Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discord says 70k users may have had their government IDs leaked in breach

theverge.com

Post reply on HN
Print view View original

51–60 of 447 posts

Re: Discord says 70k users may have had their government IDs leaked in breach

#51

Post by BoorishBears »

zahlman wrote: post #34
LoganDark wrote: post #30

Earlier quoted context omitted.

Discord has an account flag that triggers a mandatory phone number verification. It happens if you do things like send messages too quickly over the span of about a minute, or send multiple friend requests, or join too many servers, or start too many DMs, or indeed, join any server that is set to require phone number verification.

I am in dozens of servers and have not encountered this demand for a phone number. I have been in servers that required it for moderators as part of 2FA, and I just declined to moderate there. It had no effect on my use of any other server.

Anyone on HN should know the fickle nature of fraud detection, especially when the cost of getting it wrong is 0.

Re: Discord says 70k users may have had their government IDs leaked in breach

#52

Post by jjulius »

zahlman wrote: post #34
LoganDark wrote: post #30

Earlier quoted context omitted.

Discord has an account flag that triggers a mandatory phone number verification. It happens if you do things like send messages too quickly over the span of about a minute, or send multiple friend requests, or join too many servers, or start too many DMs, or indeed, join any server that is set to require phone number verification.

I am in dozens of servers and have not encountered this demand for a phone number. I have been in servers that required it for moderators as part of 2FA, and I just declined to moderate there. It had no effect on my use of any other server.

It has happened to me on two accounts. OP is also not the only other person I've seen who has dealt with it.

Bully for you that you haven't encountered it, but it's certainly a thing.

Re: Discord says 70k users may have had their government IDs leaked in breach

#54

Post by JoshTriplett »

EarlKing wrote: post #26
mikert89 wrote: post #14

When can people start going to jail for this kind of thing

Yes, good question: When can we start jailing CEOs and their employees for these blatant violations of the CPRA and GDPR?

And the politicians who mandate ID-checking requirements, without which the "government IDs" part of this wouldn't have happened.

(To be explicit, not supporting jailing here, just removing from office.)

Re: Discord says 70k users may have had their government IDs leaked in breach

#55

Post by ternera »

giancarlostoro wrote: post #17
fishmicrowaver wrote: post #11

You've got to be a complete moron uploading your gov ID to discord

It is specifically because you got banned for "being under 13" it comes from someone asking a question like "How many candles in this photo?" then you reply "7" then they edit the message to say "How old are you" and voila, underage ban. What you are overlooking is that Discord is the new MSN Messenger, YIM, etc your friends are not backed up in a meaningful way, nor the servers you're in, if you lose your account, y…

This hits the nail on the head. The big issue here is that the submitted photos were not deleted and that is quite concerning to me.

Re: Discord says 70k users may have had their government IDs leaked in breach

#56

Post by heavyset_go »

nemomarx wrote: post #49
zahlman wrote: post #33

Earlier quoted context omitted.

> Discord may have leaked sensitive personal information about 70,000 users -- including (but not necessarily limited to) government IDs, names, usernames, email addresses, last 4 digits of SSN, and IP addresses. Credit card numbers are not SSNs, and I can't fathom why Discord would have the latter (I certainly never gave them any government ID either). Not to mention, "last 4 digits" of a credit card number will com…

Age verification is "scan your government ID or give us a detailed video of your face from various angles, open and close your mouth" etc. Not sure which is better to give out in a breach

It's enough data that, combined with photos and videos from social media, could allow for more convincing deepfakes of your average person.

It's also enough data to improve surveillance and facial recognition systems, allowing them to identify you more easily.

Re: Discord says 70k users may have had their government IDs leaked in breach

#57

Post by fourside »

codedokode wrote: post #45
tifik wrote: post #9

I don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'. Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system. T…

Also this is an issue with people willing to send important documents to some company with which they do not even have a written agreement.

A big problem is that the Silicon Valley playbook drives companies like Discord to be winner take all. It’s hard to avoid using them, but then they require that give up sensitive documents. I shouldn’t have to choose between keeping sensitive documents private and being able to participate in most gaming communities. Some open source projects have also starting adopting Discord to manage their communities.

Re: Discord says 70k users may have had their government IDs leaked in breach

#58

Post by heavyset_go »

zahlman wrote: post #33
neilv wrote: post #6

This is not OK, and the reporting is not OK. Opening with: > Discord has identified approximately 70,000 users that may have had their government ID photos exposed as part of a customer service data breach announced last week, spokesperson Nu Wexler tells The Verge. Then a big PR quote, letting a potential wrongdoer further spin it. Then closing with: > In its announcement last week, Discord said that information lik…

> Discord may have leaked sensitive personal information about 70,000 users -- including (but not necessarily limited to) government IDs, names, usernames, email addresses, last 4 digits of SSN, and IP addresses. Credit card numbers are not SSNs, and I can't fathom why Discord would have the latter (I certainly never gave them any government ID either). Not to mention, "last 4 digits" of a credit card number will com…

The fact that the data is digitized, indexed and can be easily correlated with other data points is what turns your seemingly innocuous 4 numbers into a way to better impersonate, phish, or otherwise harm you.

Re: Discord says 70k users may have had their government IDs leaked in breach

#59

Post by bsimpson »

tifik wrote: post #9

I don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'. Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system. T…

For years, I resisted TSA Pre check on principle, even though I was a frequent traveler. I finally relented when I realized there were places like Thailand that force you to give your biometrics, and almost certainly sell them back to shadowy US agencies.

Re: Discord says 70k users may have had their government IDs leaked in breach

#60

Post by axus »

fishmicrowaver wrote: post #11

You've got to be a complete moron uploading your gov ID to discord

A bunch of UK users are blocked from the more "free speech" (over 13) channels unless they prove their identity to Discord, to comply with the Online Safety Act.
Post reply on HN