We’re launching a revamped, privacy-focused age assurance solution including methods that won’t require an ID or selfie. Here’s how it works.

123 points•meetpateltech•8 days ago•88 comments•

88 comments

ashleyn8 days ago
One major controversy I recall with VRchat's implementation of age assurance (via Persona) is that they retained identity of who you were after completing the process. Not who exactly, but your identity was hashed so that if the same person attempted to verify again they could tell who it is. This effectively meant one individual can have one validated account per lifetime. If the flakey AI moderation banned you for an emoji combination freshly deemed racist/etc, you effectively lost your only shot at a validated VRchat account forever.

This is an issue with age assurance that goes well beyond just verifying age, and is undoubtedly viewed as a fringe benefit of age assurance for those wishing to deanonymise the internet. There's obvious problems with this beyond just "can't ban evade anymore". Authorities or intelligence can run bulk hashes against sets of IDs to effectively deanonymise all accounts.

The question here is, does Discord do the same thing for any or all of the selected options? Or is identity data full well and truly purged once the outcome is determined - no hashing, nothing retained other than the result?

linkregister8 days ago
Discord offers age verification via AgeKey [1]. Reading their privacy policy, one can create multiple AgeKeys based on the same identification or face scan. Each AgeKey is stored as a passkey and not persisted anywhere else. The privacy policy indicates that the identification information is submitted to 3rd party providers, and also appears to be used for general internet company marketing and promotions, similarly invasive to buying a pair of shoes online. That is, your identity will be propagated to ad networks by AgeKey as it similarly does for ecommerce.

Discord cannot determine identity from the AgeKey.

1. https://agekey.org/

m4rtink8 days ago
Given Persona is involved (and thus also Thiel and Palantir) expect everything to be store for ever, sold for profit and misused agains you in the worst way possible.
StanislavPetrov8 days ago
>The question here is, does Discord do the same thing for any or all of the selected options? Or is identity data full well and truly purged once the outcome is determined - no hashing, nothing retained other than the result?

What they actually do is irrelevant since none of these companies should ever be trusted to do what they claim they will do.

rockskon8 days ago
Unacceptable.

There is no legitimate reason to impose age verification on users in jurisdictions that do not legally mandate it.

It is a risk to the privacy and safety of all users on the platform - it provides an easier way for pedophiles to identify underage users and provides more doxable information.

Discord has no business making this decision on behalf of jurisdictions that do not legally mandate it.

Grombobulous8 days ago
> it provides an easier way for pedophiles to identify underage users and provides more doxable information.

Do you have any basis for assuming that that users who are under 18 will have that information revealed to other users? That’s not what I read in this article.

I also think you’re being quite prescriptive about a private commercial service. You’re entitled to your opinion, of course, but companies enact restrictions to their products and services not required by law all the time.

If Discord wants to make their service require a mandatory declaration of allegiance to the Klingon empire, they’re allowed to do that.

hananova8 days ago
It’s actually trivially easy to detect if someone isn’t verified adult: If you DM them something normal it’ll go through, but if you try to send them any image marked as spoiler it’ll show you an error, and they don’t see anything.

So yes, it’s super easy for groomers to focus on children with this update.

iAMkenough8 days ago
You don't have to be a user to be a pedophile. Could be a developer too, seeking the attestation for users to target.
ravenstine8 days ago
I totally agree. At the same time, nobody should be using Discord anyway, for a variety of reasons. They're one of the least trustworthy online platforms I can think of, and have unfortunately encouraged online ecosystems where you have to "Join our Discord" in order to maybe be heard. I would be delighted if age verification encourage more people to abandon Discord. In a better world, companies like that wouldn't be allowed to become zombie corporations but instead be forced to go out of business.
hax0ron38 days ago
What's untrustworthy about them? I enjoy using Discord, so I should probably learn about that.
m4rtink8 days ago
Not to mention it is a total silo that is not indexed by search engines and protected by archive.org - one day when Discords VC money finally runs out, it could all vanish in an instant, destroying communities and a lot of culture.
hatsix8 days ago
There are several jurisdictions that require companies to ensure that age limits are not bypassed via VPN or anonymizers. This puts the companies in a catch-22, block all VPN and anonymizers access, restricting many people with no recourse, or applying the age rules unilaterally, restricting some teens, but giving recourse to adults using VPNs.

It is not, as you say, "a risk to the privacy and safety of all users", but rather just those marked as needing to verify.

Your hyperbolic rant is uninformed and tiring.

rockskon8 days ago
So why not apply the age verification check to known VPN services and leave residential IPs alone? Laws from one country can only apply to another country to only so much of a degree.

I did not limit my statement to "people providing their government ID are at risk" or some equivalent for a reason. Bootstrapping the service for accounts it flags as adult now completely leaves all future services who have no pre-existing userbase to behaviorally profile - facilitating an industry norm that age/ID verification should be expected going forward is, and I repeat, a risk to the safety and privacy of all users.

Don't strawman an argument next time as "uninformed" lest you reveal just how many false assumptions you were making in arriving at that conclusion.

seany8 days ago
irc + jitsi. The only options are things incapable of complying to this fucktardedness
senectus18 days ago
i dont like it, but.... its their platform. Dont like it, dont use it.

I think i'm going to run down the dont use it path, which is a shame, because i do use it atm.

mysterydip8 days ago
There’s secondary effects from not using their platform to consider as well. There’s several applications (open and closed source) I used recently that moved all their support (email/forums) to discord.
peri-cl8 days ago
> "We're launching this over the course of this week, so it may take a few days to reach your account."

That's obviously not a technical requirement; they're doing this because they expect a large volume of negative publicity, and temporally staggering this rollout means users are less able to coordinate their social-media outrage.

Same logic Reddit used in phasing out the rollout of their controversial login wall. One group says "I can't log in!"; the other says, "huh, it works for me?"

Scaled8 days ago
They will also likely dial up the sensitivity of the system over time. Maybe initially 90% of users are let through without doxxing themselves, like Discord claims. But over time, they have the knob to turn up the sensitivity to get more verifications so eventually everyone is verified. They love to exploit the network effect of making people think they're missing out while all their friends are in, exact same strategy they've used for years with the sudden demand for phone numbers on good standing accounts.
xboxnolifes8 days ago
Discord does gradual rollouts for all of their updates. It's always the case that I will have a feature before my friends, or they will have it first, or it's only on mobile first, etc.
UqWBcuFx6NV4r8 days ago
What? No. It’s just one week. If anything it’d prolong the outrage. Gradual rollouts are what responsible development teams do. When did this stop being Hacker News?
rustcleaner8 days ago
IRC plus GNU Jami are still freedom respecting zones! I sincerely hope all this age verification crap causes cypherpunk FOSS solutions to grow in popularity.
noosphr8 days ago
Just remember that systemd added age verification in Linux without anyone asking.

There are freedom respecting Linux projects, but those lead by redhat\ibm employees (past and present) don't.

Grombobulous8 days ago
The age verification API in operating systems is a really good idea for privacy and parental control, so long as it doesn’t require literally collecting your ID (it doesn’t).

Look at it from the perspective of a parent giving a device to a kid. Before, you’d have to deal with a maze of blocking content. You’d have to allow/blocklist a huge number of apps and services manually. If your kid discovers some new one you or your blocking service has never heard of, they’ve gotten around your parental control wishes.

With the age verification API, you just set the age in the OS (and lock it down with MDM or whatever) and now all the apps and websites have to respect it and act accordingly.

Your kid can’t just make a new account or download another browser or do some other crazy workaround to get around your restrictions. That setting is there at the OS level.

rustcleaner8 days ago
It can be extricated, or bypassed. The benefits of FOSS are myriad.
marsbars2418 days ago
It’s systemd. They seem to be making it their mission to windows-ify Linux anyways.
UqWBcuFx6NV4r8 days ago
…No they didn’t. It wasn’t verification. It was essentially a new setting. Stop fear mongering.
rrego8 days ago
Its just a system that optionally exposes a birthday read from a json db. You don't have to use it, and you don't have to use applications that rely on it. And if you are going to use applications that have an age verification, this is a pretty serviceable standard.

I don't understand the uproar. Systemd isn't perfect but it gets so much hate for the value it provides

thetallguyyy8 days ago
It won't. Most people don't care about privacy or FOSS. I've been trying to get my friends to switch to something else for years, and they couldn't care less.

ID verification is the least of my worries, to be honest. I've been on the internet long enough to acknowledge a need for something like that. I'm uncomfortable with the fact that data is a valuable commodity now. Discord is storing my online habits and conversations somewhere on their servers. Deleting that information is deleting money.

If people weren't worried about that before, then they certainly won't care now.

VCFundedGenYer8 days ago
You're quite wrong in your assumptions. Most Discord users are moving away from the platform. Fluxer is gaining traction very quickly.
account428 days ago
What is GNU Jami and why does the website [0] look like that of a commercial startup with mandatory AI mentions (OpenClaw Plugin) an a commercial version (or at least commercial support?) but without much information about who this is from except a link in the footer to https://savoirfairelinux.com/en which is another standard marketing landing page that says absolutely nothing except that they do AI. How does the GNU project and the FSF fit into this.

Is this an AI slop startup larping as a GNU project?

[0] https://jami.net/

iwontberude8 days ago
Matrix has become invaluable for dozens of my hacker friends. We ditched Discord almost a year ago and we have no desire to go back. Besides having high quality e2ee voice/video/screensharing (thanks LiveKit), we collectively spend 10x less for the functionality and keep our data in Switzerland. No ads, no one getting their accounts hacked with QR codes, ultra-granular space/channel settings, multiple choices for client implementations, and end to end encryption enables sensitive discussions that would have previously been curtailed. The identity verification is greatly appreciated although our new users do have some issues getting set up with multiple devices, but it's no more complicated than multi-device WhatsApp. Matrix is ready for prime time.
rustcleaner8 days ago
Nice! Last time I used Matrix there was really no voice/video calling. I'll have to check it out again! :D
axus8 days ago
There was a brief window where you could submit fake biometrics through a third-party site to verify age on Discord, pretty sure I got the link from hackernews.

That made me feel better that Discord didn't need to store my ID or video of my face, and was only storing the results of some analysis and not the inputs.

burningChrome8 days ago
When the social media ban went into effect in Australia last year, kids were submitting photos of their parents and dogs to get around the verification. Not sure how better or worse they've gotten, but the old adage of trying to keep things from kids only motivates them more to get around the limitations you put up.

For reference: https://www.ndtv.com/world-news/dog-photos-vpns-fake-ids-how...

rustcleaner8 days ago
> ... the old adage of trying to keep things from kids only motivates them more to get around the limitations you put up.

This will be a boon for FOSS.

ZeWaka8 days ago
Yep, still waiting to see if they disqualify those old determinations.

Read the full thread on Hacker News →

Related stories