Hacker News Reader

Comment by kossTKR | Hacker News Reader

If this db contains phonenumbers everyone has effectively been doxxed. All sites requiring phonenumbers should be outlawed or get shut down if they have any breaches, this is potentially a privacy catastrophe and potentially dangerous for thousands of individuals.

View on HN

Discord is the worst offender because it only allows one phone number to validate one account.

Meanwhile I have multiple Google and twitter accounts validated through one phone number.

Makes absolutely no sense now lots of businesses are using Discord so how are you supposed to have a business Discord account.

You don't need to verify.

For many communities on Discord you must verify to gain entry.

That's the community's choice not discords... https://support.discord.com/hc/en-us/articles/216679607

And discord is making it impractical for those communities to make that choice

How?

Please read this comment chain from the beginning

Your comment still doesn't make any sense. Either you want the highest verification tier and go with phone verification, or you don't. It's your choice as admin. As a user you can just delete the phone number from one account and use it to verify another... you will have a timeout [2] but both accounts will be verified. Is it annoying? Yes. Is it understandable to rate limit it? Yes. Is it impractical? No.

[1] https://support.discord.com/hc/en-us/articles/4413460214807-... [2] https://support.discord.com/hc/en-us/articles/360000961212-P...

I can't remember why but I had to switch my phone number from my personal discord to my work discord, either to get it to allow me to login from my iOS Discord or something else asinine. I remember it took me maybe 40 minutes to get into the thing, haven't seen anything like it.

So yeah, essentially you do need to verify.

They're weird about it, sometimes you have to and sometimes they never ask. It's not like Twitter where you can use the site for an hour before they force you to verify. They probably do it so people will say what you said when people point out the problems with it.

Personally I've had google accounts locked and suspended for using the same phone number on multiple accounts.

Twitch requires your phone number to a) become verified (because apparently paying them every month for 5 years is not a verification) and even dumber, b) to enable TOTP.

And people on the Twitch subreddit insult you for even questioning this issue, even after they had a data leak. And yes, that's a majority opinion over there.

It's sad.

Some communities (fandom is probably a better word) are more like cults of personality than actual communities.

Given the fannish nature of Twitch and its audience in general, this level of almost religious fanboying and "how dare you question the Gods" mentality is very familiar (my teens and 20s were spent in fandoms - first anime, then comics, then furry).

I've seen this in every single one of them to some extent, but especially furry and Twitch. It's sad, because -- as they, sunlight is the best disinfectant -- and all this does is block the sunlight and discourage people from talking about issues.

Both twitch and YouTube's subreddits aren't moderated by staff, but by random tryhards. If they don't like you, you're banned. Reminds me of Wikipedia.

Reminds me of furries, and a lot of other fandoms actually.

A: "Hey I had a problem at the con this weekend"

B: "How dare you talk about that, that's DRAMA! Take your DRAMA elsewhere, LLAMA. I'll have you know the guy who runs ConWeekend is my best friend! You're Banned for life! Long live ConWeekend! And here's that Japanese BANNED meme video to play you out! HAHA I SAVED THE FANDOM!"

Tbf, that's what I expect, most subs are community-run. But even if not, that'd be telling me a lot about the community.

You don't sign into a website forcing you to give them your real phone number if you fear being doxxed. How can anybody feel "anonymous" at that point?

I put a fake phone number into Twitter and a throwaway email. Got a few complaints about not having verified my number, then got banned for breaking the rules.

“Your account is permanently suspended After careful review, we determined your account broke the Twitter Rules. Your account is permanently in read-only mode, which means you can’t Tweet, Retweet, or Like content. You won’t be able to create new accounts. If you think we got this wrong, you can submit an appeal.”

I can’t even follow anyone, but at least I can read tweets.

As I tweeted nothing nor indeed followed anyone all I can assume is that you have to have a real phone number to sign up.

Maybe you don’t but plenty of people do. There’s a huge middle ground of people who aren’t aiming for “anonymous” and who aren’t doing professional opsec, but still expect not to have their pseudonymous online identities linked to their real-world-identity phone number.

OP is right, this is a privacy disaster.

Companies know that people think like this nowadays, so they only require the phone number after you are already invested into the service. Twitter had this where they would allow you to not set phone initially, but then ban you some time later and require it to lift the ban. Microsoft also bans you for “suspicious activity” and the only way to unlock account is to “verify” your number. You can only contact them about it via another ms account or… by phone. Fuck everything about this tbh.

For everyone to know, Instagram does this too in a way. They would let me sign up with just an email, verify it, then at first login auto ban me. Giving me the option of appealing and tracking said appeal by giving them a phone number.

The only way I could resolve it was by using a phone number. Meanwhile they've harvested 2-3 of my anon and temp emails.

Twitter doesn't require a phone number anymore. You can use it via the website or a mobile app. I have a an account from 2014 and it does not have a phone number associated.

You can create an account without a phone number, but the account is suspended as soon as you post anything.

Yes.

This happened to me.

I made an account, not using a phone number.

I then did not use it, for something like a month.

I posted - and the account was suspended, I was emailed, "you have violated our T&C, please provide your phone number to validate your account".

I may be wrong, but to my eye, they were attempting by deception to trick and force users into handing over their phone numbers.

I explained I had no phone number, and I had not posted at all, so it was hard to see how I had violated the T&C, and the account was unfrozen, and has been fine since then.

Exactly. This happened to me multiple times. I even had accounts for some of my side projects with phone numbers that got suspended.

> Twitter doesn't require a phone number anymore. You can use it via the website or a mobile app.

You used the word ”anymore”.

Obviously, you are implying that Twitter required a phone number in the past, but because you did not specify the time of the change, we must assume. It could be that phone numbers are not required since an hour ago or a year ago.

Regardless, if it was a requirement, chances are high that a good portion of the 400+M users in this (supposed) data breach were encouraged to share their phone number with Twitter.

Not to dismiss your contribution but if you have to write ”anymore” I don’t see the point of your comment.

I don't know if something has changed recently but at least as of 2016 when I signed up for a new account, I got immediately placed on a suspicious user list and had to use a phone number to prove I was a human. It was just a prepaid cell phone number that I don't even remember anymore so I don't know how it helped anything but yeah.

I suspect twitter did this to pretty much everyone.

Twitter originally was done via SMS, that's why status lengths were limited to 140 characters. So, obviously you needed a phone number when it first started.

It was never only sms though.

> Twitter originally was done via SMS, that's why status lengths were limited to 140 characters. So, obviously you needed a phone number when it first started.

This isn't what we are talking about. We are talking about requiring users to "prove they are human" by giving Twitter a phone number and then entering an authentication code that they text to that number.

It doesn't accomplish anything because I can get a new SIM card and a month of "unlimited" talk and text prepaid service for about USD 20(?). I didn't think of it much but looking back it is clearly a data grab.

Stallman has a note about it from about 2017 along with a note that one of the criteria was being a Tor user at some point: https://web.archive.org/web/20170224183228/https://stallman....

What about for multi-factor auth? Are these phone numbers leaked too?

From the csv sample fewer than half include a phone number.

Deleted. trifurcate is right.

> And for once it’s the people in power that are going to be disproportionally affected

Seriously? The people in power probably have many, many phone numbers, and getting a new one is not such a big deal.

Getting a new phone number is a much bigger deal for people not in power, and so are the possible negative outcomes from this (e.g. revealing the hidden identity of stalked or politically prosecuted individuals who are not in positions of power)

That's a good point. Perhaps a weaker claim is just the idea that people in power (or more generally, people of influence) are as likely to have skin in the game, which can only drive engagement on the issue. That's different to many issues for which those in a position of power are often less affected directly.

I think you may be over-estimating the technical competence of "people in power" there.

Reply on news.ycombinator.com