Hacker News Reader

Comment by slashink | Hacker News Reader

Phone number verification is purely one of many ways for Discord to drive down the amount of spam. Not used for any other purposes. We’re ofc working hard on enabling alternative solutions.

Source: I lead the anti-abuse team at Discord

View on HN

This phone number thing is a deal-breaker for me. Skipped several communities over that in fact.

I can't be bothered to fetch a burner sim every time someone or other wants a number.

And I'm not giving out any of my more permanent numbers to who knows whom.

I have enough spam and phishing attempts on them already, thank you very much.

(and it's not like I imply that you're behind the attempts, it's just numbers leak left and right)

Create a Google voice number and use it as a burner for all such accounts?

They probably block Google voice numbers, many similar services do.

I run into issues occasionally, but my GV number works more often than not.

Do you understand how invasive it feels to be asked for a phone number?

I think this is a generation gap thing. Most people under 30 don’t call or text anyway, so a phone number feels like pretty useless and low priority personal information.

I don't call or text much, but I don't appreciate how phone numbers cost money and are intrinsically tied to your personal identity (unless you're an adult and spend time and money shopping for burner phones), whereas email addresses and Matrix accounts are permissionless.

The phone number being tied to your identity is the entire point. If you get banned from a community are you really going to go to Verizon and ask for a new one every time you want to join again? The alternative is the kind of problem that is all too common on IRC where a troll keeps making burner accounts faster than the mods can ban them and generally ruining the experience for everyone else in the channel.

I'm under 20 and still share the same opinions with most in this thread. I don't give out my phone number unless I'm talking to you in person.

… you really think most people under 30 don’t text?

Not via SMS in my experience, no.

Your experience is a bubble, and a very different claim than "most people under 30 don't text"

I imagine this is geographic. Texts are quite expensive in some places, and that means people use alternatives instead. Also some people had pervasive mobile phone usage for a long time before smartphones made other options available, which I imagine would add to their popularity. Here in Denmark SMS is very entrenched, but I know it varies in other countries.

I thought it was pretty clear I was referring to SMS by context given that other forms of texting don’t require a phone number

For most people, not really?

Plenty of apps require it now, and I wouldn't be surprised if it overtook email as the standard verifier.

As a multi-time victim of SIM swaps and even a related SWATing, I sure as hell hope not.

Then don't use the service...

> Not used for any other purposes

...for now. I'll never give out my phone number to discord. The messages aren't even E2E encrypted.

I understand the concern, trust me. We’re working on alternative methods.

Honestly, after running into the phone number requirement it's gonna be hard to get back my trust.

You required the phone number after you got all my account details. You wouldn't let me remove my account without first giving you my phone number. When I contacted your support to get you to delete my data, a simple back and forth like "you're gonna lose all your data!" and "I don't have any data" made them completely fail the Turing test. It's clear they don't really read what I was writing, they're just responding to whatever the first thought is that comes to their head.

I don't know if they're overworked, underpaid, or have quotas. Either way, none of the experience of trying to join an OSS development channel on Discord are in any way conductive towards trust. I mean, I couldn't even copy and paste the phone number requirement error message.

So let's say that in the future you got this alternative method deployed but then, what happens with already acquired phone numbers? Will you remove it once this method will be running nicely? Or you'll keep phone numbers giving a promise you won't use it to anything naughty and users will have choice to either keep it for "security purposes", or they will have ability to remove it by themselves directly from the client or by going the longer way, asking support to remove it from account data? Can you tell which solutions were considered so far?

Also, not sure if you're aware there but in some countries it's no longer possible to use SIM card without registering it first under name and last name and that means, the state has a possibility to track your online presence.

If you give me the option to verify my account for 1$ or something like that instead, I'd much prefer and just use that and accept it as an alternative. If phone number is enforced as the only option, I find it hard to believe that spam is the only reason you want it and that the phone number won't be used for other things (in the future).

As has been said, there is sadly little reason to trust a company in that regard. Usages of user data are always expanded upon, official (or unofficial) promises from companys aren't worth anything, and leaks also happen all the time.

Provide a specific commitment. What methods, and when will they become available? "We're working on it" is worthless and when I'm told this I assume I am being blown off.

Facebook also once said that phone numbers will only be used for 2FA.

Given your entire business model is "growth and engagement", there is no reason to trust your word. It may be true currently but this can change at any time.

Interestingly, IRC operators also combat spam. But they never ask your phone number.

Spam does happen on IRC, but gets shut down eventually. Same as Discord and other messaging platforms.

I’ve run into far less spam on Discord than I have on IRC

I registered an account several years ago, and it was blocked requesting phone number verification. I've been using it as a human for several years now. Why does it instantly get blocked again when I remove my phone number? Do you still, after several years of nonstop human use, owning servers, enabling 2FA, see me as a bot?

Resolved this with nyanpasu64.

Can you link to any terms of service, where it guarantees that pure use in a transparent way, so that I do not have to take word for it?

Terms of service can change at any time. If the data gets collected, given enough time, there is a non-zero chance that someone will look at it and go "how can we make money from this?"

That is true of course. I would like to have some terms, that really guarantee, that this aspect would not change and then I would like to see transparency in how data is handled on their end. Maybe those are not TOS then? What would that be called?

Most other chat services use the phone number as a unique identifier that aids discovery of other people the users know. So using it just to drive up the cost of sending spam is kind of a waste. If the phone number was used as an identifier then most would be happy to just ignore attempts to start a discussion from people they don't presently have in their phone book.

In general, there are better approaches to avoiding spam in an IM system...

If they're only used for driving down the amount of spam, why don't you say so? You're not the only ones to do this, but I find "there's a problem with your account" demeaning as hell. If you want to use phone numbers to enforce one account per physical person, say so.

This is the spirit of the GDPR, by the way: collect as little information as possible and only use it for purposes that are related to the service you're providing. This seems like a very fair, very obvious deal, and you could just be open about what you're doing.

Gee, you are doing a terrible job. Not even kidding, "Elon Musk profile picture Twitter account tweeting about giveaways" level of ineffective. You got the reverse problem too of banning perfectly normal users for spurious reasons and losing them in a support hell of "this decision is final".

> Not used for any other purposes

I'm willing to trust that you are there to help enforce the "not used for any other purposes." ... What happens when you leave the company? History says that 5 years down the road after the current team leaves, these numbers magically start being used for marketing, etc.

There needs to be another way. Requiring attaching a unique physical identity (which phone number effectively is in many countries) is in my book unacceptable and the moment I saw that was a thing I immediately deleted my account and started trying to push people and projects away from it.

I can't believe how many people are having a negative to reaction to you saying, essentially, "We're doing the best we can." I can't begin to imagine the type of horrible stuff you and your team have to see on a daily basis.

i get phone numbers for pennies on the dollar, who do you think you're stopping?

Honestly, even if you're only paying $0.01 to send some random spam message before your number is blacklisted and message deleted, that's a pretty shit cost per click.

I'm not a spam guy, but even small costs like that would massively change the economics of bulk spam.

The many, many people who can’t. You can’t stop every spammer, but you sure can stop the angry twelve-year-olds.

Reply on news.ycombinator.com