Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discord says 70k users may have had their government IDs leaked in breach

theverge.com

Post reply on HN
Print view View original

411–420 of 447 posts

Re: Discord says 70k users may have had their government IDs leaked in breach

#411

Post by monerozcash »

wizzwizz4 wrote: post #372
monerozcash wrote: post #240

Earlier quoted context omitted.

This seems like a distinction without a difference. If you used a paid service offering Mumble servers that used some custom software that allowed them to offer multiple ... "servers" on different ports/IP addresses from a single daemon, would you really care? Focusing on the fact that it's not really a "server" because they aren't running as separate processes seems like utterly silly pedantry, and we probably don't…

The distinction matters. The cost (to my users) of switching from one Mumble server to another is the same, regardless of who hosts the server. The cost of switching from one "Discord server" to another is much lower than the cost of switching between Discord and any Discord clone, keeping people on Discord.

That's not some inherent feature of it being a server or not, that's a feature of Discord offering much more features than Mumble.

Re: Discord says 70k users may have had their government IDs leaked in breach

#412

Post by giancarlostoro »

SunlitCat wrote: post #405
dabockster wrote: post #403

Earlier quoted context omitted.

The issue then becomes "well why don't they just go back to a Teamspeak server? they can self host it!" But we're forgetting there that the average person online is not a dev. The most they usually know is how to point and click on something. Which also means they usually don't know how to spin up a Linux machine/VM somewhere and install their own chat server. Discord is popular because it lets almost anyone on Earth…

Which is kinda sad. Way back in the mid-2000s, I was playing World of Warcraft with a few people I had met in the game itself. Later on, we chipped in to rent a TeamSpeak server from a company that offered ready-made servers and we had a lot of fun. You didn’t even have to do much admin work. :(

You still don't have to do much these services still exist, even for Mumble. Their limitation is scaling. So if you want way more than just a handful of people, you either start charging everyone an entrance fee, or you cap the server.

Re: Discord says 70k users may have had their government IDs leaked in breach

#413

Post by giancarlostoro »

csmantle wrote: post #29
giancarlostoro wrote: post #16

Earlier quoted context omitted.

The issue is if you don't enforce the phone number requirement on your server you get all the trolls who don't use phone numbered accounts. I wish Discord would allow you to restrict known VPNs instead of requiring phone numbers. It would solve so many issues. I know a LOT of VPNs wont be caught, but if you block MOST non-residential IP blocks, you'll capture a lot of them.

Trolls likely have access to phone number farms though. And in some parts of the world it's extra cheap to mass-register phone numbers. Trolls wouldn't be harmed in a data leak, only normal users get hurt.

Once a phone is banned though, it's unusable again at least in a given server. Discord will treat it like an IP ban (which they also do).

Re: Discord says 70k users may have had their government IDs leaked in breach

#414

Post by atbvu »

kevincox wrote: post #324
atbvu wrote: post #295

Every time I see a data breach caused by a third party vendor, I can't help but wonder why are these big companies so deeply reliant on outsourcing, yet so lax when it comes to controlling security?

Because the consequences of events like this are minimal so why would they waste time and effort worrying about it?

I don't think incidents like this are minor. I believe personal information security is very important. Maybe they see the consequences as small, but I don't.

Re: Discord says 70k users may have had their government IDs leaked in breach

#415

Post by kevincox »

atbvu wrote: post #414
kevincox wrote: post #324

Earlier quoted context omitted.

Because the consequences of events like this are minimal so why would they waste time and effort worrying about it?

I don't think incidents like this are minor. I believe personal information security is very important. Maybe they see the consequences as small, but I don't.

I don't meant the consequences to the people who had the data leaked. I mean the consequences to the companies that didn't take security seriously and leaked the data.

Re: Discord says 70k users may have had their government IDs leaked in breach

#416

Post by codedokode »

schaefer wrote: post #79
o11c wrote: post #75

Earlier quoted context omitted.

Lying is usually legal. And even if lying is illegal in a particular context, it's de-facto legal since nobody ever gets punished for it.

fraud is not legal. There's a difference between lying on the playground and fraud in a business setting.

Fraud is illegally getting money, and IDs are not money.

Re: Discord says 70k users may have had their government IDs leaked in breach

#417

Post by [deleted] »

some_random wrote: post #348
SequoiaHope wrote: post #166

Earlier quoted context omitted.

It is a common misconception that facts are reported because they are surprising. Facts are reported because they are important. More and more governments are passing age verification laws which put exactly this data in to the hands of even more shady private companies. This breach serves as evidence that those laws are misguided, and spreading news of this event may help build public support for those efforts.

Reminds me of the Panama Papers, which exposed a huge international money laundering/tax evasion ring that no one seemed to care about because "everyone knows they're doing this stuff"

[deleted]

Re: Discord says 70k users may have had their government IDs leaked in breach

#418

Post by lesuorac »

some_random wrote: post #348
SequoiaHope wrote: post #166

Earlier quoted context omitted.

It is a common misconception that facts are reported because they are surprising. Facts are reported because they are important. More and more governments are passing age verification laws which put exactly this data in to the hands of even more shady private companies. This breach serves as evidence that those laws are misguided, and spreading news of this event may help build public support for those efforts.

Reminds me of the Panama Papers, which exposed a huge international money laundering/tax evasion ring that no one seemed to care about because "everyone knows they're doing this stuff"

Some countries cared more than others.

https://en.wikipedia.org/wiki/Reactions_to_the_Panama_Papers

Re: Discord says 70k users may have had their government IDs leaked in breach

#419

Post by selcuka »

AlienRobot wrote: post #281
itake wrote: post #154

Earlier quoted context omitted.

Can you elaborate more? Discord has 656m users. if 10% upload their ID, they'd have 65m ID photos to search through. There are 2 use-cases here: 1/ Safety Bans (lets pretend 0.01% of ID card users have been banned for safety reasons: 650k accounts) If a user submits their selfie/ID card, Discord needs to compare the new image with one of the 650k banned (but deleted?) images. I can't possible think how a human could…

Do you understand how image hashing works? You don't need machine learning just to check if two images are potentially identical.

Face hashing is different than generic image hashing. Methods like dividing the photo into smaller rectangles and storing the average colour for each rectangle won't work.

It should be able to detect and hash facial features so that it can compare it to a future (potentially taken from a different angle) photo of the same person. You need some type of machine learning algorithm.

Re: Discord says 70k users may have had their government IDs leaked in breach

#420

Post by selcuka »

itake wrote: post #313
selcuka wrote: post #188

Earlier quoted context omitted.

0.01% of 65M is 6,500. Also apparently only 70K people uploaded their IDs. That being said, you can still hash faces and metadata (such as ID numbers) instead of storing the whole ID as a scanned photo, if the information is only used for duplicate checking. Hashing does not increase the racial bias. If your model has a bias it will always have a margin of error.

neat, but how do users appeal a false positive? Do companies just trust the users or should the company retain the original information so they can manually verify?

Fair point, but how does the appeal process work today? Even if the company stores someone else's ID in JPEG format, and the customer service claims that the photo on that ID looks very similar to my photo, is it sufficient proof? Should the company trust me, or should I trust the company? I don't think storing hashes makes it more complex.
Post reply on HN