Hacker News

Note also there's a direct response from Persona's security team here[1], and a lot of back and forth from Rick on Twitter[2].

[1]: https://withpersona.com/blog/post-incident-review-source-map...

[2]: https://x.com/Persona_IDV/status/2025048195773198385?s=20

Submitted 6 days ago but flagged https://news.ycombinator.com/item?id=47059129

@dang can this get a second chance?

I read it and, maybe it’s because I’ve spent too much time in fintech, I don’t share most of the concerns.

The differences in proclaimed data retention periods is concerning though. The rest is par for the course for KYC/AML.

Good article but the web site gave me eye and ear cancer.

Please make it actually readable and don't steal my audio!

Seems to be down for me. https://web.archive.org/web/20260220192124/https://vmfunc.re...

That was a great read, very interesting!

damn. why did the website stole my audio?

This refusal to use people’s names comes across as childish and distracts from your intended point.

What is he? Voldemort?

Remember the good ol' days of the last century when we worried about Big Government spying on us?

> once code tied to US spying found

New and also should be the big story.

"Butcher cuts ties with supplier when steaks found to be human meat" shouldnt be a story about changing suppliers ...

You might email @dang and request a title change. [email protected] is the email address.

That would have been a better title, I agree.

Is this actually a thing that is true?

> "after its code was found tied to U.S. surveillance efforts" part is new ... Although most of us probably assumed it was true before too.

This makes me feel VERY old.

641A: https://en.wikipedia.org/wiki/Room_641A

Retroactive telecom immunity: https://www.eff.org/press/archives/2008/10/17

The government spying on what you do has been old news for 20 years. Snowden should not have been a shocking revelation to any one but it was, and that was 13 years ago.

Its less of a "assumed it was true" and more of a "oh look another one, not shocking".

They really should be a proscribed organization.

Can someone explain to me how Discord got so big in the first place, particularly for non-gaming uses?

I saw this coming a mile away when folks started ditching slack for Discord - Slack being problematic because a) it was profit-seeking and would use its leverage over your personal data to seek rent and b) it was antithetical to the open web.

Discord has the exact same two issues so was obviously not a solution.

Why did the internet en masse fall for it again?

Isn't it a good thing ? It makes clearly marks companies like Persona dangerous and toxic enough to hopefully makes an example that prevents others from working with them.

I've exported any servers that I run as backups and plan to uninstall if I get an age verification prompt personally.

I think they have been steadily losing their years of goodwill and trust over time. Their client is becoming worse and worse every release, introduced ads, etc... Typical enshittification, it could be worse, but Discord already went from being cool to being tolerable. The age verification thing is just another step on the way down.

Discord is a cancer on the open internet anyway.

Real time chat? Great. But entire communities, forums, and wikis moving behind the locked walled of Discord has been a disaster for information discovery.

Don't replace Discord with a similar alternative. Return to open forums and wikis!

> Discord just burned years of goodwill and trust.

...not here, they never had any. it is good tech, but so is the w80 nuclear warhead, the tiger iv (for its time) and the j-35.

Discord isn't scrapping its plans, just assuring people that one of the vendors they trialed in a sub-market they aren't moving forward with globally. They've been trying for a multi-vendor solution from the beginning and k-ID is the vendor they've been much more publicly happy with than Persona.

Today Discord also released a rather comprehensive (and good) recap of the plan so far, their apologies for some of their messaging mistakes, and what comes next: https://discord.com/blog/getting-global-age-assurance-right-...

(Also, from that post most notably mentioned about the global rollout is delayed in light of some of these vendor verification issues and also hoping to rollout a few more features to even further lesson the need for age verification by many users. One such feature being first-class opt-in "spoiler channels", which some servers had been using age restricted channels for that rather than opt-in roles and somewhat more complex role-based permissions.)

> So does this mean Discord is scrapping its new face verification requirement for users,

No, they’re outsourcing the verification to an external company. Just not this one.

Side note: The verification is only if you want to remove content filters, join adult-themed servers and a couple other features. If you only want to chat with your friends and use voice then no verification is required.

K-id is the vendor they were proposing which did on device processing. They were trying to downplay the initiative by saying all the k-id data stayed on device.

This was undermined by the fact they were also trialling a switch to Persona (the vendor in the story), which did not uphold that guarantee. It was horrific optics to be reassuring people that it was ok because you didn’t save data but also be trialling a switch to a vendor which did save data, which I guess is a lot of the reason this vendor switch was cancelled. (Though it does call into question discord’s judgment that they thought this was a good idea).

Anyway, Persona was also breached which is how the government links were discovered and also probably a part of this decision. This is not to be confused with the breach in November of 5CA, _another_ vendor they used in the initial UK and Australia roll outs. The fact that two vendors were breached in four months is a good example of why this is a bad idea

Thanks. I was curious if someone was going to address the weird use of “CATASTROPHIC” to describe source maps being available for front-end code. It’s already public. Minified is better for the regular user, and should be in production, but it’s like by far the least problematic thing in this article.

That last quote, buried at the end of the article, absolutely killed me. I cannot believe he had the nerve to say that doing what he does everyday

Discord? Or Thiel? Or both?

The bigger shame is that it took Peter Theil's name to get people's outraged about this. Discord handed over their users' identifications to a third party without regard for how it would be used or secured. I don't care if it was backed by Peter Theil or Mother Theresa - it's a huge problem either way.

And they'll do it again too. They'll find a new partner - one with less baggage - to do the exact same thing and few people will bat an eye.

Discord's previous statement:

> "Identity documents submitted to our vendor partners are deleted quickly— in most cases, immediately after age confirmation"

So now it's not "immediately" but 7 days? I don't know how anyone can trust any statement from these guys.

Same for me, and my account is almost a decade old. I think it depends a lot where are you from and the kind of activity, as i read stories of people being asked to register a number out of nowhere. Many servers requires you to have it tho, due to spam protection. I just don't talk on those.

Each discord server can decide whether they only will allow people with a phone number on. When you hit one of those, Discord will ask you for your number.

Good question. Quite a few, publicly. https://withpersona.com/customers

“For The Children”!

I just nuked it and didn’t replace it. Bloated piece of shit full of misery.

We decided to just meet up in person twice a month and play board games instead.

What's the point of E2E on a chatroom/channel/"""server""" that anyone can join?

Yes, I'm making (another) argument in favour of IRC. IRC has optional client-server encryption, and you can set channel modes to only allow encrypted clients access. So that way you at least prevent eavesdropping.

where we definitely will not be moaning about the same thing in 18 months time

I guess we could all forgive trying to destroy western civilization under the guise of saving it, but drew the line at poor media literacy when it comes to One Piece and Watchmen.

(This is a joke in case that wasn't clear)

I always explain it to recruiters contacting me from one of his companies.

Peter Thiel Integration (PTI) halted

The (PTB) Peter Theil Be

it is truly amazing how much damage one person is able to do to civilized society

if you expand the scope to a handful of adjacent figures, the catastrophe is truly amazing

That's fine, if not very good, but the central problem remains (ignoring the capitalist corrupted business culture and its merging with the state behind much of this). We can't centralize our communications without major concessions in significant ways that non-techies seem unaware of until a big news item like this comes out. "What, they're logging my chats, and IP, voice clips, and now they want my ID for 18+ discords?" Yes, absolutely you are being logged and those logs will go places you have no control over. Maybe even to oppress you or your loved ones.

Discord's entire value proposition was "Hey just click here, no need to pay for a teamspeak server or do peer-to-peer jank." Deeply personal stuff is said and posted in those spaces. Common communication should not be shared like this and we keep falling back to the "tapped my phone line" problem.

The difference between then and now is that for a long time there was no alternative to POTS. You just had to use the phone to call someone. The phone company and whatever government tapping was very hard to get around. But today there are other ways to do near everything if we give up on for-profit centralized services.

I think society keeps flirting with federation and other things similar to that but never quite makes the jump. The twitter exodus went back to a new centralized service like Bluesky that will one day be sold to another deep-pocketed buyer with its own agenda, thus creating this problem again. Sure, now with federation or personal servers, the privacy issue goes back to the server operator, but at least that could be someone you trust, or even you. When currently, neither of those options are possible with things like Discord or Bluesky.

I'm testing moving my friends and gaming group to self-hosted teamspeak or stout or mumble or something like that. I think we'll lose some convenience, but life isn't all about gains. Sometimes you have to sacrifice things for the greater good. I also really want to start moving away from things like reddit, bluesky, HN, etc to federated services and have dipped my toes there quite a bit, but the population isn't there (yet?).

I hope this is a wakeup call that people need, much like the wake-up call the fight against personal encryption was in the 90s. I think we're in a super bad place right now, and its worth discussing the elephant in the room, even to non-techies, and what alternatives there are to the current system. I think people need to get over the convivence of the current system and realize if they want privacy and safety, they may have to migrate to services built with that in mind.

Everyone needs to cut ties with those companies. Not just with Persona but any service linked to Peter Thiel, Joe Lonsdale, Palmer Luckey, Elon Musk, David Sacks, etc. The entire MAGA cultist ecosystem.

Unfortunately there will be companies that take their money and won’t care. It’ll be up to other companies and consumers to punish them for it. Maybe we need a website that lets you quickly check if you should or shouldn’t use some service based on the investors.

I think it's a bad trend. It's kind of a meta version of an ad hominem attack. The headline contained no information about why Discord is making the decision, only that there's a bad name associated with the company. The name of the company isn't even mentioned in the headline. This is prioritizing hate over information.

its not some new/modern trend just because you have not seen the term. its been a term for nearly 3 decades.

https://en.wikipedia.org/wiki/Politically_exposed_person

Translate: People who are likely to be attacked by (Putin|Orban|Erdogan|Trump) or similar.