> The ID is immediately deleted. We do not keep any information around like your name, the city that you live in, if you used a birth certificate or something else, any of that information.

This is also contradicted by what Discord actually says:

> Quick deletion: Identity documents submitted to our vendor partners are deleted quickly— in most cases, immediately after age confirmation.

What are the non-most cases?

Also, _Discord_ deleting them is really only half the battle; random vendors deleting them remains an issue.

Not to mention collecting them at all means those servers are a primo location for state actors to stage themselves to make copies of data before being deleted.

To say nothing of insider threats of which likely exist across every major social media platform in service to foreign govs.

It was this deep into the thread when I decided I don’t think I need internet service this bad, let alone Discord. I think I’m out. Let us know how it goes!

All of these types of developments, of the trap door starting to close, really do totally depend on the addiction, the dependency that was created to make sure the people would be unable to withdraw themselves. We now have some generations of people who have only been online and in a fantasy world of games and “TV”. It seems the system has calculated that we have crossed the threshold after which the system is self-reinforcing and there is very little chance of effective resistance, let alone reversal.

I think you may be attributing far too much malice of forethought to any them that may be conspiring to design the 'system'

Everyone thought that we were designing the system, but it's really been the system designing us.

(Only half joking; the medium is the message, and changes us as much as we change it)

malice aforethought

I’m not sure how to really get this point across, but you would be very incorrect believing that and I have first hand knowledge of that.

Yes, it’s not a waterfall methodology/system like some Soviet central committee planned economy, but what else do you call things like the kill list board meetings of the Obama administration, if not malicious and with forethought? They had lists, they decided on who to murder, they broke to accomplish their weekly objectives and then they reported on their progress every week. And that’s just a tiny snowflake on top of the iceberg of what is available for anyone in the public all around the world to know, even without any kind of special access other than an open mind willing to accept reality that is not what one was told it is from childhood on. You know, when people are the most vulnerable and easily manipulated, the MO of the people like Epstein.

Is not even that the information needed to understand these things are not all there in public agreed caps leaks and releases, it’s just that most people seem to just want to accept that 2+2=5 and in exchange live a life they believe is a good deal from the devil.

You seem to represent one of those people who has no idea what you are a part of, similar to how an animal born into a zoo is quite content since all his needs are met. That animal cannot understand any bigger context, because all it’s ever known is that cage it’s always been in all your conscious existence.

All the information you need is publicly available to you even without any clearances, on the internet (for the time being). What is your excuse for not knowing, e.g., that effectively all NGOs are a tool of the CIA? Or what else would you call the Obama kill list meetings where, just like how you may have weekly sprints, they picked from a backlog and then killed them and reported back on progress; if not malicious and with forethought?

Reality simply is that the majority of people are like those peasant masses that applauded Obama at the Winter Olympics; the same malicious, deliberate murderer with forethought and with a kill list that we know he was. What are you?

> write a mildly unhinged internet comment that tries to shame people for not knowing the true conspiracy all around them. Use themes like sheeple and kill squads. Explicitly call out Obama and only Obama and make sure you repeat one claim about Obama at least three times.

> Not to mention collecting them at all means those servers are a primo location for state actors to stage themselves to make copies of data before being deleted.

Not to nitpick, but in this case they'd be collecting data they already own.

The feds don't own state IDs in the US, at least.

1. Foreign state actors

2. Inter-hostile agencies within the u.s.

In addition to the sibling comments, even if they do own the ID itself, they do not own the association with Discord users, and the ID might also be faked.

For state actors - they frequently have issues "connecting the dots". Or heck - maybe connecting the dots is easy but it's a manual process that introduces too much friction for them to do casually. Maybe some of the data they connect it with is not trustworthy.

If the dots already come pre-connected, it makes the job easier.

Not to mention its value as blackmail material shoots up because it comes pre-associated with your government ID and/or a scan of your face because fewer sources/methods need to be risked.

I am pretty sure US gov doesn't have my id.

Weird that I have to get a list of all the cookie vendors that know I visit a website to show me an ad about something I already bought but the guys with my ID don't need to be listed.

Under GDPR they need to be listed.

GDPR isn't a cookie law — it's a PII law. They need to tell you all parties that get your ID picture, or they're in breach.

GDPR is not a PII law. The term is not mentioned once in GDPR. GDPR speaks of "personal data", which as Wikipedia puts it "is significantly broader".

Doesn't PII, mean personal information which is is another term for personal data?

Personally Identifiable Information is about data that can identify you personally. Personal data might be something you don't want to share but is not necessarily identifying you

"We delete them immediately after we have sold them to our 579 parters"

Vendors like that would be in deep GDPR shit if they claim to not store highly sensitive data and then do in fact store highly sensitive data.

Generally the GDPR is not rigorously enforced, but when it comes to sensitive data like face scans, IDs, medical data etc. the hammer comes down a lot swifter and harder.

GDPR does not stop a breach.

Discord already lost user IDs. Will GDPR delete them from the darknet?

> Also, _Discord_ deleting them is really only half the battle; random vendors deleting them remains an issue.

This really is the issue. Of the 5 or so data breach notifications I received last year, none are from an entity I have a direct relationship with. They're all from a vendor used directly or indirectly by these entities.

The real answer is more serious penalties for having data breaches. Having 6 concurrent "identity monitoring" services is of zero value to me.

Since when the city one lives in is mentioned in the birth certificate?

It was only one example they gave, and they accept multiple different types of ID; a driver's license or national ID card being other likely ones, and DLs do say where you live.

None of those documents reliably state my city of residence. At best they document where I once lived, but not even that is guaranteed.

You are legally required to update those within 10 days of moving.

Not updating your DL after changing your address is a crime* in all US states. I'm not as familiar with law elsewhere, but would be surprised if that's not true most other places.

*There are exceptions for active duty military personal and other limited exceptions.

That's pathetic. It would mean you can't live anywhere without a street address, such as a camp site or a ship. You also can't be a nomad.

So much for "land of the free".

Unless you’re wild camping, campsites have addresses. So do marinas where a ship would need to be docked more or less regularly to establish residency.

As for being a nomad, you don’t need a driver’s license or any kind of ID to wander if you’re willing to sleep rough. If you want to drive on public roadways though, you better have a primary address where the courts can send someone if you kill someone in a traffic accident and bail.

Docking is expensive, so no. It's also only needed once per 5 years or so for maintenance.

Government fining you a ticket doesn't mean your address has to be on the drivers license. They could register the number plate to an SSN for instance.

[delayed]

Bailing from a traffic incident is a crime itself. Good luck getting away with that.

And why would someone not get their SSN if they're old enough to drive?

- some resident aliens (if not authorized to work), B-1/B-2 Visitors, WB/WT (Visa Waiver Program), nonresident aliens

- their spouses and dependents e.g. F-2 Dependents, J-2 Dependents, H-4 Dependents: of H-1B, H-2A, H-2B, or H-3 visa holders.

- Undocumented immigrants: Individuals without lawful status who have a US tax filing requirement.

Read "Who's eligible for an ITIN" https://www.irs.gov/tin/itin/individual-taxpayer-identificat...

In some places in the U.S. it is (or at least was until recently) illegal to be healthy and unemployed.

For most situations where you don't have a permanent address, your address is either the place where you receive mail or the courthouse.

And if you don't have a place to receive mail?

Receiving mail is a requirement for participating in the legal system, which is a requirement for citizens.

Laws of the government can't override laws of physics. If you don't have a place where you can receive mail, do they just arrest you or what?

If you fail to comply with legally delivered court messages (to your registered mail address), then yes the police is going to fetch you.

America is one of the least free countries — they think they're free because the guns=free principle is drilled into them since birth, but it's a lie.

It is a law but rarely enforced, also some places like Washington are primarily digital meaning you update your DL address online but they don’t print a new ID unless you request it or your DL is expired

What kind of tyranny do you live in? None of the documents I have on me say where I live.

It's pretty standard in a lot of Europe, one is required to update ones license with each change of address (although many people don't).

Along with such weird (to us) things as applying for an exit visa from your current town when you want to move to a new town...

Which parts of Europe have a town of where the person lives on their driving license? And what do you mean by “us”?

My Spanish identity card has my full address. Not sure if the DNI does as well, or only the foreign resident version.

> And what do you mean by “us”?

US folks are pretty used to being able to up and drive across the country with a suitcase, without filing any paperwork (at least till the taxman comes knocking next April)

I ask you about drivers license, you tell me about the national ID.

You did not ask about driver's licenses. You asked about "document I have on me".

Many people in many countries carry their national ID card in instances where Americans would carry their driver's license.

(And, to be clear, if you are American and drive, your driver's license contains your address.)

Have to get your vehicle registered in your new state as well (if you own one) as well as your driver’s license. God help you if your vehicle is towed and your license/vehicle is not registered in the current state. Absolute mess.

UK driver's licence has my full home address on it. Come to think of it I think my Polish one used to as well.

Germany has the full address the ID card and the issuing office (containing the city) on both the driving license. They are also digital so who knows what they also store on them.

Australia and UK goes the full distance. Your full address: https://en.wikipedia.org/wiki/Driver%27s_licences_in_Austral...

Well since you have these IDs, for national security (AML, criminals and whatnot), we will need you to keep them if our endpoint says so, here's the endpoint

    https://.gov/print?text=true

>"Identity documents submitted to our vendor partners"..

Yeah, say goodbye to those the privacy and safety of those documents.

How can we even confirm that they are actually deleting them. Trust me bro vibe

Imagine the neural network you could train over such a large dataset of ID's so when you pay your bills or do the flight check-in you avoid the hassle of manually inputting the data yourself? Ah, yes, we have that already.

And do they really actually delete it this time?

I have it on good authority that they really truly delete it this time, super duper pinky promise

Once it's out there the only assumption that holds is no trust, and therefore all bets are off.

>Why they didn't do that the first time?

The company they hired to do the support tickets archived them, including attachments, rather than deleting them.

Ah, so it was the "staffer" excuse.

rogue engineer

How convenient.

Ah sorry our contractor did all that highly illegal stuff. Too bad we can't pierce the corporate veil anymore... shucks.

> The ID is immediately deleted.

I call it bollocks. Likely they have to keep it for audit and other purposes.

"delete" doesn't mean delete anymore, like you say, there are always audit logs, and there is "soft" deleting.

Expect any claims that things are being deleted to be a bold faced lie.

We deleted it from someplace. It's not our fault we have more places!

They wouldn't _have to_, audit checks if you stick to law, your own policies and such, but I think they will.

So how do they prove they actually checked someone's age?

They don’t need to prove that. The government or whatever would have to prove that they aren’t checking ages, by going to the site and seeing a lack of age verification.

How does shop clerk proves they checked someone's age before selling them alcohol?

They're a nonsense company, and trusting them with any information is foolish. They'll store everything and anything, because data is valuable, and won't delete anything unless legally compelled to and held accountable by third party independent verification. This is the default.

The purpose of things is what they do. They're an adtech user data collection company, they're not a user information securing company.

I believe the original finding was that they were not deleting IDs that were involved in disputes.

They explained it in their announcement at https://discord.com/press-releases/update-on-security-incide...

TL;DR: The IDs were used in age-related appeals. If someone's account was banned for being too young they have to submit an ID as part of the appeal. Appeals take time to process and review.

Discord has 200,000,000 users and age verification happens a lot due to the number of young users and different countries.

Why should we suspect the age verification and age-related appeals would involve different teams or processes?

Age verification is done by an iframe to k-id.com.

Appeals are done in the actual Discord ticketing system.

Appeals are like escalations. They bypass automations and move to manual review.

This is corporate cover speak for “we keep all data”

Yeaaah, nope.

GDPR is no joke and storing people’s actual ID card photos is a gigantic liability. Companies treat that stuff like it’s toxic waste, they want to get rid of it as fast as possible and permanently.

How come they didn’t do that the first time? There’s really no guarantee this time will be different or that the 3rd party is any better.

We’re talking about Discord. The same people who put everyone’s “server” as a chat room on WebRTC.

They don’t share your same sense of toxicity.

Maybe that's generally true but you're saying that about a company that has leaked 70,000 IDs that were supposed to not exist just last October.

And yet...

So Discord only just survived financially because of heavy fines imposed from their earlier breach of trust? All their C-suite were fined commensurate with their remunerations+wealth?

Uh... EVERYONE with a Discord account has to go through age-related appeals now. That's what the announcement is.

Compliance

Liars…

> The ID is immediately deleted. We do not keep any information around like your name, the city that you live in, if you used a birth certificate or something else, any of that information.

Everyone says this, including the TSA. But they never say they don't keep a hash, or an eigenvector of your biometric. Which is equally as important.

They also never say it goes through datacenters in room 641A or though Utah before it's "deleted", because it's a US company and they can't refuse that.

In case someone is unaware, 641A and Utah and both references to the US mass surveillance systems in this context. Specifically interceptors that a company wouldn't be able to prevent from saving your data for the few seconds they need to process and delete it

I might be misremembering, but AFAIK, that kind of surveillance mostly worked because many companies didn't bother encrypting datacenter-to-datacenter traffic, thinking that those networks are trusted. That mistake has since been rectified though.

With almost everything going over TLS these days and HTTPS being the norm, even for server-to-server APIs, it's much harder to snoop on traffic without the collaboration of one of the endpoints, and the more companies you ask for that kind of collaboration, the higher your risk of an unhappy employee becoming a whistleblower.

That's also about US companies that can't refuse or can't bother to challenge that a dragnet is set up in their process.

ISPs themselves didn't save any data. However, they gave interception rooms to the NSA (which is indeed technically not them).

Nowadays ISPs aren't the right scale to do it for the reasons you mentioned. But the USA lowkey moved the dragnet to the main datacenters with prism, then made it mandatory for all with the CLOUD act.

And if the threat is not coming from the USA, but some other country starts to ask Discord to BCC them the IDs of their citizens, we can do the odds on whether Discord will challenge it or not.

Now I want to ask Discord who is their third party provider ? Why don't they process IDs themselves ?

edit : I didn't expect for links between that third party provider and Palantir to be exposed within a week

I lost all trust in discord

> it's much harder to snoop on traffic

Unless you have a master key which decrypts all traffic.

That is not possible with modern TLS 1.3, which mandates perfect forward secrecy.

Unless you use Cloudflare (or roughly any other DDOS protection system), in which case you're letting those companies MITM all requests on purpose. Protected between you and Cloudflare by PFS and any other acronym you like.

I think the odds that Cloudflare hasn't been forced into data snooping by the government are approximately zero. It's the by far the biggest, juiciest target.

Until we have some kind of "One Time ID Verification" service that would work, the ID will never be deleted. Or a hash of the info or some kind of identifiable info.

Humm yeah, like a government digital ID of some sort. Except people go mental about that, so sending scanned copies of my personal ID documents to every bank/solicitor/estate agent/mortgage broker/random internet service it is then...

Or if they don't need your ID.

Sigh, I guess it's time to move platforms again or get your identity stolen. The more a company makes a fuss about trusting users, the more likely they store all of their shit in plaintext with vibe coded server security.

> We do not keep any information around like your name

But they might be sending a copy to the NSA, similarly to how Alphabet, Yahoo, Apple, Meta etc. have been doing (PRISM program, part of the Snowden revelation [1]). The US has the legal mechanisms of requiring this to happen, secretly, such as NSLs [2].

[1] : https://en.wikipedia.org/wiki/PRISM

[2] : https://en.wikipedia.org/wiki/National_security_letter

I bet the NSA does not even require their cooperation. They are probably already inside their systems.

Deleted from some location or purged from their entire system?

> We do not keep any information around

... "around"