Guess I'm Done with Discord

That's Twilio's database, not Discord's. Maybe it's fair to be upset at Discord for using Twilio if Twilio can't keep their database up to date, but I don't think there are that many alternatives to Twilio.

Since the OP is specifically talking about Discord, it’s worth mentioning that what you’re talking about doesn’t seem to be the case for them - they make money from Nitro subscriptions and their game store, and state in their privacy policy that they are “not in the business of selling your information” (https://discordapp.com/privacy, in the section ‘Our Disclosure of Your Information’).

So relating back to the post, their justification doesn’t necessarily make it right, but I think it’s incorrect to attribute it to a malicious cause.

You think the right set of people will check that box? And that if they do get hacked they won't cost the company a ton of resources in support/lawsuits/etc?

Yeah, you wish for too much. I remember losing MAL account (yeah, don't judge me) which I had for like 10 years (probably longer, really), not because I didn't have the correct password — I did, but because they fucked up with security not long before that and I suddenly needed to verify it was me via some email account I didn't use for the same 10 years. I mean, really, somebody stealing my MAL account? Why anybody would need that, even I don't need that, it was just silly losing my account I had for so long, because they care so much about me not losing my stupid account. So, fuck MAL. And fuck twice any service, that needs to verify my email/phone/passport name more, than it needs my money I am ready to pay for pizza delivery or whatever.

You have to remember that even if you don't care about your account getting hacked, hacked accounts are a nuisance for other users of the platform as well.

voice.google.com (not privacy focused, but works as a catchall number when you dont want to give out your own)

I mean it's not exactly privacy focused but if you just use it for spam then Google Voice or Skype numbers would work fine for this.

Google captcha is particularly egregious because it will flag you as "never allow in, ever" but not give any indication of this, and still will happily have you solving captchas (that is, working for Google, for free) for 30+ minutes, until you catch on that they aren't ever going to let you past.

Captcha v3 is even worse in this regard, because it silently flags you while appearing to let you in...

>Why the insistence on Tor?

Short answer: I'm a privacy activist. That should be a valid enough reason for this context.

>I also don't understand the 2FA point, that says nothing about your accounts' intentions.

No, but it shows my account is secured from intruders, which means reCAPTCHA is just an additional nuisance to me, the legitimate account holder.

>The account history is an interesting point

Yeah, and they just glance right over it. It doesn't mean anything for my case that I've been an active user with this account for almost two years (I had a previous account for a bit and then left Discord because I was not in any communities worth sticking around for). Never have I done anything wrong on Discord's platform; haven't uploaded any lolis or evaded any bans (I believe I was only banned from one guild, even). They just don't seem to want me as a user, and that's fine.

Force is more aggressive than language.

In that sense, bureaucracies are aggressive by default; that they use friendly language doesn't change this.

Imagine that one day, your car locks you out, and there's a smiley face and it says "oh hey, just call this number dude". Is that any less aggressive simply because it's 'friendly'? Of course not.

In many ways it's worse - because it's almost sarcastic (it's not _really_ that way, of course, because the customer support agent in this scenario is a robot, but it sure feels like it).

I don't know any of the specifics of what's going on here, but phone verification is sometimes very tricky even for willing people, with a phone, and from western countries. I can't get a Lyft even when in the US because their verification system only works for US phone numbers and I have a British one!

Discord's been an abusive member of the community for a long time. They distort nomenclature, mislead about their intentions, and aren't able to show that they protect personal information.

As a light and funny example, Discord doesn't comply with the OpenSSL license.

Just a note: I do not ask to have my blog entries submitted to this site, precisely because the comments I receive here are very assumptuous and negative. I have had prior interactions with Discord which influenced the tone of my E-mail. My blog post is simply presented as-is and I really do not care what others have to say about it, but I have no control over what is submitted here. I just want people to keep this in mind should future posts of mine be submitted, before someone points out "hey, you got onto Hacker News again" and I have to be subjected to a bunch of people not getting the full picture (and even some people complaining how pink my site is... grow up).

> Does this person not have a phone? 'Unable' seems like a stretch. If this person said, "I don't want to provide my phone number to Discord, so I'm going to stop using it" I'd understand.

If I say "I am unable to do X" that might mean "My conscience compels me to refuse to do X" or "I literally cannot do X". Both interpretations are valid.

> Their opening email also strikes a pretty aggressive tone -- calling Discord anal, insulting, "spit in my face" then goes on to make a number of demands of the company? I'm not super surprised the customer service rep on the other side didn't go out of their way to help.

I suppose I agree with you that the email is rude. Then again, I don't mind giving out my phone number and email even though companies are using these things to track me, build a profile, and spam me. I'd rather that they didn't; I think it's corrosive behavior. But it doesn't affect me much and so I put up with it. Point is, the writer of these emails could be seen as heroic because he or she has principles and is refusing to back down (despite the rudeness).

Like I said, I have similar principles but I'm not too fussed about them. This worries me sometimes. This level of invasion of privacy isn't the hill I'm willing to die on but I hope there is a hill I'd die on. If not, I'm an unprincipled person.

He says he's using tor to access Discord. While there's nothing inherently wrong with that, the IP addresses of his exit nodes are probably flagged as frequent sources of abuse.

People underestimate how hostile the internet truly is. I run a small website for a friend-- I'd say 90% of our traffic is spam/exploit fishing. I have at times blocked whole countries because we didn't have any business in that region and the abuse would not stop.

Assuming you're willing to share, how did you get banned from Lyft without ever ordering a ride?

> but there's way to much consumer abuse for these Internet age services.

a) Government programs are programs, written in the language English. So let's be careful what services we launch with the stroke of the Presidential pen. They could be a cure worse than the disease.

b) Whither capitalism? A remedy to consider in parallel with government regulation would be some actual competition. How do we get the functionality we want without quite so much Orwellian peril?

Honestly I can't be 100% spiteful toward Discord. Their customer service at least allowed me to easily begin the deletion process for my now-useless account. Compare this to Twitter, Google, or Yahoo!, where it's actually really difficult to get in touch with a human that doesn't spam canned replies at you and close your ticket soon after. (I'm especially disgusted at Yahoo! which seems to handle E-mail abuse related issues in the same customer support department as general account inquiries. Makes it really difficult to report spam as a fellow postmaster.)

It's a shame about your experience with Lyft. I'll have to remember this if I ever need a car ride, but seeing how all of these crowdsourced transportation initiatives are popping up with similar policies and disrespect toward open platforms (locking you into their apps, for instance) it might be better for me to consider conventional transportation entirely, if I'm ever stuck without a car and I can call up a normal taxi.

>I'm not one to normal advocate for government regulations and oversight

Yeah, I'd like to say that, this is capitalism and customers can naturally choose the right choice and stop supporting unethical companies, but this is hard especially with the network effect in play with things like Discord. Everyone's on Discord (or Facebook, or Snapchat) and suddenly a person is in the wrong for "not just signing up and using it" because their friends use it just fine. If consumer protections forced Discord to release a way to self-host servers (rather than calling guilds "servers") and made Discord fix their login and anti-spam mechanisms, and allowed users to have third-party apps to access the service, then I wouldn't complain. I still wouldn't like the concept of Discord because I'm a believer in federated networking, but it'd definitely be an improvement over the current state. These consumer / online service laws would also have great effect on financial and educational websites, which have rampant anti-consumer and security issues plastered all over their Internet presence. It's really upsetting to see how many corners people are willing to cut at others' expense.

my friend got instantly banned from stockx before even confirming the order,, these algos run amok

To be fair, I don't think humans have any way of verifying that you're trustworthy. Anyone can send email from your email address. Anyone can fake a driver's license. Anyone can get a phone number that meets their criteria. Knowing who someone is on the Internet is nearly impossible. Knowing whether or not to trust someone once you know who they are is nearly impossible.

There is no system of human <-> corporation trust in the real world. The best we have, maybe, is some record of how often you pay bills on time.

Tech companies kind of have to have these automated bans, because it's easy to create new identities on the Internet and the government doesn't care that you're defrauding a tech company. If you defraud a bank, the government pays the full cost of prosecuting and incarcerating you. If you spam Discord... nobody cares. It's Discord's problem, not the taxpayers' problem. So they really have no choice here. The world sucks. Get a helmet.

Having said that, banning people with a valid authentication token because of their IP address is simply the wrong algorithm. I can see why you might rate limit authentication attempts over Tor... but if you get your username/password right on the first attempt and provide the correct second factor... you should probably rate limit that valid session with a per-session rate limit key, rather than a per network endpoint key. (The era of IP address based rate limiting dies with IPv6 anyway, so they'll need a better plan someday.)

For privacy reasons implies either what you are suggesting or that they are contacting Discord from an email address not affiliated with the account in question.

Many companies have a policy of not explaining how their abuse detection works because the information aids abusers.

The stuff about privacy is just nonsense from a clueless support person.

Their own privacy most likely. Don't want to reveal the techniques used to identify the accounts they ban, so the scammers can't learn from it.

2FA is account security, not proof of being a good human user. TOTP is a very simple algorithm (python impl: https://github.com/pyauth/pyotp) that can be easily automated. After all, your phone telling you the code to type in has automated it.

It becomes extremely obvious when someones sharing a link to thousands of users they have never spoken to before. Idk about how you use Discord but I can only send so many messages to so many people in a few minutes.

> but also the tone of both emails was quite antagonistic

The customer is always right.

> They may have had slightly better luck if they'd been friendlier and not attempted to school the Discord staff on how their app should behave.

Or not. Besides, it should not matter, either they did something bad or they did not, the tone of the message may upset the recipient but when you ban someone just like that you can expect them to be upset and your first line support people should be able to take that sort of heat in stride.

Sucking up to support staff when your account has been banned for no particular reason should not be a pre-requisite for having it dealt with professionally, in fact a good first line support worker will be able to de-escalate such a situation quickly by showing some competence and making sure the user is dealt with as they should.

You know what else is antagonistic? removing you from the service.

https://thebaffler.com/salvos/critique-of-pure-niceness-whym...

Someone else suggested I should have done the same, but again, I've had prior issues with Discord and really just wanted to be done with it. This account issue set me back a little, and I can't participate in some communities I'd like to, but I've already talked to moderators for some of the guilds that I played a big part in, and they were happy to set up a Discord to Matrix relay for their main channels.

Matrix isn't great, but it's open-source and it allows me to connect however I please. I have my own Synapse homeserver set up; might consider Construct as well, once it matures. And Matrix is the only platform I have run into that even has easy bridging with Discord and so many other services.

Yes, I believe Hacker News feedback to a blog post that was not designed for feedback is unfair to me, but I guess this means that a follow-up post saying what I am doing in response to leaving Discord is in order.

I'm probably going to leave phone companies entirely, when I'm no longer on my family's plan, and set up a VoIP number because it'd give me hands-on experience with how VoIP works and it seems more cost-effective for my use case. I'll remember Twilio if I need it for any verification purposes, but it's definitely a sad state of affairs that phone numbers are seen as a mandatory identification step in this day and age. I understand that it's an easy choice for some companies to make, but it doesn't mean I have to be happy with it.

>Malicious actors constantly attempt to brute-force logins on our system - generally from public password dumps or other leaks. A lot of these brute-force attempts come from TOR, and other public proxies. In order to avoid information disclosure, we always captcha logins from these kinds of IPs, regardless of whether or not an account exists with the e-mail in question, whether the login credentials are correct, or there is 2fa enabled on the account. So, the "captchas" you notice are not really specific to your account, but rather, the origin of the login. Using TOR is not a crime, you are right - but - it's also our responsibility to our users to make it reasonably hard for their accounts to get compromised on our platform (even if they don't employ the best security practices - and reuse their passwords across the internet.)

Solution: add a checkbox "disable account security measures", so a user who doesn't want CAPTCHAs when logging into their account doesn't see them. It would have a warning so any user selecting it would know what they're doing.

First of all, thank you for the reply. Yes, my ticket was fairly … to the point and I did not make an effort to be polite, but Discord's support team does perform a good job in terms of timely and complete responses. As I said, starting the account deactivation/deletion process over E-mail was not a hassle (compare that to Twitter, eh…) and I have even been able to start a transfer of my own guild over to a trusted member, so the guild does not die with my absence. But with the current route Discord is taking, I cannot wish it as a company the best of luck. I'll respond to some of your points.

>anti-spam

My impression would be that an aged account with a good reputation would be held to much less scrutiny than a new account, regardless of my method of accessing the service.

>regardless of whether […] there is 2fa enabled on the account

Clue me in on this one because I do not understand how a bot surfing for accounts would be able to guess this code in a configured number of attempts. Many login forms have a number of tries before the account is temporarily locked and the user is notified of a potential breach. This is no substitute for a good password, but it's one additional safeguard, and it's one that doesn't depend on a nonfree CAPTCHA service. I'm trying to de-Google lately and I've been pretty successful; one of the few services I use anymore is GDrive and that's only because I have unlimited storage and GPG at my disposal. Discord isn't owned by Google, so my decision to abandon Google's services shouldn't have weighed in on my decision for third-party services.

>it's also our responsibility […] (even if they don't employ the best security practices[…].)

I understand, but there's a line one has to draw for things like this. I'm not a fan of password requirements but employing a minimum password length (if Discord doesn't already do so) would be a good start. As a public service provider, I understand the issue with compromised accounts, and how they can be used for spam and harassment, but I still believe there are smarter ways to go about this than punishing people for using the wrong IP address to log in.

>hostile toward FOSS

>we have tried to give back to open source software

That doesn't really mean much when Discord openly detests third-party FOSS clients and will not make its server available at least in a similar capacity to GitHub's self-hosted solution (I don't think GitHub is appreciative of FOSS either, and they prefer to capitalise from the walled garden they've created rather than truly express the libre ethic, but hosting servers has been a long-requested feature especially from established communities who don't wish to rely on Discord's infra).

>and privacy

>we've stated that we don't sell your data

I'm a cryptoanarchist. If an organisation has my IP address, they have my IP address. If they have my phone number, they have my phone number. Discord may have my intentions at heart, its servers may be kept updated and secure from most threats, but Discord is a high-profile platform now, and we're all no stranger to hackers leaking database information from a zero-day or some other oversight. I cannot trust words and policies, I can only fully trust audited code and myself. So, no, in this light Discord does not appreciate the concern for privacy if it does not make exceptions for verifying accounts by other, more private means.

I wish I could give an answer on how to moderate a platform without negatively impacting people, but to reuse your words, there isn't an answer that satisfies everyone, and there will always be shortcomings for any solution, whether it's a setup cost or a long-term conditioning of users to create better passwords. In fact, I talked about passwords specifically in another blog post [1] so I can only hope they are eventually phased out for something less prone to user error. Despite what we're stuck with, I do genuinely believe Discord could tune their spam and login mechanisms such that false positives are kept to a minimum.

[1] https://wowana.me/blog/are-passwords-the-right-solution.xht

I still heavily disagree with the "Discord <3 Open Source" statements.

3rd party clients (eg. Ripcord) that were shared on reddit were quickly shot down with a We don't allow or support 3rd party clients or modified versions of the client.

Do you actively hunt for Discord users with a 3rd party client or is it more of a "we don't hurt you unless you abuse our API"-deal?

Use a bouncer like ZNC and an app that supports it, and you can get push notifications on mentions.

https://www.irccloud.com/ does what you want (they have an app). If you use IRC heavily, I do recommend paying for it - it's useful and they fund IRCv3 among other things.

I used to use a bouncer, vnc, which there's a plugin for push notifications. Now I use matrix.org, which bridges to freenode and many (all?) other IRC servers and does notifications well. Quite happy with it, personally.

mIRC has trigger words. Just input your username as one and when it comes up from someone else mentioning it your window blinks.

Been like that for over 20 years.

The post is entitled "Guess I'm done with Discord", not "I'm entitled to my Discord account and everyone who disagrees with me is an idiot." As I said in another comment, my post was purely informative and not even in a format that would be digestible by people who do not know me.

> you, a non-paying client whose concerns represent basically none of the legitimate user-base?

You seem to be implying that they are not a legitimate user. What makes them any less legitimate than everybody else?

Trust me when i say paying users of discord are treated equally as flippantly.

Luckily I never had all my eggs in Discord's basket, and thankfully so. I will remember this, and I know they are welcome to discriminate against Tor or any other traffic, but that just means they opt for lazy solutions and don't care about false positives. I host websites and online services (at a much smaller scale than Discord, at that) and I know how people use Tor to abuse services. But, I also know that there's a comparable number of incidents coming from traditional ISPs, hosting ranges, dynamic home IP addresses, public proxies... you name it. This is extremely apparent in the form of E-mail SPAM.

I just believe that placing bans or flags on IP addresses is not the answer, and I will work on my own software and services with this ideology in mind. Ironically, Discord did have what I believe to be a stellar answer to guild moderation: invite links. They allowed a whitelisting model for private guilds, as well as varied forms of controlled access for more-public guilds. I'd like to see this kind of control everywhere.