Discord will require a face scan or ID for full access next month
8 months ago by mr_MADAFAKA to c/privacy
Minecraft.wiki links to Zulip....
More info for those unfamiliar:
Of the accounts impacted globally, we have identified approximately 70,000 users that may have had government-ID photos exposed, which our vendor used to review age-related appeals.
Goodbye Discord.
Hello Matrix!
Matrix isn't that good from an usability standpoint as it looks a lot like IRC
Usability is good in my opinion. They’ve spent a lot of time on the UI over the past couple years. The mobile Element X apps are excellent now IMO. But the two things that prevent matrix/Element from being a good discord replacement are:
- No Mumble-like voice chat. They have Zoom-like conference calling now, but no voice channels.
- Search is either non-existent (mobile clients) or is awful. It’s somehow worse than Discord’s search! I know it’s because the search needs to work on-device because of E2EE, but unfortunately it’s still a minus point vs Discord.
Honestly, the best solution to 1 may be to simply deploy mumble in addition to matrix (or other chat apps).
Seconding this, just use mumble. It's self-hosted free and open source software, easy on resources, provides very low latency, and it's very stable and reliable.
The client might look a little dated but I still love it. I don't care for stupid electron apps, which every modern application seems to be.
LOL! That's so true! Even I have trouble navigating.
I hope for once people would get together and drop Discord so that Discord would have to reverse this policy. So often, we the customers really have the power if we get together and act together. All these social networks are nothing without the contributions of the customers.
I don't trust discord with what little I formation I've gave them so far. Definitely not giving them my ID or a scan of my face.
Of the accounts impacted globally, we have identified approximately 70,000 users that may have had government-ID photos exposed
Users who aren’t verified as adults will not be able to access age-restricted servers and channels, won’t be able to speak in Discord’s livestream-like “stage” channels, and will see content filters for any content Discord detects as graphic or sensitive.
Shrug
I'm not using discord for porn, so I'm not going to lose sleep. Will simply live with a "teen" account until my groups migrate to a better service.
But you'll get my biometrics from my cold dead hands.
They will also get warning prompts for friend requests from potentially unfamiliar users, and DMs from unfamiliar users will be automatically filtered into a separate inbox.
GOOD
Crazy they didn't implement this years ago. Discord is bloated with fake user spam.
GOOD
Crazy they didn’t implement this years ago. Discord is bloated with fake user spam.
it's easy to see how they'll manipulate this to make you think that their pro-zionist bots are actual people.
Yeah, you go ahead & do that, & watch how many people will jump ship to other alternatives while you lose a lot of money & subscriptions, especially when you’ve been hacked before.
People have found other alternatives to TikTok, & they’ll do the same with Discord.
There’s Loops.video among other alternatives to TikTok.
However, some users may not have to go through either form of age verification. Discord is also rolling out an age inference model that analyzes metadata like the types of games a user plays, their activity on Discord, and behavioral signals like signs of working hours or the amount of time they spend on Discord.>
Revolt! your time has come (though it has been renamed to Stoat; a name I very much dislike.
I apologize :(
Limited Linux support (no repo or flatpak pkgs, not even aur) and tbh im not so sure how long they will continue to exist
isn't it just a webapp? should be trivial to package as a 'standalone program'
There is an unofficial aur pkg but still my point stands
tbh. I wasn't aware of this. So far I only used it in the browser
If that is true then that is much better than revolt because that kind of name will make the majority of people roll their eyes and pass it up.
So while it hard to get your friends to join a different platform imagine how much harder it would be to get them to join “revolt”. Its super edgy
Well, I guess that 95% of all non-native speakers don't know what a stoat is. So it is much harder to connect to/remember it.
Uhhhh no thanks. Bye.
I'm not against age restrictions, but letting every site brew their own method is a really bad idea. I'm not going to upload my legal ID to every random site; that's a recipe for identity theft, and it's a really bad idea to teach people that that's normal or acceptable.
And age guessing through facial recognition is incredibly unreliable. My 16 year old son has already been accepted as 18+ somewhere. I had a full moustache at 14. Others are blessed with a babyface well into their 30s.
The only right way to do this, is if governments provide their citizens with an eID that any site can ask "is this person 18+?" and get an accurate answer without any other identifiable info. And if you don't want the government to know what sites you visit, have sites route the request through a proxy.
But instead everybody's got to cobble together their own improvised system that we just have to trust blindly is not going to sell our data.
and it’s a really bad idea to teach people that that’s normal or acceptable.
This is a point so few people mention. Normalising having to give up personal information online is such a dangerous thing to do and companies/governments that enforce this shit are setting people up to be scammed
And if you don't want the government to know what sites you visit, have sites route the request through a proxy.
Actually, no on the fly communication with the issuer is required for selective disclose. You just need a signed document with individually salted hashes of different properties and you can create a zero knowledge proof non-interactively. Zero knowledge meaning that truely nothing but the disclosed property (age > 18, County == DE, or whatever) is communicated to anyone.
Theres a lot of other cool stuff that can be done with zero knowledge digital identity wallets. You could for example hash your pubkey together with the service providers pk and disclose that as a per service ID, but not reveal your pk. This allows linkability within one service (as a login method for example) while preventing cross service linkability.
That prevents the site from knowing your identity, but I'm not convinced it prevents the government from knowing you visit the site. The government could keep track of which document corresponds to which individual whenever they issue / sign it.
So if the government mandated that each signed proof of "age>18" was stored by the service and mapped to each account (to validate their proof), then the government could request the service to provide them copy of the proof and then cross-check from their end which particular individual is linked to it.
The reason why it works is a bit complicated, but basically the trick is that the signatures are not immutable. Given a valid signature, it is possible to create a new valid signature over the same content that is not linkable to the original one. This means that it is still possible to derive, what authority signed the document, but the authority cannot know in which transaction it has signed that specific document.
If you have no way to link the signature to the original document, then how do you validate that the signature is coming from a document without repetition / abuse?
How do you ensure there aren't hundreds of signatures used for different accounts all done by the same stolen eID that might be circulating online without the government realizing it?
Can the government revoke the credentials of a specific individual? ...because if they can't then that looks like a big gap that could create a market of ever-growing stolen eIDs (or reusing eIDs from the deceased) ...and if they can revoke, what stops the government from creating a simulation in which they revoke one specific individual and then check what signatures end up being revoked to identify which ones belong to that person? The government can mandate the services to provide them all data they have so it can be analyzed as if they were Issuer, Registry and Verifier, all in one, without separation of powers.
I know there are ways to try and fix this, but those ways have other problems too, which end up forcing the need for a compromise.. there's no algorithm that perfectly provides anonymity and full verifiability with a perfect method of revocation that does not require checks at every user login. For example, with the eIDAS 2.0 system (considered zero-knowledge proof), the government does have knowledge of the "secret serial number" that is used in revocation, so if they collude with the service they can identify people by running some tests on the data.
if you don’t want the government to know what sites you visit, have sites route the request through a proxy.
I feel a proxy would not really make much of a difference. If the government keeps a mapping of which eID corresponds to each real person from their end (which they would do if they want to know what sites you visit) then they can simply request the services (and/or intermediaries) to provide account mapping of the eIDs (and they could mandate by law those records are kept, like they often do with ISPs and their IP addresses). The service might not know who that eID belongs to.. but the government can know it, if they want.
The government needs to want to protect your privacy. If the government really wants to know what sites you visit, there's no reason why they would want to provide you with a eID that is truly anonymous at all levels and that isn't really linked to you, not even in state-owned databases.
Of course, a government has many ways they can legislate your rights, freedom and privacy away. But if you want to do this in a way that preserves privacy, this is how you do it.
Of course the government knows who you are; they have to. They issue your ID, and that makes them the only organisation that can issue your eID. But a government that serves its people would provide this an a service, with the proxy, to ensure privacy is respected.
And of course with a warrant they can and should be able to demand access to the proxy's or the website's logs. But only with a warrant. That is the bar that the government should always have to clear before they can get access to any citizen's privacy.
I agree that a government that wants privacy can actually do it in a way that ensures privacy. That's also what I was saying.
My point was that this is up to the government, and no amount of "route the request through a proxy" would patch that up, that's not gonna help this case. Because this is not something that's tracked in the networking layer, it's in the application layer.
If the government wants to protect privacy, they can do it without you needing to use proxies, and if the government wants to see what sites you visit using these certificates, they can do it even if you were to use proxies.
If the proxy is independent, I don't see how the government can know what the requesting site is. They can only see the proxy. I don't mean a standard network proxy of course, but a proxy for the entire request. That's probably the source of our misunderstanding.
Does there exist an alternative that has both a desktop (WIN/Linux) client and a phone (android/iphone) client?
Matrix
XMPP, Conversations is a Nice Android client.
Matrix and Stoat
do you know if stoat's ios client good enough? last i tried the android one was also very basic.
I don't use ios and I don't know what your standard of "good enough" is.
I've tried ouy the android one back when it was named Revolt and I though it was on par with Discord from a few years ago before they added in all the stickers and games, so I thought it was "good enough"
Just try it and see
Its Joever
We need something like what Lemmy is to Reddir, except for discord. A decentralized application with multiple instances that users can join.
I have a discord server of about ~1K members, and would love to spin up a docker container to host my own instance that users can join. Chat, voice/ video calls, video streaming, etc. I'd love to support a FOSS project like this. Maybe even have E2E while we're at it!
Closest I can think of is Matrix. Element isn't bad.
Matrix is the way, and element is the best so far, but it needs more work.
RIP Discord
personally i'd also backup the messages before deleting, this works well https://github.com/Tyrrrz/DiscordChatExporter
matrix and zulip are interesting alternatives
On-device processing: Video selfies for facial age estimation never leave a user’s device.
Quick deletion: Identity documents submitted to our vendor partners are deleted quickly— in most cases, immediately after age confirmation.
Still a no for me for now, but a bit misleading: https://discord.com/...
New to the whole privacy space, what should I start moving my social group to that's like discord but not doing this?
That's a no go from here...
Like I mentioned in a similar post, please look at this alternative: https://stoat.chat/
forgot to add that one, my other post did include Matrix as well :)
Does this still require you to 'call' people to be in a voice channel? Or is it now similar to discord in that you join a channel and can hear anyone in it?
Well, time to dump Discord after I finish school.
What about Fractal? It even have a flatpak https://gitlab.gnome.org/World/fractal
Fractal is not multiplatform (i.e. isn't available on Android and on iOS) and Matrix can be confusing to people not already familiar with it.
And no, a wall of text explaining what Matrix is won't help since most of Discord's users are teenagers with a very short attention span that don't read much (unless they're forced to by school).
Potential solution, may be controversial.
Just add a vertical video with Minecraft parkour or with CS surf on the bottom and a half naked woman from a freelance platform explaining what it is.
There are also Element and SchildiChat as alternative clients.
MSN Messenger for the win!
The same as Discord (IRC with a fancy GUI) but with the fact your data is unconsentionally sent to an intelligence agency for analysis.
@lemmy.ml
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
go to feed...
@lemmy.ml
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
go to feed...
I’m never doing this. I’ll pay someone else to verify my account before I upload my dox with these assholes.
I’m fine switching to an alternative, but I have seen no gaming companies linking anything else for their official “forums”
save