Violazione dei dati di Discord: estorsioni di 1,5 TB di dati e 2 milioni di foto di documenti d’identità governativi
Discord Data Breach – 1.5 TB of Data and 2 Million Government ID Photos Extorted
di Shaurul
Violazione dei dati di Discord: estorsioni di 1,5 TB di dati e 2 milioni di foto di documenti d’identità governativi
Discord Data Breach – 1.5 TB of Data and 2 Million Government ID Photos Extorted
di Shaurul
29 commenti
There’s a bigger question here, “Why were the images of ID cards being held for one second longer than was necessary to confirm age?” secondly “Why were these images stored without being encrypted?”.
I know what the answer partially is. It’s because they decided to use a generic ticketing platform not designed for PII for their PII sensitive processes.
This is eventually the future humanity is not ready for.
Amen.
> Discord Data Breach – 1.5 TB of Data and 2 Million Government ID Photos Extorted
Thank the UK for showing how stupid these laws are.
So if I hoarded 2 million government IDs and then lost control of them as a private citizen, you know what would happen to me? Why aren’t these people in jail?
No one will be held responsible for this
This is a good reminder not to blindly follow what the government suggests. It’s not safe at all.
Why would anyone share their actual id with discord?
Somewhere in that leak there’s a ticket with my discord nick
That ticket is me snitching on one person breaking discord TOS because they were annoying a-hole
I regret nothing
How many of those images will be used for ID fraud and AI models? Will the government care?
The fraud fallout of this is going to be bad. And the world has changed, banks are are on the hook for a lot more than they should be tbh. I would be furious at the government for this nonsense
Can’t wait for the EU version of OSA to kick in…
I hope I can avoid most of the verification stuff with a VPN
I see protecting the kids is working great.
Companies need to be made responsible and people put in jail.
*surprised pikachu face*
Company Leaders have to be accountable for every Action of their fucking Company!
The UK should be held responsible as well.
Lmao imagine using discord
No prob’, chat control will solve it! /s
This is what I have been warning everyone about and have advised against as a cyber security analyst and expert consultant but no, never listen to me because the consultant grifter crypto finance bro is always right…
I hope the EU squeezes them dry.
This also affects more than just the UK. Discord was “[experimenting](https://www.reddit.com/r/europe/comments/1nldh4e/discord_is_rolling_out_experimental_age/)” with age verification in some EU countries as well. Even though the EU does not require it (yet) and the proposed EU system does not allow “just upload your ID”.
So some EU users might have been hit as well.
Dsgvo lawsuit incoming.
UK Parliament members proved their IQ not that high
Whoever could have seen this coming!
My take is that we need to work on an open standard for government ID that protects privacy.
This was well done for Covid app in UK
Trying to simplify it:
– you generate a private key in your phone’s Secure Enclave
– you register the public keep with the government in a government ID service
– the government ID service provide a derived public key service that merchants can reach to get a unique instance of a derived public key for your id
Merchant don’t need any personal info
You can auth to their service with your gov ID (no more passwords, local 2FA on your phone).
You have a different public key for each merchant (no tracking)
Protecting the children by doxing them.
It’s not the corps to blame for this, corps are what corps always has been. It’s stupid ass governments making such nonsense as age verification mandatory to blame – but then, not even giving a slightest fuck how it is handled.
Is my child safe?
Make TeamSpeak 6 without the mandatory account and I will never use discord again.
Sucks for the people who’s ID’s got leaked, but I’m glad this happened so quick. Maybe now higher ups will recognize how incredibly stupid age verification like that is.
Even without evil intent, keeping data secure is hard work, and if they don’t have to do it, they won’t, in the interest of cost control. Beyond actual tech giants like google, meta, apple that both have huge budgets and actual oversight from EU, and maybe some heavily regulated financial companies, anything customer facing is cowboy territory, if discord can’t keep it safe, you can forget about everyone else who is smaller. Usually these platforms have no alternatives so you can’t even “choose the more secure alternative”