Hacker News Reader

Comment by judge2020 | Hacker News Reader

judge2020

Mobile number is required if the admin of a server sets its verification level to "highest". This is often needed because spam bots are rampant and will do anything, including solving a regular captcha (which discord also employs via hCaptcha), to send spam in direct messages and channels.

View on HN

This is one but not the only case discord uses mobile numbers. If for any reason discord figures you are a probable source of spam - they dont tell you the criteria for that for obvious reasons - discord will present you with a prompt to verify with a unique mobile number. They only tell you so after the normal email signup and the profile will be instant locked. So you are locked out on profile not on "server" level. For people not on discord: A "server" is something like a subreddit or a part of discord which is subadmined by a certain group/admin. The thing is whatever they exactly do it can flag you for any reason, not only if you really spammed the platform and they seem to use rather creepy technology to make the flagging sticky. At least flushing your browser profile and changing IPs is NOT enough to remove it, so they might be using TLS supercookies, screen resolution or whatever. Would be intresting if some privacy researcher reverses their tracking tech. I had that happen to me in the past and cant tell you what exactly caused it. It may (and equally likely may not) have been caused by an account of mine being thrown out of a "server" after pointing out some lets say inaccuracies that our student government spread. (I didnt spam the server. But it contraticted some talking points they rather not want contraticted.) This wasnt a platform ban either just a local admin action, but it teached me you really want seperate identifiers for different tasks, especially if you somehow engage with politics, cause otherwise crazy people will start following you around and discord makes it easy to track you across servers. You would probably run into the same issue if you engage with health related, nsfw or really any non mainstream content. Other reasons discord might figure you are a likely spam source might be use of a vpn or a network range they already have seen spamming. I cant tell you if they also just want to collect numbers, a blog post of then claimed they only do so to combat spam and not for advertising. At least in germany mobile numbers are tied to your real identity: To get one you have to provide ID to the mobile provider so the goverment has an easier time to spy on you if it wants to. Also you can be followed between platforms with the number. For example you would be able to find me on signal if you had my number. There are ways to firewall against this by using virtual mobile numbers (google voice or something) but they can be detected, it is work and Im not sure if they are allowed or blocked. Lastly, at a certain point you can only join so many "servers" with a free account, which will be quickly reached if every damn software project out there uses one. Though I think this is fair from discords POV. I mean in the end they need to make money somehow.

> At least flushing your browser profile and changing IPs is NOT enough to remove it, so they might be using TLS supercookies, screen resolution or whatever.

Fairly obvious that they flag your account in their database. They can't use TLS supercookies for the primary reason that all of their traffic is proxied through Cloudflare - every API call, CDN image, and websocket event.

Cant be just that. You can change your IP, create a whole new browser profile and of course not log into your old account and it will still flag you. It might just be that Im unlucky and for some reason outside of my control whole regions of my ISPs adress space are flagged.

Yes because the flag is on your account.

The flag is not on my (usually used) account. I can perfectly use that one (though it seems to be the case that old accounts can and sometimes are flagged, not for me though). It is set on new accounts in an otherwise empty browser profile over a clearnet connection in the adress space of a rather large ISP. So there should be no context to work with at all unless creepy things are done. Having some amount of google cookies didnt help either.

Reply on news.ycombinator.com