Hacker News Reader

Comment by 2pEXgD0fZ5cF | Hacker News Reader

I remember a while ago I was very much in the "I guess it's ok to use Discord, even if I don't like it". A number of tech/programming communities are there, and so I participated despite having a bad feeling about it.

Now more recently I started receiving my first "hey we believe there is something wrong with your account, attach a (first time, new) phone number to it to join this server". That is most likely a lie of course, Discord just wants to blackmail me into giving them my phone number. Also apparently there is an option to make an attached phone number mandatory in order to join a server, which quite a number communities activate for some reason.

So it turns out the bad feeling was correct.

View on HN

Phone number verification is purely one of many ways for Discord to drive down the amount of spam. Not used for any other purposes. We’re ofc working hard on enabling alternative solutions.

Source: I lead the anti-abuse team at Discord

Do you understand how invasive it feels to be asked for a phone number?

For most people, not really?

Plenty of apps require it now, and I wouldn't be surprised if it overtook email as the standard verifier.

As a multi-time victim of SIM swaps and even a related SWATing, I sure as hell hope not.

I think this is a generation gap thing. Most people under 30 don’t call or text anyway, so a phone number feels like pretty useless and low priority personal information.

I don't call or text much, but I don't appreciate how phone numbers cost money and are intrinsically tied to your personal identity (unless you're an adult and spend time and money shopping for burner phones), whereas email addresses and Matrix accounts are permissionless.

The phone number being tied to your identity is the entire point. If you get banned from a community are you really going to go to Verizon and ask for a new one every time you want to join again? The alternative is the kind of problem that is all too common on IRC where a troll keeps making burner accounts faster than the mods can ban them and generally ruining the experience for everyone else in the channel.

… you really think most people under 30 don’t text?

Not via SMS in my experience, no.

Your experience is a bubble, and a very different claim than "most people under 30 don't text"

I imagine this is geographic. Texts are quite expensive in some places, and that means people use alternatives instead. Also some people had pervasive mobile phone usage for a long time before smartphones made other options available, which I imagine would add to their popularity. Here in Denmark SMS is very entrenched, but I know it varies in other countries.

I thought it was pretty clear I was referring to SMS by context given that other forms of texting don’t require a phone number

I'm under 20 and still share the same opinions with most in this thread. I don't give out my phone number unless I'm talking to you in person.

Then don't use the service...

> Not used for any other purposes

...for now. I'll never give out my phone number to discord. The messages aren't even E2E encrypted.

I understand the concern, trust me. We’re working on alternative methods.

So let's say that in the future you got this alternative method deployed but then, what happens with already acquired phone numbers? Will you remove it once this method will be running nicely? Or you'll keep phone numbers giving a promise you won't use it to anything naughty and users will have choice to either keep it for "security purposes", or they will have ability to remove it by themselves directly from the client or by going the longer way, asking support to remove it from account data? Can you tell which solutions were considered so far?

Also, not sure if you're aware there but in some countries it's no longer possible to use SIM card without registering it first under name and last name and that means, the state has a possibility to track your online presence.

If you give me the option to verify my account for 1$ or something like that instead, I'd much prefer and just use that and accept it as an alternative. If phone number is enforced as the only option, I find it hard to believe that spam is the only reason you want it and that the phone number won't be used for other things (in the future).

As has been said, there is sadly little reason to trust a company in that regard. Usages of user data are always expanded upon, official (or unofficial) promises from companys aren't worth anything, and leaks also happen all the time.

Honestly, after running into the phone number requirement it's gonna be hard to get back my trust.

You required the phone number after you got all my account details. You wouldn't let me remove my account without first giving you my phone number. When I contacted your support to get you to delete my data, a simple back and forth like "you're gonna lose all your data!" and "I don't have any data" made them completely fail the Turing test. It's clear they don't really read what I was writing, they're just responding to whatever the first thought is that comes to their head.

I don't know if they're overworked, underpaid, or have quotas. Either way, none of the experience of trying to join an OSS development channel on Discord are in any way conductive towards trust. I mean, I couldn't even copy and paste the phone number requirement error message.

Provide a specific commitment. What methods, and when will they become available? "We're working on it" is worthless and when I'm told this I assume I am being blown off.

This phone number thing is a deal-breaker for me. Skipped several communities over that in fact.

I can't be bothered to fetch a burner sim every time someone or other wants a number.

And I'm not giving out any of my more permanent numbers to who knows whom.

I have enough spam and phishing attempts on them already, thank you very much.

(and it's not like I imply that you're behind the attempts, it's just numbers leak left and right)

Create a Google voice number and use it as a burner for all such accounts?

They probably block Google voice numbers, many similar services do.

I run into issues occasionally, but my GV number works more often than not.

i get phone numbers for pennies on the dollar, who do you think you're stopping?

Honestly, even if you're only paying $0.01 to send some random spam message before your number is blacklisted and message deleted, that's a pretty shit cost per click.

I'm not a spam guy, but even small costs like that would massively change the economics of bulk spam.

The many, many people who can’t. You can’t stop every spammer, but you sure can stop the angry twelve-year-olds.

Can you link to any terms of service, where it guarantees that pure use in a transparent way, so that I do not have to take word for it?

Terms of service can change at any time. If the data gets collected, given enough time, there is a non-zero chance that someone will look at it and go "how can we make money from this?"

That is true of course. I would like to have some terms, that really guarantee, that this aspect would not change and then I would like to see transparency in how data is handled on their end. Maybe those are not TOS then? What would that be called?

Facebook also once said that phone numbers will only be used for 2FA.

Given your entire business model is "growth and engagement", there is no reason to trust your word. It may be true currently but this can change at any time.

If they're only used for driving down the amount of spam, why don't you say so? You're not the only ones to do this, but I find "there's a problem with your account" demeaning as hell. If you want to use phone numbers to enforce one account per physical person, say so.

This is the spirit of the GDPR, by the way: collect as little information as possible and only use it for purposes that are related to the service you're providing. This seems like a very fair, very obvious deal, and you could just be open about what you're doing.

I registered an account several years ago, and it was blocked requesting phone number verification. I've been using it as a human for several years now. Why does it instantly get blocked again when I remove my phone number? Do you still, after several years of nonstop human use, owning servers, enabling 2FA, see me as a bot?

Resolved this with nyanpasu64.

Most other chat services use the phone number as a unique identifier that aids discovery of other people the users know. So using it just to drive up the cost of sending spam is kind of a waste. If the phone number was used as an identifier then most would be happy to just ignore attempts to start a discussion from people they don't presently have in their phone book.

In general, there are better approaches to avoiding spam in an IM system...

Interestingly, IRC operators also combat spam. But they never ask your phone number.

Spam does happen on IRC, but gets shut down eventually. Same as Discord and other messaging platforms.

I’ve run into far less spam on Discord than I have on IRC

Gee, you are doing a terrible job. Not even kidding, "Elon Musk profile picture Twitter account tweeting about giveaways" level of ineffective. You got the reverse problem too of banning perfectly normal users for spurious reasons and losing them in a support hell of "this decision is final".

There needs to be another way. Requiring attaching a unique physical identity (which phone number effectively is in many countries) is in my book unacceptable and the moment I saw that was a thing I immediately deleted my account and started trying to push people and projects away from it.

I can't believe how many people are having a negative to reaction to you saying, essentially, "We're doing the best we can." I can't begin to imagine the type of horrible stuff you and your team have to see on a daily basis.

> Not used for any other purposes

I'm willing to trust that you are there to help enforce the "not used for any other purposes." ... What happens when you leave the company? History says that 5 years down the road after the current team leaves, these numbers magically start being used for marketing, etc.

Its more likely that they just want the number for Multi-factor authentication. Not that I like, that every site now asks for a phone number. But it is more of a security reason. Otherwise there must be real people involved in oder to restore your account. It also insures that most of the user accounts are no sock puppets. Not every user has access to vast ammounts of mobile phone numbers.

Another great thread, describing this dilemma is "Don't build your castle in other people's kingdoms" https://news.ycombinator.com/item?id=29108662

In discords defense: It was never made for open source projects in mind, but gamers and small private communities. Having a free service provided might come with traps and pitfalls, but I would prefer that over having only paid online services. Choose your poison. I don't think discord is the right choice for FOSS communities.

It's to prevent people from creating unlimited "anonymous" accounts. Phone numbers cost money and are, in many cases, something that can identify you if needed.

Ah sorry. I did not see your comment while editing mine to include this argument as well.

It's also a good way to signal to investors and advertising partners about how many real humans actively use their services versus how many bots are using them.

> Its more likely that they just want the number for Multi-factor authentication.

You can do that with an app or an U2F key. You don't need a phone number for that and, in fact, SMS-based 2FA is mostly discouraged by now due to sim swapping attacks.

So it boils down to avoiding sock puppets (most likely IMO) and to collect your data (which is something nice to get on top).

The reason for having SMS-based 2FA as a default is that it's At least something.

Adding a U2F token and having SMS as a backup means that you don't have people locked out because their yubikey failed -- which happens.

Discord is trying to solve some of the bootstrapping problems that arise from "oh fuck my computer and phone were both stolen" -- which, again, happens.

While it's annoying, the reason communities activate this is to reduce spam/bot accounts.

It's a big problem on Discord and requiring a phone number linked to the account helps quite a bit :(

Same goes for twitch. Found this cozy stream and followed. Was called out, wished a merry christmas.

Wanted to say thanks, but couldn't, because apparently "verified accounts only chat" is a thing.

Well, not gonna share my phone number with the world.

My phone number is kinda holy to me.

Uhm that thing about the phone number is a totally losing battle. You should adapt by getting a burner phone with a separate number.

Or I just don't use such services.

I know it's not en vogue, but abstinence is one possible solution.

I don't feel like having to pay 10€/year for a burner phone (so the SIM isn't deactivated)

It's fine, I can live without most of these services just fine.

And if I can't any longer, I will walk that bridge then.

How do you achieve multi factor auth at all then, if you regard tour phone number to be a secret.

I only have multi factor auth enabled for clients of mine

Apart from that I use strong passwords.

Wasn't hacked in over 20 years :)

Your password can be as strong as it can possibly be, but a lot of services nowadays require MFA.

Correct and I don't use most of such services.

I survived without them before, I will now.

And I have more spare time then, to read, to exercise, to enjoy nature, to code...

TOTP does not require a phone number, and it's not vulnerable to SIM jacking.

That's up to the broadcaster not Twitch, everyone can set on their own.

https://i.imgur.com/im2JAkc.png

Well aware. It's not the only stream I am interested in.

Also similar to discord, because so far I wasn't forced to add a number there.

Maybe it's not up to the server owner, but it's also not mandatory on the whole discord platform

Up to the server owners

https://support.discord.com/hc/en-us/articles/216679607-What...

Thanks, so it's actually totally similar to Twitch.

Also not very inclusive, if you ask me.

I know people who have no phone on purpose :)

A lot of smaller Streamer only allow verified accounts only because there is a lot of spam happening and they don't have enough mods to deal with that

Was the first small streamer with such a restriction for me. (Mostly following small streamers, being a tiny one myself ;))

That's totally fine, I am not mad at them, I understand their motives.

It's then just simply not for me, is all.

You'll also enable it when your chat starts getting flooded with spam bots.

Na, I'll code a counter measure on stream and have fun with it.

Or just leave twitch g

Just an unimportant hobby, is all ;)

It does however sound like you put the blame on Twitch. Streamers are demanding more ways to combat spam. The community wants more intrusive verification, not less.

There is no sound in written word. While I totally get what you mean (being a non native speaker), I don't care as much as I did.

It's the same tone for me as was used on Discord. There it's also not discord, but the server owners (as I learned a few comments down)

Apart from that: yes, I somehow blame the "give us your phonenumber approach". It's a lazy solution and a couple of years back, before the "war on terror/drugs/childporn/whatever" we used to get sim cards without r egistration and a DNA test (the later is a slight exaggeration ;))

And of course big companies such as Amazon or Discord love data such as the phone number.

It's a super data point to link profiles across a variety of services

Is there really a lot of spam? In my experience, I just saw a robot subscription storm once in the past year at a small streamer (~100 people). I watch twitch roughly 3hr+/day.

Unfortunately a lot of twitch streamers get some very unpleasant spam attacks - things like racist chat flooding using bots.

Requiring an account to be verified, or a follower, or in extreme cases a subscriber is the only practical response as twitch moderation tools are practically useless.

Discord already has a huge problem with spam as-is. Yes, it may suck to be randomly locked out of your account when you haven't done anything wrong, but if they removed the requirement altogether it would just open the floodgates even more. Even if you don't trust them fully, they're not some random shady website that's likely to leak your number or use it for advertising. I've been regularly providing my phone number to big services like Discord for years and have never once received spam calls or texts for them. In the incredibly rare case that I do get spam it's always some Hungarian number rather than a foreign one, and they probably just got my number from some public database. It's much more common to get spam via email instead.

Either way, it's pretty easy to get a burner SIM or use Google Voice (if you're in the US), or services like getsmscode.com which provide disposable phone numbers that work with hundreds of major services for 10 cents per SMS, and you can even pay with crypto.

It feels like more than a coincidence that the flavor of "security" that comes out of these companies hinges on infringements of ever increasing amounts of their users' privacy.

> Even if you don't trust them fully, they're not some random shady website that's likely to leak your number or use it for advertising.

The last few years of leaks and hacks say that trust should never be implicit. Every company has the incentive to use your data for profit.

> It feels like more than a coincidence that the flavor of "security" that comes out of these companies hinges on infringements of ever increasing amounts of their users' privacy.

It is the same as in politics: saying 'because security', is a very convenient and easy way to get about anything accepted, little by little.

I get robo-called and scam-called every day, several times a day. Do you? I am interested to know whether your cautious behavior involving sharing phone numbers helps you to avoid this sort of attention.

I haven't even thought about it that way yet. I just generally want to avoid sharing things with companies unless really necessary. But no, I rarely if ever receive calls of that kind.

I get spam calls every day and they leave voicemails. Until a few months ago, I had disabled incoming calls on my phone because of this but recently had to activate it for a specific reason.

Often, the spam calls spoof the number to be either my OWN number or my area code too.

Reply on news.ycombinator.com