Persona, Discords "Age Verification" Service, creates a profile of you, sends it to the US Feds and deems you suspicious based on your appearance, exposed by Hackers
https://www.therage.co/persona-age-verification/
883 points · 97 comments · view on lemmy.world
97 Comments
Lost_My_Mind@lemmy.world · 243 pts · 174d
"Why wouldn't I use verification? I've got nothing to hide".
This. This is why you do not submit willingly, regardless of what you have to hide. Fascism doesn't give a shit if you're innocent.
leds@feddit.dk · 62 pts · 174d
Using Microsoft teams at work, it keeps on asking me record a voice sample and selfy so it can identify me in meeting , yeah no thanks
A_norny_mousse@piefed.zip · 16 pts · 174d
And then your coworkers think you're IT challenged because you don't even know how to do the simplest things. (true story)
Monument@lemmy.sdf.org · 19 pts · 174d
My company just mandatorily implemented “Windows Hello”
No one seems to be able to tell me why the information from Microsoft says the fingerprint and face scans are both “local only” and may take 24 hours to sync after initial setup. Where are they syncing to?
(I opted for the ‘pin’ method instead of surrendering my biometrics.)
Kiernian@lemmy.world · 7 pts · 174d
PIN is the best way to go there. It only works on that one machine, although you can technically set the same PIN again on another computer.
I believe the typical intent is as follows:
This should, in theory, allow workplaces to set requirements for really complex passwords that only need to be reset once a year or so, without breaking helpdesk, inconveniencing users, or leaving gaping security holes.
Whether or not that all happens depends on the workplace, but that's the general thought process in most of the places I've worked where a modicum of sense prevails
Monument@lemmy.sdf.org · 4 pts · 174d
…. Oh!
You just explained a question I had.
I couldn’t figure out why a pin was considered more secure.
In my reasoning: How is a PIN (potentially numeric only), changed 1x a year, safer than a password (3 of 4: Alpha, Mixed case, numeric, special chars), changed 4x a year.
The answer, as you explained, is scope of trust. Machine only vs tenant-wide. That makes sense.
smh@slrpnk.net · 4 pts · 174d
That makes sense. Something you have (that specific machine) + something you know (your pin).
I used to work someplace where we all had a pin+a smart card that we'd insert into the machine, same idea except I could log into any machine with the card+pin combination.
Loved not having to remember a long AF password. Didn't like having to drive home if I forgot my card on the kitchen counter.
JcbAzPx@lemmy.world · 2 pts · 173d
The problem is, if someone does get physical access to the machine, you've just made breaking into it much easier.
Edit: that's assuming the smart card is using rfid.
Poem_for_your_sprog@lemmy.world · 1 pts · 173d
Just keep the card in your anus
tux7350@lemmy.world · 3 pts · 174d
Windows Hello ties the PIN to the TPM of the computer. It's not just you having a pin, its the pin + the crypto secret loaded on the device. Thats why its more secure then just a complex password.
wizardbeard@lemmy.dbzer0.com · 5 pts · 174d
My assumption is that they are recorded locally, then hashed, then the hash is sent to Azure (Microsoft cloud) as Windows Hello leverages some cloud features. Some things in Azure have warnings about taking up to 24 hours to take effect.
Hashing locally and sending the hash to a server is the same way all passwords for online services and systems work, so nothing nefarious there.
There's probably perceptual hashing so they can count 95% similarity as a match without having to check against the source material every time.
Monument@lemmy.sdf.org · 9 pts · 174d
I could accept that it has to do with azure propagation delays, but the verbiage was explicit about our computers syncing to the tenant. (Vs. data propagating across it.)
I sort of reject the idea that there’s nothing nefarious going on. The misdirect is weird.
Unless they’re salting the hashed data with information they can’t access, they’re just creating a database of faces and fingerprints.
Sure, maybe if their cryptography is good the DB cannot be reversed but they can still use an unsalted database to give match/no match info on scans of faces and fingerprints submitted to it.
But also, I firmly don’t trust Microsoft. They’ve violated our ELA several times - mostly around applying analytics tools to our data without consulting us first. (Like rolling out MS Viva without telling us.)
buttmasterflex@piefed.social · 9 pts · 174d
Woof. Every time I open a Word doc at work, I now get a pop up saying I've disabled location services in my system settings. Why the fuck does Microsoft need to know my location for opening a Word doc?!
ImgurRefugee114@reddthat.com · 38 pts · 174d
"If you have nothing to hide, why are you wearing pants? Why don't you tell me your password?"
VitoRobles@lemmy.today · 21 pts · 174d
I wear pants to protect my password! No, please! Don't hit me in the password!
zurohki@aussie.zone · 33 pts · 174d
dethedrus@lemmy.dbzer0.com · 3 pts · 173d
Ooof, right in the password! That'll leave a mark.
MalReynolds@slrpnk.net · 34 pts · 174d
Depending on context my favorite answers to 'Why do you need privacy if you have nothing to hide ?" are
"I need privacy, not because my actions are questionable, but because your judgements and intentions are.",
"Arguing that you don't care about privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say." - Edward Snowden,
and "The only difference between a wizard hat and a dunce cap is the wide brim of privacy."
ETA: None of which a fascist will give a shit about, but can be useful in politer society.
Dry_Monk@lemmy.world · 24 pts · 174d
My favorite is:
"So take off your pants. Right here, right now."
Gets the point across quickly and viscerally.
Kolanaki@pawb.social · 8 pts · 174d
What do you do if they drop trou?
Inkstainthebat@pawb.social · 5 pts · 173d
Inspect, very carefully, and point out every detail of course
No1@aussie.zone · 5 pts · 173d
Take a photo, and use that for face ID.
Or call the cops.
TheBenCommandments@infosec.pub · 6 pts · 174d
This is good but I prefer demanding they unlock their phone and hand it to me.
MalReynolds@slrpnk.net · -2 pts · 174d
Jokes on you, not wearing any (and how would you know on the other side of a cable) ;)
I get your point but I think there are higher levels here than just a nudity taboo.
A_norny_mousse@piefed.zip · 12 pts · 174d
The point is to counter the dumb "I have nothing to hide" statement. It simply isn't true. If that evolves into a deeper convo, good.
Dry_Monk@lemmy.world · 4 pts · 174d
This exactly. It's meant to open up the conversation.
MalReynolds@slrpnk.net · -2 pts · 174d
Fair cop, not my style, but you do you.
zergtoshi@lemmy.world · 24 pts · 174d
Whether there's "nothing to hide" is an assessment made by the fascists and not by the people giving out information.
WanderingThoughts@europe.pub · 23 pts · 174d
And then a new president comes into office or just changes their mind and now something that used to be innocent is now a violation. Luckily the government recorded everything you ever said and did, so knows exactly who to arrest.
MonkderVierte@lemmy.zip · 22 pts · 174d
That's not for you to decide.
BarneyPiccolo@lemmy.today · 8 pts · 174d
We'll determine that after several days of brutal torture. If we determine that you're telling the truth, then you'll be free to go. No harm, no foul.
NotASharkInAManSuit@lemmy.world · 8 pts · 174d
Innocence proves nothing.
Ghostie@lemmy.zip · 7 pts · 173d
defaultusername@lemmy.dbzer0.com · 59 pts · 174d
"We have determined based on the shape of your nose that you are Jewish. Please follow us to the nearest train."
mad_djinn@lemmy.world · 9 pts · 174d
“We have determined based on the shape of your nose that you are not Jewish. Please follow us to the nearest train.”
chasteinsect@programming.dev · 49 pts · 174d
Well, now I see why there was an avoid OpenAI movement. They actually allowed Persona to create an internal database of their users and may be a potential AI provider for gov surveillance.
Since when did OpenAI started using Persona, and is it widely known that they use it ? Does anybody know? I used their service way back at gpt 3.5 days, back then you didn't need any verification.
betterdeadthanreddit@lemmy.world · 44 pts · 174d
What's next, some kind of psychological profile based on the bumps and grooves of my skull?
Whostosay@sh.itjust.works · 31 pts · 174d
Godamn will y'all stop writing their next steps out for them to create the newest dystopian hellhole update
betterdeadthanreddit@lemmy.world · 24 pts · 174d
I see that your profile indicates some reservations about synergizing with the Torment Nexus but have you considered the value it brings to the shareholders?
Whostosay@sh.itjust.works · 10 pts · 174d
Must collect .00000001% more dollars per unit, it's only billions of lives after all
betterdeadthanreddit@lemmy.world · 8 pts · 174d
Urge to maximize paperclips rising...
Chozo@fedia.io · 23 pts · 174d
To verify that you are permitted to use our platform, please answer the following prompt: You're in a desert walking along in the sand, when all of a sudden you look down and see a tortoise...
remedia@piefed.social · 8 pts · 174d
snooggums@piefed.world · 4 pts · 174d
Do I know the tortoise?
Does it owe me money?
lastlybutfirstly@lemmy.world · 9 pts · 174d
What's next is that they are going to guilt you in to accepting it because it's "to save kids from pedophiles and if you don't fork over your ID, you're either helping pedophiles or you are a pedophile yourself."
And it's going to work. You're going to go along with it.
Reddit implemented this for brits months ago and there has been no mass exodus. They all forked over their IDs to save the kids. They're probably all stuck on Discord too assuming everyone who's leaving is a pedophile. Once KOSA and EARN IT pass here in the US, we also will go along with it, to stop the pedophiles.
betterdeadthanreddit@lemmy.world · 6 pts · 174d
"Won't somebody think of the children?"
ttyybb@lemmy.world · 36 pts · 174d
What? But Discord pinky promised that pictures would stay on my system, and be deleted immediately after verification. Are you implying that they lied? Pikachu shock face
tyler@programming.dev · 9 pts · 174d
This title isn’t what the article says at all. There’s a secondary system completely separate from persona’s main system, that is seemingly tied to openai and government systems, most likely tied to ICE.
Trilogy3452@lemmy.world · 2 pts · 174d
If that's what they said literally (pictures stay local) then they probably didn't say that the face data leaves the devices
ttyybb@lemmy.world · 2 pts · 174d
I'd have to double check, but I also don't think they said the picture would only be used for age verification.
Trilogy3452@lemmy.world · 3 pts · 173d
https://www.pcgamer.com/hardware/discord-clarifies-it-is-not-requiring-everyone-to-complete-a-face-scan-or-upload-an-id-and-will-confirm-your-age-group-using-information-we-already-have/
Perhaps partners will receive account info but Discord won't receive identity? If Discord collects and shares a lot of data then maybe they can correlate account metadata with identity
wonderingwanderer@sopuli.xyz · 33 pts · 174d
"This person looks like they might commit a crime in the future. You guys should go arrest him before that happens so we can 'zero out crime' in our neighborhoods."
The neighborhoods where crime has been 'zeroed-out':
WeebLife@lemmy.world · 11 pts · 174d
Also plot of Psycho pass.. Spoiler it didn't eliminate crime..
Nikelui@lemmy.world · 2 pts · 173d
Someone is disagreeing with the Sybil System? Let's have your criminality coefficient checked.
mrpollo@lemmy.zip · 3 pts · 174d
Literally that one episode of Futurama
Zanathos@lemmy.world · 8 pts · 174d
Literally the movie Minority Report
motruck@lemmy.zip · 3 pts · 173d
Precogs are machines in our version.
wonderingwanderer@sopuli.xyz · 1 pts · 174d
Which one?
wetling@lemmy.world · 32 pts · 174d
Robinhood also uses Persona and may not allow you to transfer money out without providing ID and face scans.
JcbAzPx@lemmy.world · 4 pts · 173d
Not sure why anyone would still be using Robinhood after that GME debacle, but if they are, this is a good reason to stop.
ModernRisk@lemmy.dbzer0.com · 29 pts · 174d
It seriously gets worse the more you read and hear about their “verification system”.
guynamedzero@piefed.zeromedia.vip · 29 pts · 174d
Jfc, I mean I was guessing that something like this was going on behind the scenes. But I guess it’s reassuring to see it out in the open.
Sunflier@lemmy.world · 24 pts · 173d
It really occurs to me that this emphasis on surveillance (Palantir, this Discord stuff, the cameras everywhere, etc.) really shows how afraid the billionaire class is. They're trying to identify those that are getting uppity to try and prevent organizing, which they hope would quash revolution. They know people are angry; they know they've been looting and pillaging; they know they've been denying access to basic things like food, housing, healthcare; and they know they work for hostile interests. Yet, they're going to keep on doing it. They even have a new police force.
It never works though.
UnderpantsWeevil@lemmy.world · 5 pts · 173d
If you get under the hood of Mangione's actual history and ideology, the guy was an Effective Altruist insider. Not some Far-Left Antifa Radical, but a staunch techbro anarcho-libertarian who initially sympathized with Balaji Srinivasan's Network State and Peter Thiel's vision of fully capitalist Start Up Cities.
He'd never have normally registered on a dragnet like this.
But, more importantly, he's a near-singular instance of vigilante violence against a business executive. To say "it never works", you need to ignore the enormous security apparatus surrounding Fortune 100 senior executives. And the relative infrequency of these attempts in general. Since Thompson, there hasn't been some wave of executive assassinations. The closest we've seen was another lone wolf shooting of Charlie Kirk. Has a billionaire ever been deliberately targeted and killed... ever?
Whether it is through a reasonably robust security state, a militantly apathetic public, or the general anonymity of business executives, the real physical risk to billionaires and their CEO stogies appears to be nearly zero.
horn_e4_beaver@discuss.tchncs.de · 24 pts · 174d
Why can't people just go down to their local shop, show their ID like when you buy alcohol, and buy some kind of age verification token/code which can be used with online services?
raspberriesareyummy@lemmy.world · 31 pts · 174d
because that would be sensible and privacy-friendly, and our governments are controlled by fascist pieces of shit that want to have full control over us.
cmbabul@lemmy.world · 8 pts · 173d
Cause the goal has never been to prevent underage access it’s to create a database of troublemakers and brown people
JcbAzPx@lemmy.world · 5 pts · 173d
They very literally could not possibly care about protecting children less. They just want as much of your data as possible so they can neutralize you if you ever become a problem to them.
PhireFloofski@lemmy.world · 1 pts · 173d
my id has an nfc chip built in, I can scan it with my phone to confirm my identity. if only online services could implement an identity check that way.
tmyakal@infosec.pub · 10 pts · 173d
Outside of banking and taxes, I can't think of a single online service that I want verifying my identity. Ostensibly, these services just want to verify if you're of legal age. The small, binary question of "Are you over 18?" should require much less private data than would be needed to verify my identity.
ADTJ@feddit.uk · 1 pts · 173d
They can! In fact, in the UK some government services do this already however there's a couple of drawbacks:
They'd need to use some kind of companion app for each device since the web APIs won't give them access to this.
For us at least the NFC chip still contains a digital copy of the photo so it's not really any better since I don't know what data is going to be sent by the app.
PhireFloofski@lemmy.world · 1 pts · 173d
Maybe I'm wrong then, but I just kinda assumed that when I log into some government platform by scanning my ID with an official app all it does is it confirms my identity and sends some kinda encrypted token to the api of whatever platform I'm trying to access.
Although if that's not the case then yea, I guess that wouldn't be very anonymous either.
horn_e4_beaver@discuss.tchncs.de · 1 pts · 173d
My point wasn't one of convenience, but more one of privacy. What's the difference between someone demanding a photo of your ID (and then storing it) and someone taking the same information from an NFC scan and then storing it?
Don_alForno@feddit.org · 2 pts · 173d
I don't know about other countries, but the german e-ID for example is more sophisticated than that. It can actually limit access to the information that is necessary for the given application (your terminal or app shows you what specific information is requested before you confirm via PIN). So it can just return "yes/no" to the question "is this person an adult?" Almost no company uses it, likely because they can't steal data that way.
sheetzoos@lemmy.world · 23 pts · 173d
The government has the names of prolific pedophiles and all they do is protect these rich and powerful child abusers.
Any claims that they're doing stuff like this to protect kids is complete bullshit.
arc99@lemmy.world · 14 pts · 173d
I opened Microsoft Solitaire on my phone the other day and the fucking thing wanted to age verify me. Over on the desktop the same thing happened in MS App Store. The stupid part? I've had this Microsoft account for so long that it legally qualifies as an adult in its own right.
sleepmode@lemmy.world · 13 pts · 173d
We should all just take pics of our taint and send that in. Malicious compliance.
leopardpuncher@feddit.dk · 8 pts · 173d
They'll just forward the data to the butthole database; we still lose ✨
sleepmode@lemmy.world · 7 pts · 173d
Playing the entire Bee movie to reporting hotlines for ICE worked for a bit. Let’s kick it up a notch.
BanMe@lemmy.world · 3 pts · 173d
Off to take some photos of bee taints, I guess
Poem_for_your_sprog@lemmy.world · 4 pts · 173d
Just use goatse
muusemuuse@sh.itjust.works · 13 pts · 174d
Will they even bother trying to rebrand this or just pretend it doesn’t exist?
techt@lemmy.world · 6 pts · 174d
BeardededSquidward@lemmy.blahaj.zone · 3 pts · 174d
And will not be implementing age restrictions, for now. Key point is t the end.
Ghostie@lemmy.zip · 1 pts · 173d
BeardededSquidward@lemmy.blahaj.zone · 1 pts · 173d
Aye, I pointed out for now they're not doing it. They'll do it again eventually.
bigFab@lemmy.world · 11 pts · 173d
How is romance fraud at the same level as child exploit or money laundering? These assholes want to take full control of the world population.
matlag@sh.itjust.works · 10 pts · 173d
They just wanted to pack that list. Who thinks child exploitation is a true concern while nothing is done about the Epstein file?
SocialMediaRefugee@lemmy.world · 3 pts · 173d
Pig butchering pulls in billions and steals entire life savings.
JcbAzPx@lemmy.world · 2 pts · 173d
Yeah, I'd say it's at least on the same level as money laundering.
Buddahriffic@lemmy.world · 3 pts · 173d
It's financial fraud with a romance hook. It's like nigerian prince scams, except instead of some rich prince who will pay you back many times over, the motivation is helping your long distance lover with some big financial problem that came up.
It's not just referring to people getting catfished (it's possible the other person is even real, because it's a lot more effective when they can do video chats and video chat sex... And it might even involve human trafficking and/or slavery and that woman's whole "job" is to have video chat sex with targets).
That said, I think those are all just excuses, valid threats or not.
rumba@lemmy.zip · 1 pts · 173d
The people pushing the legislation are so unappealing to the opposite sex, it ranks very high on their psyche.
chaotic_ugly@lemmy.zip · 10 pts · 173d
Just deleted my Discord account. It wasn't an issue since I have no friends and never use it but still... it's the principle of the thing?
treesapx@lemmy.world · 10 pts · 173d
Don't let others downplay the "quality" of your protest. "It doesn't really matter, does it?" is the #1 enemy of protests.
chaotic_ugly@lemmy.zip · 9 pts · 173d
True.
I deleted reddit, for that matter, and working on degoogling, which is a really hard one.
At this point, it's not really protest. It's just that, despite being crazy lazy, there are no more excuses. This government actually is hunting down people who dissent online. No more talk of conspiracy theories. The facts are in.
kablez@lemmy.world · 1 pts · 172d
If you have a budget, I highly recommend getting a Synology NAS. Synology are a Taiwanese company with decent reliable enthusiast and SME software.
They have a bit of a reputation for overcharging for hard drives with their logos on it, but otherwise it can do all the things you need, pretty much turn key solutions for cloud services like mail server, office collaboration suite, cloud drive, team chat and so much more.
TyrionBean@lemmy.ml · 7 pts · 173d
So, Discord says they will not be using Persona. Count me skeptical as to their supposed new choice and methodology, given that they appear to have either been:
Neither option leaves me with the confidence needed to remain on any platform which recently announced this sort of "update" for our safety and "convenience".
I told my friends on Discord that I am not telling them how to proceed - they can keep using it if they want to - but I shall remove myself from there (and apparently Reddit as well soon?) post-haste. One reason I came to Lemmy last week was because I was tired of Reddit's US Ownership and, frankly, from everything I've heard...the guy in charge is a veritable Nazi anyway. As for Discord, for my friends I've set up my own Nextcloud instance and we can use Nextcloud Talk. For general groups, I'll have to look into Element with Matrix, I suppose.
UnderpantsWeevil@lemmy.world · 4 pts · 173d
This is all very bad. But, much like with the tools used during the War on Terror to track "potential terrorists", I suspect this system has a problem of excessive false positives and false correlations.
Historically, the response to this kind of data sweep was not to target people based on the information but to justify targeting of people after the fact. Also, the FBI made a habit of setting out honeypots for (typically mentally ill or extremely naive) would-be radicals or even radicalization programs intended to foment prosecutable misconduct where none had existed.
Case in point, the Newburgh Four
If these programs are allowed to run their course, I suspect we'll see similar stories springing up as less ideologically motivated judges recoil at investigations and prosecutions where the crimes themselves are entirely orchestrated by the investigating agencies.
Flames5123@sh.itjust.works · 2 pts · 173d
I thought discord moved to k-id and ditched this system?
Telodzrum@lemmy.world · 2 pts · 173d
Mwa@thelemmy.club · 2 pts · 174d
what if i AI generate a face and give it to Persona :ahahah:
LemonyLickets@lemmy.world · 1 pts · 172d
Diplomjodler3@lemmy.world · 0 pts · 174d