Discord/Twitch/Snapchat age verification bypass • Hacker News Board

Re: Discord/Twitch/Snapchat age verification bypass

#411

Post by FMecha » Thu, Feb 12, 2026, 2:31 PM UTC

Retr0id wrote: post #386

rationalist wrote: post #385

Earlier quoted context omitted.

Lots of websites assume you are located in the country where your IP address is, and thus apply the rules for that country. So perhaps if someone wanted to use heuristics instead of uploading an ID, they could pretend to be in the UK by using a VPN.

Legislatively, the UK is among the stricter regimes wrt online age verification. It's a place you want to be VPNing out of. Discord is apparently rolling this out worldwide out of their own free will, not due to legislative pressures.

>not due to legislative pressures

It's a pre-emptive move against any (potential) legislative pressures.

Re: Discord/Twitch/Snapchat age verification bypass

#412

Post by ongy » Thu, Feb 12, 2026, 2:35 PM UTC

voxic11 wrote: post #393

taminka wrote: post #391

Earlier quoted context omitted.

presumably you'd just use unique one time codes derived from the eID

I fail to see how that solves the problem? That's what I'm saying my service would provide. Unless the eID has some kind of client side rate limiting built in I can generate as many of them as I want. And assuming they are completely privacy preserving no one can tell they were all generated by the same ID.

You could do some scheme that hashes a site specific identifier with an identifier on the smart element of the id.

If that ever repeats, the same I'd was used twice. At the same time, the site ID would act as salt to prevent simple matching between services.

Re: Discord/Twitch/Snapchat age verification bypass

#413

Post by FMecha » Thu, Feb 12, 2026, 2:36 PM UTC

rockskon wrote: post #290

semiquaver wrote: post #186

Earlier quoted context omitted.

The governments making laws which mandate it feel otherwise.

No law mandates Discord impose this globally. To be clear - this is a wholly discretionary act on their part to implement this in jurisdictions that have no such legal requirement.

They are doing this pre-emptively since it will be the global law trend sooner or later.

Re: Discord/Twitch/Snapchat age verification bypass

#414

Post by ongy » Thu, Feb 12, 2026, 2:36 PM UTC

Orphis wrote: post #339

adjfasn47573 wrote: post #293

Earlier quoted context omitted.

You forgot one (the sane one, which is coming soon anyway): Using a government issued eID system. The EU is going to rollout eID in a way that a site can just ask “is this person > age xy?”. The answer is cryptographically secure in the sense that this person really is this age, but no other information about you has to be known by the site owner. Which is the actual correct way to do it. I don’t understand why all t…

There are also alternatives that can be good enough, such as the Swedish BankId system, which is managed by a private company owned by many banks. They provide authentication and a chain of trust for the great majority of the population on about all websites (government, healthcare, banking and other commercial services) and is also used to validate online payments (3D Secure will launch the BankId app). While it's n…

How does that prevent the ID service from discovering which services you use it for?

Re: Discord/Twitch/Snapchat age verification bypass

#415

Post by manuelmoreale » Thu, Feb 12, 2026, 2:41 PM UTC

ongy wrote: post #401

manuelmoreale wrote: post #353

Earlier quoted context omitted.

We have a similar system in Italy so the age verification process itself doesn't personally concerns me that much since the verification process is done by the government itself and they obviously already have my information. I'm personally more interested in the intuition people have when it comes to squaring rejecting age verification online while also accepting it in a multitude of other situations (both online an…

My main issue is trust. In real world scenarios, I can observe them while they handle my ID. And systematic abuse(e.g. some video that gets stored and shows it clearly) would be a violation taken serious With online providers it's barely news worthy if they abuse the data they get. I'm not against age verification (at least not strongly), but I'd want it in a 2 party 0 trust way. I.e. one party signs a jwt like thing…

> So one knows the identity, one knows the usage But they are never related

I could be wrong but I think this is how the system we have in place in Italy works. And I agree that it's how it should work.

Re: Discord/Twitch/Snapchat age verification bypass

#416

Post by manuelmoreale » Thu, Feb 12, 2026, 2:44 PM UTC

ongy wrote: post #409

manuelmoreale wrote: post #306

Earlier quoted context omitted.

I know they're not compatible. I'm asking if you're also ok with those. There are also plenty of situations where you are asked to provide an ID, digitally, when above a certain age. For example booking hotels and other accommodations. Personally I'm still trying to figure out where my position is when it comes to this whole debate because both camps have obvious pros and cons.

Which hotel asks for id online..? I've only ever had to provide it once on-site and checking in. And when then, only when I'm in foreign countries.

Happens quite often with Airbnb for example. You often don't meet the host in person so there's no way to show them a physical ID.

Re: Discord/Twitch/Snapchat age verification bypass

#417

Post by jabroni_salad » Thu, Feb 12, 2026, 2:52 PM UTC

unethical_ban wrote: post #268

jen729w wrote: post #258

Earlier quoted context omitted.

> everyone would be better served by open platforms Oh cool, which ones?! …aaaand there's the problem.

This suggests that the immediate availability of a drop-in replacement today means there is no utility in encouraging that growth. There are multiple open-source tools that do everything Discord does. There are few-to-none that offer everything Discord does, and certainly none that are centralized, network-effect-capture-ready. Short term: * Small group chats with known friends: Signal, whatsapp, IRC, Matrix * Commun…

If you want to host your own stoat server, you will also need to recompile the apps to use your URL and distribute them to your friends, and they will not be compatible for any other server.

Re: Discord/Twitch/Snapchat age verification bypass

#418

Post by jabroni_salad » Thu, Feb 12, 2026, 2:54 PM UTC

r2vcap wrote: post #185

Well, it’s a clever idea. Discord seems to have intentionally softened its age-verification steps so it can tell regulators, “we’re doing something to protect children,” while still leaving enough wiggle room that technically savvy users can work around it. But in practice, this only holds if regulators are either inattentive or satisfied with checkbox compliance. If a government is competent and motivated, this appr…

Unless the governments come out with a first party national digital ID that can convey age of majority, they had better make themselves happy with a checkbox because nothing else is realistically possible.

Re: Discord/Twitch/Snapchat age verification bypass

#419

Post by hparadiz » Thu, Feb 12, 2026, 3:06 PM UTC

littlecorner wrote: post #402

cowboylowrez wrote: post #347

Earlier quoted context omitted.

if you make smartphones an 18+ item like alcohol many of these problems would go away.

And have schools stop giving kids laptops or tablets. I wonder how much of the Chromebooks for school incitive was to develop a new market for Google

It's wild seeing these opinions on hackernews of all places. Do we want future generations to know nothing about computing?

I would not be here if I didn't get my start in my early teen years.

Re: Discord/Twitch/Snapchat age verification bypass

#420

Post by hparadiz » Thu, Feb 12, 2026, 3:12 PM UTC

ongy wrote: post #412

voxic11 wrote: post #393

Earlier quoted context omitted.

I fail to see how that solves the problem? That's what I'm saying my service would provide. Unless the eID has some kind of client side rate limiting built in I can generate as many of them as I want. And assuming they are completely privacy preserving no one can tell they were all generated by the same ID.

You could do some scheme that hashes a site specific identifier with an identifier on the smart element of the id. If that ever repeats, the same I'd was used twice. At the same time, the site ID would act as salt to prevent simple matching between services.

People do, in fact, have multiple profiles. For very valid reasons.