One major controversy I recall with VRchat's implementation of age assurance (via Persona) is that they retained identity of who you were after completing the process. Not who exactly, but your identity was hashed so that if the same person attempted to verify again they could tell who it is. This effectively meant one individual can have one validated account per lifetime. If the flakey AI moderation banned you for an emoji combination freshly deemed racist/etc, you effectively lost your only shot at a validated VRchat account forever.
This is an issue with age assurance that goes well beyond just verifying age, and is undoubtedly viewed as a fringe benefit of age assurance for those wishing to deanonymise the internet. There's obvious problems with this beyond just "can't ban evade anymore". Authorities or intelligence can run bulk hashes against sets of IDs to effectively deanonymise all accounts.
The question here is, does Discord do the same thing for any or all of the selected options? Or is identity data full well and truly purged once the outcome is determined - no hashing, nothing retained other than the result?
> "We're launching this over the course of this week, so it may take a few days to reach your account."
That's obviously not a technical requirement; they're doing this because they expect a large volume of negative publicity, and temporally staggering this rollout means users are less able to coordinate their social-media outrage.
Same logic Reddit used in phasing out the rollout of their controversial login wall. One group says "I can't log in!"; the other says, "huh, it works for me?"
A long time ago, I'd participate in things like CAcert in-person assurance, PGP key-signing, etc.. I think a model like that would've been useful here: An AgeKey issued/signed by two people. I think of it like a decentralized equivalent to someone's parents saying "Yeah, $CHILD is old enough", or to a cashier saying "This person obviously looks old".
IRC plus GNU Jami are still freedom respecting zones! I sincerely hope all this age verification crap causes cypherpunk FOSS solutions to grow in popularity.
Matrix has become invaluable for dozens of my hacker friends. We ditched Discord almost a year ago and we have no desire to go back. Besides having high quality e2ee voice/video/screensharing (thanks LiveKit), we collectively spend 10x less for the functionality and keep our data in Switzerland. No ads, no one getting their accounts hacked with QR codes, ultra-granular space/channel settings, multiple choices for client implementations, and end to end encryption enables sensitive discussions that would have previously been curtailed. The identity verification is greatly appreciated although our new users do have some issues getting set up with multiple devices, but it's no more complicated than multi-device WhatsApp. Matrix is ready for prime time.
There was a brief window where you could submit fake biometrics through a third-party site to verify age on Discord, pretty sure I got the link from hackernews.
That made me feel better that Discord didn't need to store my ID or video of my face, and was only storing the results of some analysis and not the inputs.
When the social media ban went into effect in Australia last year, kids were submitting photos of their parents and dogs to get around the verification. Not sure how better or worse they've gotten, but the old adage of trying to keep things from kids only motivates them more to get around the limitations you put up.
I actually like their implementation.
I'm curious if it will be enough for governments, but it is nice that they are trying to persue a path without id checks
This proposed solution does however allow quite liberal access to discord without confirming the age. If the implementation is as worded; then i would not see a reason to confirm my age at all.
The issue comes down to if governments accept such a (urgh) comparatively lax implementation. It's pretty clear to me that the primary purpose of these laws are entirely to... force all citizens to identify themselves across the internet for the purpose of profile building, and nothing to do with child safety.
So as implementations go; this one is pretty decent. We should stop governments from passing these darn laws though.
I think it's interesting they limit the types of content they use to determine your age. I'd guess they don't impose those same limitations when it comes to other uses (including targeted ads)
One major controversy I recall with VRchat's implementation of age assurance (via Persona) is that they retained identity of who you were after completing the process. Not who exactly, but your identity was hashed so that if the same person attempted to verify again they could tell who it is. This effectively meant one individual can have one validated account per lifetime. If the flakey AI moderation banned you for an emoji combination freshly deemed racist/etc, you effectively lost your only shot at a validated VRchat account forever.
This is an issue with age assurance that goes well beyond just verifying age, and is undoubtedly viewed as a fringe benefit of age assurance for those wishing to deanonymise the internet. There's obvious problems with this beyond just "can't ban evade anymore". Authorities or intelligence can run bulk hashes against sets of IDs to effectively deanonymise all accounts.
The question here is, does Discord do the same thing for any or all of the selected options? Or is identity data full well and truly purged once the outcome is determined - no hashing, nothing retained other than the result?
> "We're launching this over the course of this week, so it may take a few days to reach your account."
That's obviously not a technical requirement; they're doing this because they expect a large volume of negative publicity, and temporally staggering this rollout means users are less able to coordinate their social-media outrage.
Same logic Reddit used in phasing out the rollout of their controversial login wall. One group says "I can't log in!"; the other says, "huh, it works for me?"
A long time ago, I'd participate in things like CAcert in-person assurance, PGP key-signing, etc.. I think a model like that would've been useful here: An AgeKey issued/signed by two people. I think of it like a decentralized equivalent to someone's parents saying "Yeah, $CHILD is old enough", or to a cashier saying "This person obviously looks old".
IRC plus GNU Jami are still freedom respecting zones! I sincerely hope all this age verification crap causes cypherpunk FOSS solutions to grow in popularity.
Just remember that systemd added age verification in Linux without anyone asking.
There are freedom respecting Linux projects, but those lead by redhat\ibm employees (past and present) don't.
It can be extricated, or bypassed. The benefits of FOSS are myriad.
Matrix has become invaluable for dozens of my hacker friends. We ditched Discord almost a year ago and we have no desire to go back. Besides having high quality e2ee voice/video/screensharing (thanks LiveKit), we collectively spend 10x less for the functionality and keep our data in Switzerland. No ads, no one getting their accounts hacked with QR codes, ultra-granular space/channel settings, multiple choices for client implementations, and end to end encryption enables sensitive discussions that would have previously been curtailed. The identity verification is greatly appreciated although our new users do have some issues getting set up with multiple devices, but it's no more complicated than multi-device WhatsApp. Matrix is ready for prime time.
Nice! Last time I used Matrix there was really no voice/video calling. I'll have to check it out again! :D
There was a brief window where you could submit fake biometrics through a third-party site to verify age on Discord, pretty sure I got the link from hackernews.
That made me feel better that Discord didn't need to store my ID or video of my face, and was only storing the results of some analysis and not the inputs.
When the social media ban went into effect in Australia last year, kids were submitting photos of their parents and dogs to get around the verification. Not sure how better or worse they've gotten, but the old adage of trying to keep things from kids only motivates them more to get around the limitations you put up.
For reference: https://www.ndtv.com/world-news/dog-photos-vpns-fake-ids-how...
> ... the old adage of trying to keep things from kids only motivates them more to get around the limitations you put up.
This will be a boon for FOSS.
Still required to use a video or ID card in the UK.
A friend of mine, who lives in the UK, says that he's been offered the credit-card verification option.
I actually like their implementation. I'm curious if it will be enough for governments, but it is nice that they are trying to persue a path without id checks
All the available paths turn into:
- give us your ID
- give us your biometrics
- give somebody, not necessarily Discord, a valid credit card
That's sll of the paths.
This proposed solution does however allow quite liberal access to discord without confirming the age. If the implementation is as worded; then i would not see a reason to confirm my age at all.
The issue comes down to if governments accept such a (urgh) comparatively lax implementation. It's pretty clear to me that the primary purpose of these laws are entirely to... force all citizens to identify themselves across the internet for the purpose of profile building, and nothing to do with child safety.
So as implementations go; this one is pretty decent. We should stop governments from passing these darn laws though.
If the account age estimation puts you in adult, it sounds like you don't need to do any of those?
I'd like to see details about their model there, but account age is at least better than a lot of systems like steam are doing for this.
Some of those details are available here: https://discord.com/safety/how-discord-estimates-age-without...
I think it's interesting they limit the types of content they use to determine your age. I'd guess they don't impose those same limitations when it comes to other uses (including targeted ads)
Sounds like scam.
They should not be trying to implement it globally. That is unacceptable.
I like that the dialog indicates the service provider. Thumbs up for transparency.