[tifik]

I don't know if I just became cynical and jaded, but is this really surprising to anyone in any way? Any time I give out my personal information to anyone for any reason, I basically treat it as 'any member of public can now access it'.

Even if a service doesn't have it in their TOS that they sell it to 3rd parties, they might do it anyway, or there will, sooner or later, be a breach of their poorly secured system.

To make it clear - I don't particularly blame any one corporation, this is a systemic issue of governments not having/not enforcing serious security measures. I just completely dropped the expectation of my information being private, and for the very few bits that I do actually want to stay private, I just don't, or allow anyone to, digitalize or reproduce them at all in any way.

[SequoiaHope]

It is a common misconception that facts are reported because they are surprising. Facts are reported because they are important. More and more governments are passing age verification laws which put exactly this data in to the hands of even more shady private companies. This breach serves as evidence that those laws are misguided, and spreading news of this event may help build public support for those efforts.

[boriskourt]

This is the essential point, and why it’s always a bit frustrating seeing ‘is anyone surprised’ take come up so often here. It lowers the quality of the possible discussion by trivialising it.

[some_random]

Reminds me of the Panama Papers, which exposed a huge international money laundering/tax evasion ring that no one seemed to care about because "everyone knows they're doing this stuff"

[nomilk]

Wonder if this will cause a surge in demand for fake IDs that are sufficient for age-verification but harmless if leaked.

[consp]

In the example you give there is no needed provision to store the id or all information in the document. Only extracting the date of birth, name and document number is sufficient.

Yes I know this a utopia and it won't happen.

Edit: afaik storing the photo is only needed in medical cases to alternatively asses having the correct person. Bit much for something simple as age verification.

[monooso]

I don't think there was any suggestion that the story should not have been reported, or that only "surprising" facts should be considered news.

[iinnPP]

Things that cease to be surprising can also cease being important. Which is made clear reading the remainder of the post.

It's my take as well, frankly.

[sph]

> Facts are reported because they are important.

Without going too much off-topic: In a vacuum, you are right. In reality, facts are reported because they sell.

It is a good day when important facts like this one happen to coincide with what people what to know more about. (the recent UK attempt at stripping the rights of its citizens)

Tomorrow, people will have forgotten all about it, and the government can continue to expand its powers without anyone talking about it.

[raxxorraxor]

> I don't particularly blame any one corporation, this is a systemic issue of governments not having/not enforcing serious security measures

Wrong, governments caused the issue because they demand customers to ID themselves. There exists not a single viable security measure aside from not collecting the data. Government is also not able to propose any security measures.

Unlikely that the data will ever be deleted now, no matter if Discord pays any ransoms or not.

[mrweasel]

No, governments caused the issue by demanding customers to ID themselves, while failing to provide the necessary tooling for doing so in a secure manor.

There's really only a few countries in the world who can provide the services needed to make this work. On top of my head, Estonia, Sweden and Denmark (there's probably others).

[etiennebausson]

The companies in question could have a flag in every user data to confirm they are over the age limit.

At worse keep the birth date, since various aspect of a service can be available depending on age (and user can change locality / country, and therefore be subject to different law).

If you keep on top of it, you have at most 3 days of user's "ongoing verification" sensible data available for theft. Keeping more than that will always be an invitation to bad actors.

[sc11]

In the context of age limits, that is wrong. The German eID has a zero knowledge method of proving that your age is above a certain number without revealing anything else. That method has been around for like 15 years and these days, thanks to smartphones with NFC readers, is quite user-friendly.

In practice it's basically not used anywhere except for cigarette vending machines because it's much simpler to hire some dubious third party "wave your ID in front of your camera" service

Edit: mandatory age verification is still an atrocious idea for a number of other reasons, just to be clear

[0xbadcafebee]

It's not surprising because there's never been a significant penalty for it, I guess because everybody just got completely used to massive breaches without much reaction. But then again it's very hard to get legislation passed that's not in the interests of big business.

[SeanAnderson]

ZK proofs for identity can't go mainstream quick enough. I agree with what you're saying completely. It's frustrating that we have the technology now to verify aspects of someone's identity without revealing it, but that it's going to take forever to become robust enough for mainstream use.

[xyzzy123]

It's an interesting litmus test because regulators would not accept ZK age proofs unless the stated purpose of age verification laws (reduce harm to minors) is the _actual_ purpose of those laws.

Not some different unstated goal, such as ending online anonymity.

[mindslight]

That does not work without treacherous locked-down hardware. The marketing by Google et al is leaving out that fact to privacy-wash what is ultimately a push for digital authoritarianism.

Think about it - the claim is that those systems can prove aspects of someone's identity (eg age), without the site where the proof is used obtaining any knowledge about the individual and without the proof provider knowing where the proof is used. If all of these things are true while users are running software they can control, then it's trivial for an activist to set up a proxy that takes requests for proofs from other users and generates proofs based on the activist's identity - with no downside for the activist, since this can never be traced back to them.

The only thing that could be done is for proof providers to limit the rate of proofs per identity so that multiple activists would be required to say provide access to Discord to all the kids who want it.

[raxxorraxor]

You mean not collecting IDs is the real answer. Easy solution is the best solution and it already is mainstream.

This is an example why that was a bad idea in the first place. No damage control for bad solutions will change that.

[immibis]

Anonymous proofs of age don't work, because (in theory) I could set up a server, plugged into my ID chip, that lets anyone download age proofs from me, and then anyone can be over 18. They don't just need to know someone is over 18 - they also need to know it's the same person using the website.

[eleveriven]

What's wild is that the burden keeps falling on individuals to be ultra-cautious, while the systems handling the data rarely face meaningful consequences

[bsimpson]

For years, I resisted TSA Pre check on principle, even though I was a frequent traveler. I finally relented when I realized there were places like Thailand that force you to give your biometrics, and almost certainly sell them back to shadowy US agencies.

[weird-eye-issue]

They might not be competent enough

https://www.scmp.com/week-asia/politics/article/3300568/thai...

[jonasdegendt]

> places like Thailand that force you to give your biometrics

You're being returned the favor! Anyone that's ever entered the US has had to do the same, and our prints are being stored in a DHS database.

Out of curiosity, did you not need to provide prints to get a passport in the first place? I can't image a single developed country without biometric passports.

[L-four]

Developer time is more valuable than user data. The market is being efficient.

[kalaksi]

I think you're assuming an ideal world where there's no information asymmetry, all the market participants receive and understand all the information and the risks, and clients could realistically move to an alternative platform that provably handles things better.

[baobabKoodaa]

Externalized costs aren't weighed in that calculation

[hulitu]

No.Just greedy.

[codedokode]

Also this is an issue with people willing to send important documents to some company with which they do not even have a written agreement.

[fourside]

A big problem is that the Silicon Valley playbook drives companies like Discord to be winner take all. It’s hard to avoid using them, but then they require that give up sensitive documents. I shouldn’t have to choose between keeping sensitive documents private and being able to participate in most gaming communities. Some open source projects have also starting adopting Discord to manage their communities.

[01HNNWZ0MV43FF]

I'm not willing, I just don't have a choice. The US should regulate it from the top down like Europe does

[Forgeties79]

I told the 2 servers I hang in about a month ago that if I randomly disappear it’s because I can’t login without an ID and I’m simply not doing it/that they should consider the post my preemptive “goodbye.” I included where to contact me for those who want to. Frankly I think anyone on discord should do the same

[abustamam]

There's a surprising amount of people pro-age verification in this thread https://news.ycombinator.com/item?id=45424888

(I don't really want to call out specific comments)

So I'm sure this article may be surprising to them.

[somenameforme]

> "or there will, sooner or later, be a breach of their poorly secured system."

It doesn't even need to be poorly secured. The oldest form of hacking is social engineering. If a company is storing valuable enough information, all one needs to do is compel the lowest common denominator with access to it to intentionally or inadvertently provide access.

You can try to create all the sort loopholes and redundancies but in general the reality is that no system is ever going to be truly secure. Another reality is that many of the people with the greatest level of access will not be technical by nature. For instance apparently the DNC hacks were carried out by a textbook phishing email - 'You've like totally been hacked, click on this anonymizer link to leads to Goog1e.com so we can confirm your identity.'

[yibg]

I blame companies (including discord) for collecting as much information as they can instead of as little as possible. More data collected -> more data that will eventually get sold / leaked / hacked.

[petre]

Don't governments require them to chech people's IDs to make sure they aren't kids?

[southernplaces7]

I very much do blame the corporations and governments that push for these kinds of policies in some way or another.

We see things like this, which happen about as often as fucking rainfall in a mountain forest, and then also see the ever increasing push towards ID verification by corporations and government organizations that pinkie-promise to secure or not retain any of the personal data you were wrist-burned into handing over to them.

What a toxic mix of garbage that becomes. The result is crap like the above, making the internet ever worse and basic personal data security (to not even speak of lofty things like digital privacy and using the internet anonymously) pretty much null and void even if you really do try to take the right steps.

[Braxton1980]

>I very much do blame the corporations and governments that push for these kinds of policies in some way or another

71% want age verification

https://www.pewresearch.org/short-reads/2023/10/31/81-of-us-...

How that's done is the issue but you can't blame the government and corporations from making it happen.

[eleveriven]

It's really just creating massive honeypots of sensitive data that will eventually leak. And when it does, the consequences are always on us

[NoSalt]

> "this is a systemic issue of governments not having/not enforcing serious security measures"

Is it this, or is it a "systemic issue of governments not minding their own damn business"???

[paganel]

If “serious security measures” involves anything to that 2fa authentication that any normal person hates with a passion then you can forget about it.

The real, long term answer to all this consists in having less of our lives in digital presence, that even means less digital government thingies and, yes, less payments and other money-related issues being handled online.

[cookiengineer]

Honestly I don't understand why so many things are tied to one secret _that you have to share with others_ all the time.

Why is there no rotation possible? Why is there no API to issue a new secret and mark the previous one as leaked? Why is there no way to have a temporary validation code for travels, which gets auto revoked once the citizens are back in their home country?

It's like governments don't understand what identity actually means, and always confuse it with publicity of secrets.

I mean, more modern digital passports now have a public and private key. But they put the private key on the card, which essentially is an absolute anti pattern and makes the key infrastructure just as pointless.

If you as a government agency have a system in place that does not accommodate for the use case that passports are stolen all the time, you must be utterly out of touch with reality.

[gloosx]

Governments don't get a damn thing about the internet. They just want to govern, and justify the spending.

Their goal is not to build resilient systems — it iss to preserve control. The internet was born decentralised, while governments operate through centralised hierarchies. Every system they design ends up reflecting that mindset: central authority, rigid bureaucracy, zero trust in the user.

So instead of adopting key rotation, temporary credentials, or privacy-first mechanisms, they recreate 1950s paperwork in digital form and call it innovation.

[AlienRobot]

I don't think you have become jaded. It's just the truth of the internet.

If you upload anything to the internet, it's public. Even the passwords you type are potentially public.

[rwky]

Same. I automatically assume that all information I send to any organisation will end up on the Internet sooner or later be it by accident or sold to some shady third party.

[nirui]

> I basically treat it as 'any member of public can now access it'.

Still remember the conversation over "mega apps"?

Based on my experience with Alipay, which was a Chinese financial focused mega app but now more like a platform of everything plus money, the idea of treating every bit information you uploaded online as public info is laughable.

Back when Alipay was really just a financial app, it make sense for it to collect private information, facial data, government issued ID etc. But now as a mega app, the "smaller app" running inside it can also request permission to read these private information if they wanted to, and since most users are idiots don't know how to read, they will just click whatever you want them to click (it really work like this, magic!).

Alipay of course pretends to have protection in place, but we all know why it's there: just to make it legally look like it's the user's fault if something went wrong -- it's not even very delicate or complex. Kinda like what the idea "(you should) treat it (things uploaded online) as 'any member of public can now access'" tries to do, blame the user, punch down, easy done.

But fundamentally, the information was provided and used in different context, user provided the information without knowing exactly how the information will be used in the future. It's a Bait-and-switch, just that simple.

Of course, Discord isn't Alipay, but that's just because they're not a mega app, yet. A much healthier mentality is ask those companies to NOT to collect these data, or refuse to use their products. For example, I've not ever uploaded my government ID photos to Discord, if some feature requires it, I just don't use that feature.

[HeavyStorm]

Couldn't agree more, save for your last sentence. How do you avoid that? We need to provide o Digital papers to a number of different people for proper handling

[stackbutterflow]

For us it's too late. But we must push for better laws and build better systems for those that come after us.

[andsoitis]

> this is a systemic issue of governments not having/not enforcing serious security measures.

To do so seems impractical. Imagine the government machinery that would be required to audit all companies and organizations and services to which someone can upload PII.

Not tractable.

[austhrow743]

The systemic solution wouldn’t be to do that. It would be to both remove their own requirements that organisations collect this data, and to penalise organisations for collecting it outside of a handful of already heavily regulated industries like banking.

[aydyn]

The enforcement could be done by incentives, making sure the penalty for such breaches is large.

[stackbutterflow]

Audit at random? With severe penalty in case of non compliance.

[troyvit]

> I just completely dropped the expectation of my information being private

There are all the reasons in the world to feel that way. The scary thing (says troyvit as he passes out the tinfoil hats) is that privacy laws are all about an "expectation of privacy." In other words we all expect privacy when we're in our bathrooms, so government surveillance in the bathroom is hard to justify. Now that there are cameras in supermarket checkouts, and we all expect them, legally that's no longer a privacy concern and we can't claim that our privacy is being unreasonably infringed.

And what you're saying is that now we've reached the stage in history where through incompetence and greed we shouldn't expect any privacy anyway, and that opens the door for all kinds of surveillance because our expectations have fallen so low. I'm not a lawyer btw so take it all with a grain of salt.

[johndhi]

You really think governments could write rules that would help this?

The only rule I can imagine is big penalties for data being breached, no matter the cause, but do we actually think it's a multi million dollar problem for 70k photos to be released? Hard problem.

[Gigachad]

It’s surprising that it happened to a big name like Discord in this day and age. Huge data breaches of large tech companies are becoming increasingly rare as security in general is getting better.

[Suzuran]

Penetrations of this sort happen differently.

If I want the ID of a bunch of Discord users, I don't go after Discord directly, I find some bot that the targeted users have on their discord servers, or third party service that Discord uses themselves. Then I find some individual person with access to those things, and I harass and/or threaten that person until they give me what I want to make me go away. If I think they might be crooked, I might just offer them a cut of the take. I'm probably not paying them though, not unless I think I can leverage them against other targets and need to keep them around.

Either way, an individual person isn't going to be able to hold off a coordinated attack for very long, and law enforcement generally doesn't give a shit about internet randoms attacking individual people.

[eviks]

It's getting better, but never reaching good, so still no surprise

[tacticus]

i mean it's only every other week we see orgs like TCS handing out admin

[hulitu]

> Huge data breaches of large tech companies are becoming increasingly rare as security in general is getting better.

Citation needed. /s

cough Microsoft cough