> Chat apps use Identity to verify bots and prevent bad bots from spamming real users.

Is bot spam rampant on discord or something? Are less invasive forms of verification (eg. SMS, credit card, or requiring a deposit) not enough? Can it not be solved via technical means? eg. requiring users to opt-in before receiving messages from a bot?

> And shipping services use Identity when a user is suspected as a fraudster—to double check before creating fraudulent shipping labels.

Yet I can buy hundreds of dollars of goods off amazon (or any other e-commerce site) without uploading my ID and giving them a live video feed of my face.

For both of these use cases, I don't doubt that ID verification provides benefit, I just find the privacy tradeoff to be unacceptable. As an analogy, a store can probably cut down on shoplifting if they performed ID checks at the entrance and kept a visitors log, but I think most people would find that unnecessarily intrusive and would refuse to patronize that store.

>Is bot spam rampant on discord or something?

It definitely is. If you don't turn off DMs from all the public servers you're in you'll inevitably be hit with the crypto spam bots.

There's also the issue of bots silently sitting on servers and logging all chats, user statuses, etc.

And yet other websites (ex HN, Stack Exchange) manage to combat such spam without ID.

> bots silently sitting on servers and logging all chats

Anyone who thinks this isn't happening in every public communication channel is hopelessly naive.

> If you don't turn off DMs from all the public servers you're in you'll inevitably be hit with the crypto spam bots.

The ones that aren't marked as bots and wouldn't have their identify verified anyway?

I am on several discords and get 4-5 messages a day from crypto pumps and other spam.

This doesn't seem like it works.

Those are usually from automated user accounts, not actual bots.

But doesn't that prove the ineffectiveness of requiring KYC in this case? Bad actors will just scrape the private API, bypass the verification and do their mischief, while good users who want to create bots now have to compromise their privacy by providing identity information.

And the difference is?

Bots are officially sanctioned as such and have an application ID in the developer console as well as a label in the client. Alternatively, nothing's stopping someone from taking a user account's authentication token and making the same calls, but that's against TOS (Discord calls them selfbots). The KYC they use won't protect against this kind of abuse.

Not to mention the possibility of a widely deployed moderation bot being used to attack the servers/channels they're running on, en masse.