back to article Discord says 70,000 photo IDs compromised in customer service breach

Communication platform provider Discord has admitted that around 70,000 users had their government IDs stolen as part of its recent data breach. The breach, which Discord insists occurred at an unidentified third-party customer service provider, involved government ID scans that users upload to verify their age. Some …

  1. Elongated Muskrat Silver badge

    This, dear reader,

    is why the government's age verification law is bad. You provide ID to prove you are over 18, and then, what happens to it? It only takes one weak link in the "supply chain" - one ID verification service, one vendor, one website, and all that juicy PID is stolen.

    Quite apart from a requirement to provide your identity to use a website, which has clear potential for tracking and monitoring.

    1. cyberdemon Silver badge
      Holmes

      Re: This, dear reader,

      This.

      BTW is there any UK Reg reader left who hasn't signed the petition yet? It's 230k away from being the biggest response ever on the government's cylindrical receptacle suggestion box

      https://petition.parliament.uk/petitions/730194

      1. elsergiovolador Silver badge

        Re: This, dear reader,

        How politician can buy a mansion with petition signatures?

        Billionaire power hungry degenerates have more power than unwashed voters.

        Another failure of MI5 to uphold its statutory duty.

      2. Elongated Muskrat Silver badge

        Re: This, dear reader,

        They ignored the one for a second vote on brexit, despite the obvious irregularities with the advisory referendum, as well as the million people protesting outside parliament, so I wouldn't hold your breath. That one had over 6 million signatures at the point where they "archived" it. Whether you agree with brexit or not (and I know there are people here who still think it was a brilliant idea despite the evidence), this demonstrates exactly how easy it is for government to completely ignore the strongly-held opinions of huge swathes of the population when it suits their purposes.

        The one linked above is a little more than 230K off having the record, as at the time of me writing this, it's over 3 million off the number of signatures on the brexit one. Not even half way...

        1. cyberdemon Silver badge
          Pint

          Re: This, dear reader,

          That's interesting.. I was looking at the list of "all petitions" here: https://petition.parliament.uk/petitions?state=all

          You are right, the brexit one and many others are mysteriously absent from that list. Apparently "All petitions" only shows those submitted to the current government, and there is no single list of all petitions ever, sorted by number of signatures.

          But yes, a right stitch-up. Had the "non-binding referendum" been 48/52 the other way, you bet your arse there would've been a second referendum.

          1. Elongated Muskrat Silver badge

            Re: This, dear reader,

            But yes, a right stitch-up. Had the "non-binding referendum" been 48/52 the other way, you bet your arse there would've been a second referendum.

            Technically, that one was the second one (the first one was in 1975), so another one would have been a third one.

            Points of note are:

            - it was explicitly advisory in the enabling bill

            - if it had not been explicitly advisory, it would have required a 2/3 super-majority for any constitutional change, not a simple majority of votes cast.

            - it explicitly excluded a group of people who would have voted strongly against leaving the EU, namely British citizens living overseas in the EU.

      3. heyrick Silver badge

        Re: This, dear reader,

        But the response: We will introduce a digital ID within this Parliament to help tackle illegal migration, make accessing government services easier, and enable wider efficiencies.

        Sounds very much like "screw you we're going to do it anyway".

      4. Anonymous Coward
        Anonymous Coward

        Re: This, dear reader,

        >BTW is there any UK Reg reader left who hasn't signed the petition yet? It's 230k away from being the biggest response ever on the government's cylindrical receptacle suggestion box

        All this proves is that nearly 3 million people don't understand the point of the petitions website or the way that Parliament works.

        The petitions website explicitly calls for the topic to be debated in Parliament if there is sufficient interest. It doesn't - and can't - make the government backtrack (or proceed) on any policy decisions or laws.

        Digital ID *must* be debated in Parliament already before it can be implemented. This is a petition signed by nearly 3 million people asking Parliament to do its job - which it will do anyway in the near future when the bill reaches Parliament and the Lords. Parliament will do its job and if a majority of MPs and Peers support it, it will be implemented.

        If you don't want digital ID, write to your MP and explain to them why you don't want it. That is the only way that you'll stop it if you don't agree with it - but don't just say "Don't like it, don't want it". Give them reasons that they can use in the debate - preferably backed with cold, hard facts.

        1. Elongated Muskrat Silver badge

          Re: This, dear reader,

          Given that my current MP is a member of a minority party with 4 MPs, I don't think writing to her would have a great deal of effect on government policy.

    2. Anonymous Coward Silver badge
      Facepalm

      Re: This, dear reader,

      Also it normalises submitting confidential data to random websites, so even if most sites use a genuine and trustworthy third party (yeah, I couldn't type that with a straight face) there will be other sites geared up specifically to harvest such data.

  2. Empire of the Pussycat

    I'm shocked, appalled, taken aback

    (Not really)

    Predictable, and, indeed, predicted.

    1. heyrick Silver badge
      Pint

      Re: I'm shocked, appalled, taken aback

      Of course, but, you know, I expected this story as a Christmas present, not pre-Halloween.

      Beer, because getting pissed is the only response to this level of dumb predictability.

  3. bitwise

    We said this was going to happen mere weeks ago

    Why this isn't being wielded more strongly as a weapon against this stupid law I don't know.

    1. MonkeyJuice Silver badge

      Re: We said this was going to happen mere weeks ago

      Because legislators are too dim to see the cause and effect between a poorly rushed age verification scheme that has been outsourced with zero privacy or security requirements to third party companies. They simply do not understand how the tech landscape works, and the sheer number of chancers in the industry willing to sell businesses a service they cooked up in a weekend for a quick buck.

      1. Not Yb Silver badge

        Re: We said this was going to happen mere weeks ago

        It's the usual political fallacy:

        A) This is terrible, something must be done!

        B) This is something, therefore it must be done.

        1. Anonymous Goat

          Re: We said this was going to happen mere weeks ago

          It's not only age verification. Buy or sell a house, administer an estate, open a savings account, register with a doctor, there's all sorts of activities that cause professionals to need to verify your identity and/or banking details. They all use different third party companies, all of who grant themselves rights to transmit your data abroad, to store it, sell it and share it with whoever they feel like.

          It's all very well to say the government shouldn't administer a digital ID, but at the moment there are dozens of companies fulfilling that function for regulatory purposes, all obvious magnets for intruders. I'm coming round to the view that a single, government grade dB is safer than what there is now.

          1. logicalextreme

            Re: We said this was going to happen mere weeks ago

            Aye. One that works and it used right is a good idea (though I think it should have a physical piece to it). The idea of an ID isn't the problem, it's the asinine Act that's been passed.

            I'm in the process of being evicted and my local authority wants me to send proof of ID by email — if that's the only way they can accept it then they're not getting my passport but rather my provisional driving license that expired 10 years ago. In a world where a safe state-operated digital ID existed I could perhaps satisfy them with a simple key exchange.

  4. VoiceOfTruth Silver badge

    Wait until the politicians' details are leaked

    Then this will be rolled back.

    1. EvaQ

      Re: Wait until the politicians' details are leaked

      There's a 'better' solution: an exception for politicians.

      Just follow the EU Chat Control proposal: The scanning would apply to all EU citizens, except EU politicians.

      1. Anonymous Coward
        Anonymous Coward

        Re: Wait until the politicians' details are leaked

        Just like Animal Farm...

        1. Kane
          Unhappy

          Re: Wait until the politicians' details are leaked

          "Just like Animal Farm..."

          All animals are equal, but some animals are more equal than others.

          Also, Pink Floyd's "Animals" lyrics has never felt more relevant.

    2. Anonymous Coward
      Anonymous Coward

      Re: Wait until the politicians' details are leaked

      See: https://use-their-id.com

  5. EvaQ

    The good news

    "We take our responsibility to protect your personal data seriously " ... so then all's good!

    /s

  6. IGotOut Silver badge

    Ok...

    "We take our responsibility to protect your personal data seriously and understand the inconvenience and concern this may cause."

    Can we make this an offense punishable by, maybe not death, but maybe just having their fingers and thumbs cut off and their tongue cut out?

    1. PhilBuk

      Re: Ok...

      Are you complaining about the offense or the shitty PR statements that they excrete after the fact?

      Phil.

      1. Stephen Wilkinson

        Re: Ok...

        both

  7. Anonymous Coward
    Anonymous Coward

    Online Security Act

    I feel safer already. /S

  8. steviebuk Silver badge

    "If you're

    against an ID system then you're on the side of the criminals" or whatever it was that foolish Labour MP said (which I now can't find anywhere and neither could chatgpt).

    THIS is the reason we don't want an digital ID system.

    Knobs.

    1. MachDiamond Silver badge

      Re: "If you're

      "THIS is the reason we don't want an digital ID system."

      Most particularly an all-encompassing system that becomes a big phat target whose data is being "shared" all over the place.

      Not only is the data vulnerable, there's not a good way to repair breeches which should the an overriding requirement. Does the government issue new ID's for everybody, provide credit monitoring service and take liability to any sort of crime that uses that leaked information?

      I see convenience as that antithesis of security in most things digital. Controls are better handled locally. When I was young, getting adult magazines wasn't easy, but with enough dedication, they could be had. Today, there's so much free smut online that requiring age verification is hopeless. The mainstream publishers will have to comply, but the oodles of other suppliers in countries that don't have much enforcement even if there are laws won't bother. One thing politicians forget is that kids have motivation and loads of time as well as a whole school or online group to sort these things out. They also forget that raising children is the job of parents and those parents need to be held accountable to do a good job of it.

    2. elsergiovolador Silver badge

      Re: "If you're

      The issue with digital ID is that this is a wedge.

      Once most people have it, the next step will be to track everyone's location and perhaps even what people talk about.

      Just perfect for the next far-right government that looks like will be coming to power.

      1. krakead

        Re: "If you're

        If you think this shit is limited to the far right, you need your head examined. Every authoritarian of whatever colour will be getting a hard-on for this.

        1. elsergiovolador Silver badge

          Re: "If you're

          I am not saying it is limited to far-right, just made an observation of likely turn of events - based on polls. Far-left would equally love it.

      2. GNU Enjoyer
        Unhappy

        Re: "If you're

        >track everyone's location and perhaps even what people talk about.

        Wow, it's libel to point out that's exactly what demon rectangles are all about (location tracking is inherit to the workings of the network and you'd be kidding yourself to think silent call functionality was about debugging only)?

        There are probably no plans to do location tracking or listening with the digital ID software - but there seems to be a reason the software is only available for iOS and non-root Android.

        Currently it appears that the UK government does not have access to such information, but I'm sure all governments will love to gain access to such information.

        All governments abuse their citizens just as hard if they get a chance to do so, whether that's a "far-right", or "far-left" or "middle" government.

    3. Dan 55 Silver badge

      Re: "If you're

      Yvette Cooper defends children as young as 13 needing digital ID

      Remember it was just for right-of-work checks.

      Or not.

      1. elsergiovolador Silver badge

        Re: "If you're

        How people constantly thinking of children would otherwise know where those children are?

        (insert Epstein remark)

    4. Anonymous Coward
      Anonymous Coward

      Re: Peter Kyle

      > (which I now can't find anywhere and neither could chatgpt

      "Kyle refused to back down after Farage's criticism, saying on social media: "If you want to overturn the Online Safety Act you are on the side of predators. It is as simple as that." "

      https://www.bbc.co.uk/news/articles/cgery3eeqzxo

      2 minutes with google, most of which was scrolling down to the BBC. I note that Google says "Some results may have been removed under data protection law in Europe", but not who might have been doing that. Chatgpt's probably better if you just want to make things up, rather than find sources.

      I haven't seen any apology or retraction from Kyle.

  9. Tron Silver badge

    Starmer Reich Fail.

    Govt demand you use age verification. And your details get leaked.

    Would be nice if at least one politician was forced to take responsibility for this and resign, but that never happens. We are just cannon fodder for their political theatre.

    So how many leaks before they cancel the whole idiot scheme and go back to the optional ISP blocks and mobile blocks that actually worked, without feeding your ID to hackers.

    1. Boris the Cockroach Silver badge
      FAIL

      Re: Starmer Reich Fail.

      you're forgetting that takes effort on the part of pa"THINK OF THE CHILDREN"rents, and they taking responsi"THINK OF THE CHILDREN"bity for their kinder, and anyway if y"THINK OF THE CHILDREN"ou're against the online safety "THINK OF THE CHILDREN"act then you're on the side of the "THINK OF THE CHILDREN" of the perverts and weirdos out to "THINK OF THE CHILDREN" corrupt our precious innocent children "THINK OF THE CHILDREN"

      Anyway , any dissent will be met with our trump card

      "THINK OF THE CHILDREN"

      "THINK OF THE CHILDREN"

      "THINK OF THE CHILDREN" etc etc etc

    2. GNU Enjoyer
      FAIL

      Re: Starmer Reich Fail.

      Censorship like site blocking does not stop people from accessing websites they really want to access - as VPNs and tor exists.

      Hackers are too busy with playful cleverness - you are thinking of crackers.

      Usually no cracking or hacking is even required - often the database simply has no authentication at all; https://mag212.com/data-breaches/inside-the-tea-app-hack-how-weak-api-security-exposed-thousands-of-users/

      With "age verification", it seems the result could inadvertently be a complete record of what sites someone has visited (simply by collecting the IDs when those leak), which could be an issue for that person if it is found out that they previously accessed a site now deemed to be "terrorist" or something.

  10. Anonymous Coward
    Anonymous Coward

    Can big corp just be honest...

    They are drooling over this extra KYC data point and are "pushing back" just because they know how toxic implementing this is.

    1. elsergiovolador Silver badge

      Re: Can big corp just be honest...

      Imagine the flood of brown envelopes, once Digital ID is implemented, to give employers location data in real-time of each employee, even on time off.

      Or future salary negotiations. Employer scans Digital ID and has view of all your finances, where you go, what you eat etc then types in to Copilot: "Does this scrote need this extra money he came cap in hand for?" and then copilot crunches the data and spits out money saving plan headed with a "NO".

      1. seldom

        Re: Can big corp just be honest...

        Copilot has learned that the "No" answer avoids subsequent queries and says "No"

  11. Doctor Syntax Silver badge

    It needs to be instil in businesses from the board down and governments from the head of government down that personal data is toxic. If you don't really need it then it's toxic waste. If it has to be handled at all then handle it as carefully as you'd handle a strongly radioactive biohazard.

    But how to achieve that?

    1. ChrisElvidge Silver badge

      Find out who in the company/government decided that it was necessary to keep all that data instead of just the relevant parts, and jail them. Make it clear that whoever collected the data is responsible for keeping it safe. It's no good saying "one of out sub-contractors leaked it." It's the collecting party's responsibility, government or corporation.

      On another tack, why should I have to provide age verification via two (or more) different age verification "authorities" just because the sites involved don't allow me to pick who verifies my age? Two sites, two different age verification methods is not acceptable.

  12. mark l 2 Silver badge

    Discord are keeping quiet about who this third party actually is and where they are even based? No doubt they went with some off shore company that promised to do it for the lowest price and now its coming back to bit them in the arse for cheaping out. But the question is are they STILL using that company for age verification?

  13. Anonymous Coward
    Anonymous Coward

    Big Picture -- STASI At Work!

    - Digital ID

    - Comprehensive car number plate scanning

    - Comprehensive CCTV and facial recognition

    - Comprehensive mobile phone scanning (two and three tower correlation)

    - Comprehensive tracking of credit card use

    - Comprehensive tracking of ATM use (with CCTV support)

    - DVLC has direct access to the Home Office passport records

    - Demands for Signal and Meta to provide "backdoors"

    - Age verification

    Do we need any more evidence that the STASI has arrived in Blighty?

    Look at the list above.......is it REALLY because someone is "thinking about the children"?

    Absolutely NOT!!

    Quote (William Burroughs): "The paranoid is a person who knows a little of what is going on."

  14. Anonymous Coward
    Anonymous Coward

    Apparently...

    - this Digital ID is being pushed by the Tony Blair Institute and associated Labour cronies ( TB having failed to get it implemented when PM )

    - it has been proposed the system be implemented by Oracle

    - Larry Ellison has donated half a billion dollars to the Tony Blair Institute

    - Ellison and Blair are supporters of the current US government

    ( ref: https://www.thenerve.news )

    1. Anonymous Coward
      Anonymous Coward

      Maybe......................

      .................Tony Blair can fix the mess in Birmingham????

      1. Like a badger Silver badge

        Re: Maybe......................

        What mess? From Oracle's perspective it's going swimmingly.

  15. cookiecutter Silver badge

    monetisation

    bets that either discord or whoever the verification outfit is was going to monitise the database, either with facial recognition or selling it to law enforcement with all the details of the discord account, server membership etc

    1. Anonymous Coward
      Anonymous Coward

      Re: monetisation

      Why are you not using present tense?

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like