactly what LoganDark said...

https://support.discord.com/hc/en-us/articles/6181726888215-...

Re: Discord says 70k users may have had their government IDs leaked in breach

#299

Post by LoganDark »

zahlman wrote: post #65
malfist wrote: post #37

Earlier quoted context omitted.

Just because something hasn't happened to you, doesn't mean it doesn't happen to other people

[dead]

A simple Google search turns up results from years ago that are still valid today: https://old.reddit.com/r/discordapp/comments/ircyh1/locked_o...

> You'll be required to register a phone number to your Discord account in order to continue the use of it.

Re: Discord says 70k users may have had their government IDs leaked in breach

#300

Post by bell-cot »

nomilk wrote: post #272
SequoiaHope wrote: post #166

Earlier quoted context omitted.

It is a common misconception that facts are reported because they are surprising. Facts are reported because they are important. More and more governments are passing age verification laws which put exactly this data in to the hands of even more shady private companies. This breach serves as evidence that those laws are misguided, and spreading news of this event may help build public support for those efforts.

Wonder if this will cause a surge in demand for fake IDs that are sufficient for age-verification but harmless if leaked.

Might that be a business model for an enterprising Secretary of State? They carefully verify your real ID, the fake ID's trivially tie back to that if the cops ask (not so useful for committing crimes), there are upcharges for multiple fake ID's, or tweaked ages / weights / photos. More upcharges for "vanity" names...

"Really, your honor, it's hardly different from an author getting a DBA or LLC for his pen name."

Post reply on HN