Three hacktivists tried to find a workaround to Discord’s age-verification software. Instead, they found its frontend exposed to the open in
Ten days ago, the social chat app Discord announced that it would launch “teen-by-default” settings for its global audience. As part of this update, all new and existing users worldwide will have a teen-appropriate experience, with updated communication settings, restricted access to age-gated spaces, and content filtering that preserves privacy and meaningful connections, the platform said. This, of course, means that to use Discord the way you are used to, you’ll have to let it scan your face, and the internet wasn’t happy. Many communities quickly announced their move to other platforms. Others, like the security researcher Celeste, who goes by the handle vmfunc, were convinced there would be a workaround. Together with two other researchers, they set out to look into Persona, the San Francisco-based startup that’s used by Discord for biometric identity verification – and found a Persona frontend exposed to the open internet on a US government authorized server.
“Beyond offering simple services to estimate your age, Persona’s exposed code compares your selfie to watchlist photos using facial recognition, screens you against 14 categories of adverse media from mentions of terrorism to espionage, and tags reports with codenames from active intelligence programs consisting of public-private partnerships to combat online child exploitative material, cannabis trafficking, fentanyl trafficking, romance fraud, money laundering, and illegal wildlife trade.”
Nightmare world
The link isn't seeming to load, so here's an archive.is:
https://archive.is/vlUXU
