The Discord Breach Might Be Worse Than We Thought, As The Hacker Is Said To Have Two Million Age Verification Photos

I don‘t think I‘ve ever seen someone defend it online but there were a few people laughing it off which is not much better.

To be fair, they were before this incident too.

These were photos submitted via the compromised support provider (Zendesk) via the Discord support portal.

Automated age verification via their partner (k-ID, which has its own issues) is a separate system, which was only available to some users. Other users had to contact Discord support manually and submit photo ID, which went through Zendesk, which was then compromised in this breach.

https://support.discord.com/hc/en-us/articles/360041820932-Help-I-m-old-enough-to-use-Discord-in-my-country-but-I-got-locked-out

Additionally, for the automated process, it's the video selfie that's on-device and never transmitted, but photos of your ID and selfie photo are transmitted, just supposedly deleted afterwards. Those ones are *not included in this breach, as far as we're aware, as it's an entirely different third-party with wholly separate infrastructure.

What legal fallout? Discord made users agree to new terms just a week ago that involves forced arbitration.

Here's the information directly from the FAQ as of right now:

Q: Is my data stored when I use Face Scan or Scan ID verification?

A: Discord and k-ID do not permanently store personal identity documents or your video selfies. The image of your identity document and the ID face match selfie are deleted directly after your age group is confirmed, and the video selfie used for facial age estimation never leaves your device.

Where is that small print? It should be archived before Discord tries to change it.

Idk it doesn't seem like there are any legal consequences for tech companies anymore.

you agree to legal mediation other than a court in their terms of service, so... not really

"Apparently" only those who were challenging the verification results and uploaded awaiting reverification are affected.

Not that that isn't bad enough

That's because you have ethics

Me when I get a request for PII pertaining to a suspected corruption case: Have one of our corporate lawyers give me a written and explicit statement of what data I'm supposed to send to whom or get bent. I'm not touching that with a ten foot pole and gloves unless I have a legally solid affirmation that what I'm doing won't come back to bite me, and that our workers' council knows about it and will back me up.

I'm reluctant to even confirm that I can get that information in the first place. I mean, I'm the one with full access to the audit tool, so I probably do, but I'd have to access that data in the first place to check. I don't think that anyone would notice or care so long as I don't share that information, but as you said: dangerously radioactive; don't touch if I can help it.

Right. It blows me away the required training we have to do for physical files more secured than Fort Knox! Tech world? Eh just throw it in the recycle bin

I agree completely its moronic, but I do imagine the law requires it

Wait til you see the next one.

:(

The Labour under Starmer is closet Tory. I wish that the popular Manchester Labour mayor (whose name I forgot) takes his place as PM, which actual leftist politicians try to make him to be. Although this will be a Sysiphean task under the ruthless politicking in British politics and Labour Party's own strict rule on who could become PM.

I think it's a UK thing

They have been passing legislation to basically dox their citizens for them to gain access to the internet

I believe people from EU UK and people who say they were under 13 and got reported. They needed to send in a pic of them holding their ID to get unbanned.

edit: UK people not EU

Any time your account gets locked for age reason it requires it. So if you have never had an age lock it's unlikely you had to do it.

It's as easy as someone reporting you for being underage with no proof or even just saying "I'm 14 and what is this" as a meme to get locked tho.

Hell the auto flag system can hit you if you just talk like a kid sometimes.

You often get age verification if your account got blocked because someone reported you to be underage

And why any service asking it should be moved on from.

Pretty sure these people could have found a teamspeak, matrix, or mumble server without the requirement.

In this case, it's the opposite for people in the UK. It's illegal to not verify age.

Why shouldn't I make the Torment Nexus!?

I agree, but fuck this dumb law first and foremost.

discord isn't at fault here. I don't say they do good stuff either, i just want to stick to the facts. It's the UK government who forced them in the first place

A hacker stealing your id can do way more malicious stuff like more expertly crafted phishing and identity fraud just to name two.

No one involved in this from the government to the companies is innocent in this chain though in my opinion. A breach is always bound to happen.

Option 3: companies that you pay to provide authentication service. Regulated so that they clearly tell you if they are subsidizing service outside of your payments.

We nearly already do this with certificate services and they would probably be in a good position to offer an id service.

They're all screenshots from Detroit: Become Human

The department of Social security could have created some sort of public/private key pair to very age and DOB. But that's too much to ask for isn't it?

so instead of creating some kind of authorization system that would not require sending your private information to everyone the govt did nothing and instead put that responsibility on EVERY company. begs the question why rushing so much?

I would suppose that this is because there is not a single way valid for every govt. For example, in Italy we have SPID, which is different from what Germany, France and every EU state have.
If Discord wanted to use it, they had to implement a numbers of way to do it, which can be not that easy.

...what?

The issue here is that age verification is mandatory in the UK, and not just for Discord.

Keep on keeping on 👍

hey don't share my discord id photo please

These were images of people's ID's, along with photos of their faces to check for a match, not stock photos or even just real selfies on their own.

Half of those are Norman Reedus in Death Stranding 2.

I’d like to use your cat verification system too.

UK ones too.

Besides some countries, people that had their account flagged as possible underage also need to verify themselves.

I know a French guy that joked about being 12 in a chat, got reported by a troll that got his account locked, and had to send his ID to unlock it.

Throw away email! Are you going something illegal online that you would want to bypass the government and big techs absolute right to spy on everything you do! That's it people will henceforth only get one single email address assigned at birth that they will be forced to use for all online interactions henceforth. I hope you feel ashamed of yourself with all the children you put at risk with your thoughtless selfish behaviour. Now upload an image of your face certified by a government official and a copy of your birth certificate just to be sure that terrorists, uh criminals, uh child abusers don't win.

*Please tell me this is the most superfluous /s of all time. *

Should have just gone back to TeamSpeak 3