Discord will require a face scan or ID for full access next month
Discord will require a face scan or ID for full access next month
Starting in March, all Discord users will have a “teen” experience by default unless they complete age verification using a video selfie or ID.Stevie Bonifield (The Verge)
like this
mr_MADAFAKA
in reply to mr_MADAFAKA • • •Artwork
in reply to mr_MADAFAKA • • •incompetent
in reply to Artwork • • •More info for those unfamiliar:
Update on a Security Incident Involving Third-Party Customer Service | Discord
discord.comMwa
in reply to mr_MADAFAKA • • •Idk
Prove_your_argument
in reply to mr_MADAFAKA • • •I’m never doing this. I’ll pay someone else to verify my account before I upload my dox with these assholes.
I’m fine switching to an alternative, but I have seen no gaming companies linking anything else for their official “forums”
Goodlucksil
in reply to Prove_your_argument • • •mechanicalAnt
in reply to mr_MADAFAKA • • •ttyybb
in reply to mechanicalAnt • • •yeehaw
in reply to mr_MADAFAKA • • •CrocodilloBombardino
in reply to mr_MADAFAKA • • •Rom [he/him]
in reply to mr_MADAFAKA • • •UnderpantsWeevil
in reply to mr_MADAFAKA • • •Shrug
I'm not using discord for porn, so I'm not going to lose sleep. Will simply live with a "teen" account until my groups migrate to a better service.
But you'll get my biometrics from my cold dead hands.
GOOD
Crazy they didn't implement this years ago. Discord is bloated with fake user spam.
eldavi
in reply to UnderpantsWeevil • • •it's easy to see how they'll manipulate this to make you think that their pro-zionist bots are actual people.
ttyybb
in reply to UnderpantsWeevil • • •this
in reply to UnderpantsWeevil • • •Vanth
in reply to this • • •Anas
in reply to UnderpantsWeevil • • •VoxAliorum
in reply to mr_MADAFAKA • • •LadyMeow
in reply to VoxAliorum • • •You made the poor little guy sad. :(
VoxAliorum
in reply to LadyMeow • • •LadyMeow
in reply to VoxAliorum • • •NamedUser
in reply to VoxAliorum • • •If that is true then that is much better than revolt because that kind of name will make the majority of people roll their eyes and pass it up.
So while it hard to get your friends to join a different platform imagine how much harder it would be to get them to join “revolt”. Its super edgy
VoxAliorum
in reply to NamedUser • • •kittenzrulz123
in reply to VoxAliorum • • •chgxvjh [he/him, comrade/them]
in reply to kittenzrulz123 • • •VoxAliorum
in reply to kittenzrulz123 • • •hexagonwin
in reply to kittenzrulz123 • • •kittenzrulz123
in reply to hexagonwin • • •ZombieCyborgFromOuterSpace
in reply to mr_MADAFAKA • • •Goodbye Discord.
Hello Matrix!
Goodlucksil
in reply to ZombieCyborgFromOuterSpace • • •Untold1707
in reply to Goodlucksil • • •Usability is good in my opinion. They’ve spent a lot of time on the UI over the past couple years. The mobile Element X apps are excellent now IMO.
But the two things that prevent matrix/Element from being a good discord replacement are:
moonpiedumplings
in reply to Untold1707 • • •ℍ𝕖𝕝𝕚0𝕤
in reply to moonpiedumplings • • •Seconding this, just use mumble. It's self-hosted free and open source software, easy on resources, provides very low latency, and it's very stable and reliable.
The client might look a little dated but I still love it. I don't care for stupid electron apps, which every modern application seems to be.
ZombieCyborgFromOuterSpace
in reply to Goodlucksil • • •EstraDoll [she/her, he/him]
in reply to mr_MADAFAKA • • •Zerush
in reply to EstraDoll [she/her, he/him] • • •PleasantPeasant
in reply to EstraDoll [she/her, he/him] • • •(des)mosthenes
in reply to mr_MADAFAKA • • •RotatingParts
in reply to mr_MADAFAKA • • •harsh3466
in reply to RotatingParts • • •Without the contributions of the product.
As the adage goes, if you're not paying for it (and often even when you are), you're not the customer.
Whostosay
in reply to harsh3466 • • •tehWrapper
in reply to mr_MADAFAKA • • •☂️-
in reply to tehWrapper • • •PowerCrazy
in reply to mr_MADAFAKA • • •Tatar_Nobility
in reply to PowerCrazy • • •Hirom
in reply to PowerCrazy • • •Conversations - Jabber/XMPP client for Android
conversations.immnemonicmonkeys
in reply to PowerCrazy • • •hexagonwin
in reply to mnemonicmonkeys • • •mnemonicmonkeys
in reply to hexagonwin • • •I don't use ios and I don't know what your standard of "good enough" is.
I've tried ouy the android one back when it was named Revolt and I though it was on par with Discord from a few years ago before they added in all the stickers and games, so I thought it was "good enough"
Just try it and see
Postmortal_Pop
in reply to mr_MADAFAKA • • •PleasantPeasant
in reply to Postmortal_Pop • • •can someone on a server that isnt defederated from lemmy.world send this comment for me?
copied from earlier comment above:
teamspeak (although i dont think they have teamspeak 6 server files available yet?), riot! (now called stoat apparently?), mumble, matrix, and jitsi meet
oh yeah if you're ok seperating the chat and voice app i really like deltachat for chatting in the group
Redtrax
in reply to mr_MADAFAKA • • •Thordros [he/him, comrade/them]
in reply to mr_MADAFAKA • • •Carl [he/him]
in reply to Thordros [he/him, comrade/them] • • •☂️-
in reply to Carl [he/him] • • •chgxvjh [he/him, comrade/them]
in reply to ☂️- • • •hexagonwin
in reply to Carl [he/him] • • •99zz99 [comrade/them, he/him]
in reply to mr_MADAFAKA • • •swelter_spark
in reply to 99zz99 [comrade/them, he/him] • • •newcool1230
in reply to mr_MADAFAKA • • •discord.com/press-releases/upd…
Update on a Security Incident Involving Third-Party Customer Service | Discord
discord.comMeetMeAtTheMovies [they/them]
in reply to mr_MADAFAKA • • •PleasantPeasant
in reply to MeetMeAtTheMovies [they/them] • • •it's fine as long as you dont have the server marked as 18+
also, supposedly they will be having an ai determine people who are 18+ so you might not even need to upload anything
still, if this leaves too sour of a taste in your mouth the alternatives i can think of off the top of my head are: teamspeak (although i dont think they have teamspeak 6 server files available yet?), riot! (now called stoat apparently?), mumble, matrix, and jitsi meet
oh yeah if you're ok seperating the chat and voice app i really like deltachat for chatting in the group
hexagonwin
in reply to PleasantPeasant • • •greencoil
in reply to PleasantPeasant • • •SpaceCrystal
in reply to mr_MADAFAKA • • •Yeah, you go ahead & do that, & watch how many people will jump ship to other alternatives while you lose a lot of money & subscriptions, especially when you’ve been hacked before.
People have found other alternatives to TikTok, & they’ll do the same with Discord.
☂️-
in reply to SpaceCrystal • • •onlooker
in reply to SpaceCrystal • • •Geki
in reply to mr_MADAFAKA • • •We need something like what Lemmy is to Reddir, except for discord. A decentralized application with multiple instances that users can join.
I have a discord server of about ~1K members, and would love to spin up a docker container to host my own instance that users can join. Chat, voice/ video calls, video streaming, etc. I'd love to support a FOSS project like this. Maybe even have E2E while we're at it!
pucker4676
in reply to Geki • • •UltraGiGaGigantic
in reply to pucker4676 • • •borrowed_atoms
in reply to Geki • • •Stoat (formerly called Revolt) is potentially that. I tried it a while back and it was still rough around the edges, but the potential was there. Open source and has potential for self hosting.
Stoat.chat
onlooker
in reply to borrowed_atoms • • •Clickable link for anyone curious:
stoat.chat
Stoat
stoat.chatKubiac
in reply to Geki • • •☂️-
in reply to mr_MADAFAKA • • •☂️-
in reply to ☂️- • • •hexagonwin
in reply to ☂️- • • •GitHub - Tyrrrz/DiscordChatExporter: Saves Discord chat logs to a file
GitHubintoner
in reply to mr_MADAFAKA • • •मुक्त
in reply to intoner • • •intoner
in reply to मुक्त • • •PleasantPeasant
in reply to मुक्त • • •UltraGiGaGigantic
in reply to mr_MADAFAKA • • •Felis_Rex
in reply to UltraGiGaGigantic • • •VoxAliorum
in reply to mr_MADAFAKA • • •Still a no for me for now, but a bit misleading: discord.com/press-releases/dis…
Discord Launches Teen-by-Default Settings Globally
discord.comArdens
in reply to mr_MADAFAKA • • •mcv
in reply to mr_MADAFAKA • • •I'm not against age restrictions, but letting every site brew their own method is a really bad idea. I'm not going to upload my legal ID to every random site; that's a recipe for identity theft, and it's a really bad idea to teach people that that's normal or acceptable.
And age guessing through facial recognition is incredibly unreliable. My 16 year old son has already been accepted as 18+ somewhere. I had a full moustache at 14. Others are blessed with a babyface well into their 30s.
The only right way to do this, is if governments provide their citizens with an eID that any site can ask "is this person 18+?" and get an accurate answer without any other identifiable info. And if you don't want the government to know what sites you visit, have sites route the request through a proxy.
But instead everybody's got to cobble together their own improvised system that we just have to trust blindly is not going to sell our data.
M1k3y
in reply to mcv • • •Actually, no on the fly communication with the issuer is required for selective disclose.
You just need a signed document with individually salted hashes of different properties and you can create a zero knowledge proof non-interactively. Zero knowledge meaning that truely nothing but the disclosed property (age > 18, County == DE, or whatever) is communicated to anyone.
Theres a lot of other cool stuff that can be done with zero knowledge digital identity wallets. You could for example hash your pubkey together with the service providers pk and disclose that as a per service ID, but not reveal your pk. This allows linkability within one service (as a login method for example) while preventing cross service linkability.
Ferk
in reply to M1k3y • • •That prevents the site from knowing your identity, but I'm not convinced it prevents the government from knowing you visit the site. The government could keep track of which document corresponds to which individual whenever they issue / sign it.
So if the government mandated that each signed proof of "age>18" was stored by the service and mapped to each account (to validate their proof), then the government could request the service to provide them copy of the proof and then cross-check from their end which particular individual is linked to it.
M1k3y
in reply to Ferk • • •Ferk
in reply to M1k3y • • •If you have no way to link the signature to the original document, then how do you validate that the signature is coming from a document without repetition / abuse?
How do you ensure there aren't hundreds of signatures used for different accounts all done by the same stolen eID that might be circulating online without the government realizing it?
Can the government revoke the credentials of a specific individual? ...because if they can't then that looks like a big gap that could create a market of ever-growing stolen eIDs (or reusing eIDs from the deceased) ...and if they can revoke, what stops the government from creating a simulation in which they revoke one specific individual and then check what signatures end up being revoked to identify which ones belong to that person? The government can mandate the services to provide them all data they have so it can be analyzed as if they were Issuer, Registry and Verifier, all in one, without separation of powers.
I know there are ways to try and fix this, but those ways have other problems too, which end up forcing th
... Show more...If you have no way to link the signature to the original document, then how do you validate that the signature is coming from a document without repetition / abuse?
How do you ensure there aren't hundreds of signatures used for different accounts all done by the same stolen eID that might be circulating online without the government realizing it?
Can the government revoke the credentials of a specific individual? ...because if they can't then that looks like a big gap that could create a market of ever-growing stolen eIDs (or reusing eIDs from the deceased) ...and if they can revoke, what stops the government from creating a simulation in which they revoke one specific individual and then check what signatures end up being revoked to identify which ones belong to that person? The government can mandate the services to provide them all data they have so it can be analyzed as if they were Issuer, Registry and Verifier, all in one, without separation of powers.
I know there are ways to try and fix this, but those ways have other problems too, which end up forcing the need for a compromise.. there's no algorithm that perfectly provides anonymity and full verifiability with a perfect method of revocation that does not require checks at every user login. For example, with the eIDAS 2.0 system (considered zero-knowledge proof), the government does have knowledge of the "secret serial number" that is used in revocation, so if they collude with the service they can identify people by running some tests on the data.
freedickpics
in reply to mcv • • •This is a point so few people mention. Normalising having to give up personal information online is such a dangerous thing to do and companies/governments that enforce this shit are setting people up to be scammed
Ferk
in reply to mcv • • •I feel a proxy would not really make much of a difference. If the government keeps a mapping of which eID corresponds to each real person from their end (which they would do if they want to know what sites you visit) then they can simply request the services (and/or intermediaries) to provide account mapping of the eIDs (and they could mandate by law those records are kept, like they often do with ISPs and their IP addresses). The service might not know who that eID belongs to.. but the government can know it, if they want.
The government needs to want to protect your privacy. If the government really wants to know what sites you visit, there's no reason why they would want to provide you with a eID that is truly anonymous at all levels and that isn't really linked to you, not even in state-owned databases.
mcv
in reply to Ferk • • •Of course, a government has many ways they can legislate your rights, freedom and privacy away. But if you want to do this in a way that preserves privacy, this is how you do it.
Of course the government knows who you are; they have to. They issue your ID, and that makes them the only organisation that can issue your eID. But a government that serves its people would provide this an a service, with the proxy, to ensure privacy is respected.
And of course with a warrant they can and should be able to demand access to the proxy's or the website's logs. But only with a warrant. That is the bar that the government should always have to clear before they can get access to any citizen's privacy.
Ferk
in reply to mcv • • •I agree that a government that wants privacy can actually do it in a way that ensures privacy. That's also what I was saying.
My point was that this is up to the government, and no amount of "route the request through a proxy" would patch that up, that's not gonna help this case. Because this is not something that's tracked in the networking layer, it's in the application layer.
If the government wants to protect privacy, they can do it without you needing to use proxies, and if the government wants to see what sites you visit using these certificates, they can do it even if you were to use proxies.
mcv
in reply to Ferk • • •Ferk
in reply to mcv • • •They don't need to know the requesting address in order for them to know if it was you the person corresponding to that proof of age, because the information is in the data being exchanged. These kind of verifications don't depend or rely on IP address or networking, these are credentials that are checked on the application layer.
In fact, they don't even need to directly communicate with the government for this.
This is equivalent to a registration office for a service asking you provide a paper stamped by the government that certifies your age without the paper actually saying who you are.. the service does not need to contact the government if they can trust the stamp in the paper and the government official signature (which in this case is mathematical proof). And even though the service office can't see your name in the paper, the government knows that the number written in the paper links to you individually, because they can keep record of which particular paper number was issued to which individual, even if your name wasn't written in the document itself.
... Show more...They don't need to know the requesting address in order for them to know if it was you the person corresponding to that proof of age, because the information is in the data being exchanged. These kind of verifications don't depend or rely on IP address or networking, these are credentials that are checked on the application layer.
In fact, they don't even need to directly communicate with the government for this.
This is equivalent to a registration office for a service asking you provide a paper stamped by the government that certifies your age without the paper actually saying who you are.. the service does not need to contact the government if they can trust the stamp in the paper and the government official signature (which in this case is mathematical proof). And even though the service office can't see your name in the paper, the government knows that the number written in the paper links to you individually, because they can keep record of which particular paper number was issued to which individual, even if your name wasn't written in the document itself.
So, the government can, at any given time, go to those offices, ask them to hand in the paper corresponding to a particular registration and check the number to see who it belongs to.
The traceability is in the document, not in the manner in which you send it. It does not matter if you send the document to a different country for someone else to send it from a different address, on your behalf (ie. a proxy). If the government can internally cross-reference the registration papers as being the ones linked to your governmental ID, they can know it's yours regardless of how it reached the offices. So this way they can check if you registered yourself in any particular place they wanna target and what your account is.
mcv
in reply to Ferk • • •Ferk
in reply to mcv • • •They might not know the list of sites you visit right away in the same way they could by contacting your ISP when you are not using a proxy, but that wasn't my point.
My point is that they can check with a specific site that uses this verification method and see if you have an account on that site, and if you do, which account in particular. And in a way that is much more directly linked to you personally than an IP address (which might be linked to the household/internet access you're using but that isn't necessarily under your name).
So in this situation they can indeed know if you use any one particular site that they choose to target, as long as that site is requiring you to provide them with a document, regardless of how many layers of proxies you (or the site) choose to be under.
I'm not sure what you mean by "the site that’s requesting this", the site does not need to request anything from the government, they just need to have previously agreed on a "secret" mathematical verification method that works for every document. The digital equivalent of a
... Show more...They might not know the list of sites you visit right away in the same way they could by contacting your ISP when you are not using a proxy, but that wasn't my point.
My point is that they can check with a specific site that uses this verification method and see if you have an account on that site, and if you do, which account in particular. And in a way that is much more directly linked to you personally than an IP address (which might be linked to the household/internet access you're using but that isn't necessarily under your name).
So in this situation they can indeed know if you use any one particular site that they choose to target, as long as that site is requiring you to provide them with a document, regardless of how many layers of proxies you (or the site) choose to be under.
I'm not sure what you mean by "the site that’s requesting this", the site does not need to request anything from the government, they just need to have previously agreed on a "secret" mathematical verification method that works for every document. The digital equivalent of a stamp/signature.
mcv
in reply to Ferk • • •But getting that information from the USP or the site would require a warrant. Not to mention that the site doesn't have to know your real identity either.
And the whole point of this exercise is to ensure that you don't have to provide any document to the site.
What I mean by the site that's requesting this, is exactly that: you need to prove to a site that you're above a certain age. For that, the site redirects you to the proxy that redirects you to the eID site, with a request to confirm that you're above a certain age.
The site has fulfilled its legal obligation to check your age, but doesn't have to know your identity, and the government doesn't have to know what site you're visiting.
I feel like you're misunderstanding the scenario we're discussing.
Ferk
in reply to mcv • • •I feel you are talking about a different thing now. My point was surrounding what you initially said:
An eID is a digital document. You yourself are proposing that sites should request people to provide a document, one that's issued by the government to you, personally.
Then later you said that using a proxy prevents the government to know what you visit.
My answer was that if you are providing a government-issued document/file to the service then the government (the issuer) can know if you visit the site just by keeping track of who did they issue each document for and requesting the sites for copies of the documents. Even if the document itself does not say your name. And that's regardless of how many proxy layers y
... Show more...I feel you are talking about a different thing now. My point was surrounding what you initially said:
An eID is a digital document. You yourself are proposing that sites should request people to provide a document, one that's issued by the government to you, personally.
Then later you said that using a proxy prevents the government to know what you visit.
My answer was that if you are providing a government-issued document/file to the service then the government (the issuer) can know if you visit the site just by keeping track of who did they issue each document for and requesting the sites for copies of the documents. Even if the document itself does not say your name. And that's regardless of how many proxy layers you use, since there's traceability in the document. This makes you fundamentally less anonymous to the government than before (when you could have indeed used a proxy to prevent this), this makes proxies no longer a good defense.
The service does not know you, but that's not the point, what you said is that the government can't know if you visit the site, which is the one thing I disagreed with.
mcv
in reply to Ferk • • •I'm still talking about the same thing, but I understand the nature of our misunderstanding now. You see eID as something you download and can share (but what kind of security would that provide?). I mean an online ID service, similar to the Dutch DigiD. I assume the EU eID is also something similar, although I have no personal experience with that.
The first paragraph on Wikipedia contains a good description of what I'm talking about: en.wikipedia.org/wiki/Electron…
... Show more...The online authentication is the important part
I'm still talking about the same thing, but I understand the nature of our misunderstanding now. You see eID as something you download and can share (but what kind of security would that provide?). I mean an online ID service, similar to the Dutch DigiD. I assume the EU eID is also something similar, although I have no personal experience with that.
The first paragraph on Wikipedia contains a good description of what I'm talking about: en.wikipedia.org/wiki/Electron…
The online authentication is the important part. The article also talks about physical cards with a chip, but I honestly don't quite understand how that's different from a regular chip in a passport.
When I have to access any government service, I get redirected to digID to log in, then redirected to the site I want to visit. This is very similar to other online authorisation schemes, except it's tied to me official legal identity.
My proposal is to use this not just to log in to government sites, but to use it to provide any legally required online identification, tailored to the highest amount of privacy possible in that situation. So if a site needs to confirm you're 18+, let that site ask the eID service for just your age, or even just whether you're 18+ or not, log into the eID system, and the eID system sends confirmation of your age back to the site.
physical or electronic identity which can be used for online and offline personal identification or authentication; form of eID
Contributors to Wikimedia projects (Wikimedia Foundation, Inc.)Ferk
in reply to mcv • • •Oh, I see the misunderstadning.
Note that "authentication and login" does not necessarily require network communication with a government service. In fact in Europe the eIDs (eIDAS) are digital documents that use cryptography to authenticate without the need of spending resources in a government-funded public API that could be vulnerable to DDOS attacks and would be requiring reliable internet connections for all digital authentication (which might not always be an online operation). The chips are just a secure way to store the digital document and lock under hardware the actual key, making it much harder for it to be copied/replicated, but they don't require internet connection for making government-certified digital signatures with them that can be used in authentication, this is the same whether the service itself you are login into is online or offline.
In any case, in your example where actual network communication is used, it would still be possible for the government to track you regardless of proxies, because then they can store a log of the data & messages
... Show more...Oh, I see the misunderstadning.
Note that "authentication and login" does not necessarily require network communication with a government service. In fact in Europe the eIDs (eIDAS) are digital documents that use cryptography to authenticate without the need of spending resources in a government-funded public API that could be vulnerable to DDOS attacks and would be requiring reliable internet connections for all digital authentication (which might not always be an online operation). The chips are just a secure way to store the digital document and lock under hardware the actual key, making it much harder for it to be copied/replicated, but they don't require internet connection for making government-certified digital signatures with them that can be used in authentication, this is the same whether the service itself you are login into is online or offline.
In any case, in your example where actual network communication is used, it would still be possible for the government to track you regardless of proxies, because then they can store a log of the data & messages exchanged in the authentication.
They can either ask the sites to authenticate previously with the government for the use of the API (which would make sense to prevent DDOS and other abuse, for example), which would let them know immediately which site you were asking login for (in a much more direct way than with "documents"), or simply provide a token to the site as result of the user authentication (which is a common practice anyway, most authentication systems work through tokens) and later at any given time in the future ask the sites to provide back which tokens are linked to each account on the site (just like I was saying before with the "documents" example) so the government can map each token with each individual person and know which users of that site correspond to which individuals.
hobata
in reply to mr_MADAFAKA • • •Jimmycrackcrack
in reply to mr_MADAFAKA • • •Matt
in reply to Jimmycrackcrack • • •typhoon
in reply to mr_MADAFAKA • • •gitlab.gnome.org/World/fractal
World / fractal · GitLab
GitLabMatt
in reply to typhoon • • •Fractal is not multiplatform (i.e. isn't available on Android and on iOS) and Matrix can be confusing to people not already familiar with it.
And no, a wall of text explaining what Matrix is won't help since most of Discord's users are teenagers with a very short attention span that don't read much (unless they're forced to by school).
::: spoiler Potential solution, may be controversial.
Just add a vertical video with Minecraft parkour or with CS surf on the bottom and a half naked woman from a freelance platform explaining what it is.
:::
There are also Element and SchildiChat as alternative clients.
Matt
in reply to mr_MADAFAKA • • •Freakazoid
in reply to mr_MADAFAKA • • •Stoat
stoat.chatpineapple
in reply to Freakazoid • • •Freakazoid
in reply to pineapple • • •Raz
in reply to Freakazoid • • •SporadicSpiral
in reply to mr_MADAFAKA • • •Mantiddies
in reply to mr_MADAFAKA • • •