What legal fallout? Discord made users agree to new terms just a week ago that involves forced arbitration.
HexesofVexes@lemmy.world 3 weeks ago
So, I looked at age verification - it was made clear photos were on device only and never transmitted.
If this turns out to be false, then the legal fallout would be apocalyptic.
lemmyout@lemmy.zip 3 weeks ago
Azzu@lemmy.dbzer0.com 3 weeks ago
Forced arbitration clauses are not legal in many European jurisdictions, so “agreeing” to them didn’t actually do anything.
amju_wolf@pawb.social 3 weeks ago
Are they legal in any EU jurisdictions? I’d hope not.
Not to mention half of their TOS being illegal/unenforceable in the first place.
Azzu@lemmy.dbzer0.com 3 weeks ago
Dunno, just didn’t want to make a statement I’m not sure of.
ms_lane@lemmy.world 3 weeks ago
Sounds like Discord is about to have 2 million cases of arbitration to sort out.
One person takes them to arbitration, it’s short work for their legal team, if 1000 do it’s harder, if 100,000 do, you still have to respond in a timely manner. The costs would be astronomical.
Valve and a few others removed it for that reason, it’s a bomb waiting to blow.
Holytimes@sh.itjust.works 3 weeks ago
Forced arbitration tends to backfire massively when you have something of this scale because of everyone starts doing it. The cost of that forced arbitration is more than what the lawsuits would have been without it. It’s a big reason why like steam got rid of it. If you get too many people trying to go after you, it’s just not worth it and costs too much.
socialsecurity@piefed.social 3 weeks ago
And US courts allow companies to reverse force abortion if it no longer suits the company!
REDACTED@infosec.pub 3 weeks ago
I’m not sure if Discord’s ToS apply to zendesk
Assassassin@lemmy.dbzer0.com 3 weeks ago
Here’s the information directly from the FAQ as of right now:
Q: Is my data stored when I use Face Scan or Scan ID verification?
A: Discord and k-ID do not permanently store personal identity documents or your video selfies. The image of your identity document and the ID face match selfie are deleted directly after your age group is confirmed, and the video selfie used for facial age estimation never leaves your device.
LyD@lemmy.ca 3 weeks ago
That sounds like the video stays on your device but the photos do not.
oplkill@lemmy.world 3 weeks ago
Big company lies again what a big surprise
Ganbat@lemmy.dbzer0.com 3 weeks ago
Yeah, but those methods of verification weren’t the subject of this breach, this was some manual bullshit done through Zendesk.
floofloof@lemmy.ca 3 weeks ago
Where is that small print? It should be archived before Discord tries to change it.
HexesofVexes@lemmy.world 3 weeks ago
…discord.com/…/30326565624343-How-to-Complete-Age…
Check down on data security ;)
LibertyLizard@slrpnk.net 3 weeks ago
Looks like it’s already been archived: web.archive.org/…/30326565624343-How-to-Complete-…
floofloof@lemmy.ca 3 weeks ago
It’s also here:
renegadespork@lemmy.jelliefrontier.net 3 weeks ago
Idk it doesn’t seem like there are any legal consequences for tech companies anymore.
ipkpjersi@lemmy.ml 3 weeks ago
Definitely not, laws are only for the poors.
mr_pip@discuss.tchncs.de 3 weeks ago
you agree to legal mediation other than a court in their terms of service, so… not really
explodicle@sh.itjust.works 3 weeks ago
Those don’t always hold up, especially when the shit is really hitting the fan.
mr_pip@discuss.tchncs.de 3 weeks ago
“dont always… when it hits the fan” is a little too elusive compared to a legal document you agreed to online imho so i will not necessarily hold to that
explodicle@sh.itjust.works 3 weeks ago
Yep that’s a lot of stuff, it’s a money spending contest.
AmbitiousProcess@piefed.social 3 weeks ago
These were photos submitted via the compromised support provider (Zendesk) via the Discord support portal.
Automated age verification via their partner (k-ID, which has its own issues) is a separate system, which was only available to some users. Other users had to contact Discord support manually and submit photo ID, which went through Zendesk, which was then compromised in this breach.
https://support.discord.com/hc/en-us/articles/360041820932-Help-I-m-old-enough-to-use-Discord-in-my-country-but-I-got-locked-out
Additionally, for the automated process, it’s the video selfie that’s on-device and never transmitted, but photos of your ID and selfie photo are transmitted, just supposedly deleted afterwards. Those ones are *not included in this breach, as far as we’re aware, as it’s an entirely different third-party with wholly separate infrastructure.
NuXCOM_90Percent@lemmy.zip 3 weeks ago
Which is why you farm off stuff like this to third parties whenever possible
DiscordCorp will get a slap on the wrist and give people an offer of a free six months of discord turbo (so long as you provide payment info so it can auto-renew on month seven).
But ANY meaningful consequences will go toward Zendesk Corp for not doing what they were supposed to. And… then everyone will just use ZZendesk instead
Warl0k3@lemmy.world 3 weeks ago
Well, yeah. Discord isn’t exactly at fault here, they’re operating as best they can within the boundaries of a piece of legislation that could be best described as gods gift to the “I-told-you-so” crowd. This breach is exactly what everyone was warning would happen with the UK ID laws, and discord got stung first as they’re one of the few companies trying to adhere to the law in good faith (which, yes, why in hell they’re trying to do this is good faith is a very good question)
Axolotl_cpp@lemmy.ml 3 weeks ago
Literally days ago i was accessing a nsfw channel and i got “well, you should send to us your JD and things so i can verificate you” and i thought “no way! I don’t want to give my infos, if they have a data breach we are all doomed” and i ignore, well i don’t want to say “i told you so” but…
AmbitiousProcess@piefed.social 3 weeks ago
In my opinion, they’re still somewhat at fault, because this was them failing to find and configure their software to work with a third-party identity provider who’s infrastructure was built to handle the security of sensitive information, and just choosing to use email through Zendesk because it was easier in the meantime. A platform that I should note has been routinely accessed again and again by attackers, not just for Discord, but for all sorts of other companies.
The main problem is that legislation like the Online Safety Act require some privacy protections, like not collecting or storing certain data unless necessary, but they don’t require any particular security measures to be in place. This means that, theoretically, nothing stops a company from passing your ID to their servers in cleartext, for example.
Now compare this to industries like the credit card industry, where they created PCI DSS, which mandates specific security practices. This is why you don’t often see breaches of any card networks or issuers themselves, and why most fraud is external to the systems that actually process payments through these cards. (e.g. phishing attacks that get your card info, or a store that has your card info already getting hacked)
This is a HUGE oversight, and one that will lead to things like this happening over and over unless it becomes unprofitable for companies to not care.
HexesofVexes@lemmy.world 3 weeks ago
Neat summary and cleanup - editing original post to point at this.