Dad stuck in support nightmare after teen lied about age on Discord

Data dump confirms dad's suspicions that Discord knew teen's age prior to hack.

See full article...

 

[RickRoyLeonPrisZhoraRacha]

Presumably, because his child has friends there she wants to keep in touch with. The network effect keeps a lot of people using all manner of shitty services. Particularly if you're a teen, being the one left out isn't exactly the ideal outcome.

There is nothing more heartbreaking than to watch your child/nephew/niece break down in tears that they've lost their friends/contacts when they did absolutely nothing wrong. Remember, their brains aren't developed fully, nor do they understand (FFS, look at the missing children for centuries!) that there are predators on these platforms...whether to abuse, steal or harm others. And these platforms are about monetizing users, not protecting them. Plus now, parenting (no wonder population in decline) is more difficult in monitoring or access to the internet. Its no longer, "be home for dinner" as your child walks 1/2 mile to friends house. While you can supervise, enable "parental controls", did they teach that in school/college, you as a parent are responsible. Get off that smartphone and raise your family! -off my soapbox

 

[jmpalk]

The reason there's tension is because:

1. Most parents are digitally incompetent. Their kids know more about computers, and parental-settings, and bypassing them, than parents do. Now, these days most kids don't know that much about the devices either--but they know worlds more than their busy and flustered parents

This isn't true the way it used to be. Parents these days are millennials, Xers and Gen. Z. It's not the Boomers anymore.

 

[GaidinBDJ]

Discord has a lot of problems to resolve with reguards to community safety, but when it comes to authenticating another person's identity they'll need accurate information (even if it's only your age). It honestly did not help that a kid lied about their age just to get on the platform.

There are schemes they could implement to verify that users of a site are over 18 without forking over your personal information to that site.

 

[colin1497]

The reason there's tension is because:

1. Most parents are digitally incompetent. Their kids know more about computers, and parental-settings, and bypassing them, than parents do. Now, these days most kids don't know that much about the devices either--but they know worlds more than their busy and flustered parents
2. We don't want to regulate internet companies. In part we don't know how. Freedom to just be anonymous and anything on the internet is kind of cool--except it enables and empowers scammers and predators too
3. Companies don't want to police themselves--because that costs money. That is true whether it is Discord or Google or Boeing.
4. Coupled with particularly in car-centric suburban USA, kids can hardly do anything without their parents needing to drive them somewhere--so kids turn to the internet, and its services, to fill their lack of easy out-of-school IRL social interactions because on a school night their parents want to unwind from work and not drive them anywhere to be able to do anything with friends.

And so here we are. An internet ridden with slop and scammers. Adults and kids becoming victims of them every day. Corporate actors washing their hands of it. And...there's no good answers.

Age verification sucks, because blanket laws will kill Linux. Already Arch and Bazzite and others have pulled out of places like Brazil that demanded Linux age-gate local OS user accounts. Age verification also sucks, because of the easy opportunity for ID theft damage.

As someone who is relatively competent I can tell you that "parental controls" are often broken (Apple controls suck, Microsoft's largely sucks, Nintendo does a good job) and if you want to do it for real you need good 3rd party tools and you need to lock down things at the network level. If you're in a situation like me with a very smart AuHD kid committed to the fight over video games, it's a battle where everyone loses.

I'll never forget learning that he'd figured out my Apple Watch passcode and used that access to get my Microsoft password from Lastpass and used that to access all EVERYTHING from my desktop PC, and that he'd been sneaking around with full control of everything for several months, sending me token requests for time to keep me unsuspecting... He was 10.

Or when he was sneaking in a Chromebook from school and using my USB-C dock to connect it to our network via ethernet because I had the wifi locked down. I think he was 14.

 

[nvemb3r]

There are schemes they could implement to verify that users of a site are over 18 without forking over your personal information to that site.

How could the site positively confirm a person's age without someone surrendering their government ID?

 

[Dividable2745]

It would be easy to develop an AI bot to recognize behavior that indicates an account has been hacked - e.g., share a malicious link, solicit financial information, solicit login information. And these are just some simple rules. AI excels at recognizing patterns. Train it on the posting behavior of known hacks and it becomes much more effective at recognizing problems.

But I guess there's no profit in that.

 

[tooki]

This isn't true the way it used to be. Parents these days are millennials, Xers and Gen. Z. It's not the Boomers anymore.

While you are correct about which generations are parents now, don’t underestimate how many younger-than-boomer people are technically incompetent. People often assume that anyone born since around 1975 is a “digital native”, but it really isn’t true. Yes, they will generally be more used to it being around, and even with using it, but it doesn’t mean they’re any more technically adept or competent. This misunderstanding leads lots of IT product designers to make bone-headed assumptions about what their users will know. And many of the people — including younger ones — who don’t know what the question or warning in front of them means will simply ignore it and consequently make a “wrong” decision.

As someone who used to work in user interface design (including user testing) and IT retail, I assure you, the average young person knows far less about technology than people assume.

 

[rho180]

I guess I’m old, but I fail to see how giving Discord a copy of your passport is a good idea with as many times as it’s been proven they subcontract that out to less than reputable companies. I think it should be illegal for any non-government entity to request a ‘copy’ of identity information.

I’d have made my kid start a new account or not engage on that platform, seems like a lot of effort for a ‘free’ platform to have accurate marketing data for a minor.

"Once Frey realized his daughter had been hacked, he assumed that Discord would promptly intervene, recognizing that many minor victims on her friends list could be harmed the longer the attacker kept control".

It sounds to me that they were trying to be good citizens and prevent further harm to others. Maybe I'm super naive to believe everything I read, but there was an article in the last year I read about extensive rings of people extorting minors on social media to get them to provide CSAM of themselves. From this article, they themselves were subject to an extortion attempt to recover the account. Without knowing the extent of her friends list or if they even had alternate means to contact all of them, we don't know if they could warn everyone.

 

[culus]

I have my own support sob story here.. When my son was born I opened a Google account to reserve a sensible name for him in the future. When he was old enough I gave him the account to use. In the duration Google changed their policies and to their credit there was an near-automatic system to correct the age. Great, it a proper minor account and it gets linked to the parental supervision.

Now step in Fitbit. He had a kids Fitbit device and it was working great. Then Fitbit forced an upgrade to Google accounts. No problem right? Somehow Fibit thinks his account is an adult account and you absolutely cannot pair a child Fitbit device to an adult Google account. Lots of stories on the internet about this exact problem. Crying children at Christmas when the parents can't make their Gift work. Fitbit support couldn't fix it or perhaps understand what was wrong. We ended up throwing out the Fitbit. Years later it is still broken.

Support said make a new Google account. No, I'm not doing that, he already has stuff in his account I want to keep, and you certainly can't have Fitbit use a different Google account from the Android phone's base account!

Writing this motivated me to look at the current state of affairs, perplexity says I have to remove the Fitbit service from the google account, wait 90 days and then it might start working again. So at least they recognize the problem..

There is a story in our local news, Meta decided to randomly cancel one of the local restaurants Instagram accounts. They never got it back. Lost all the marketing they had done, no recourse.

Sigh, it's dystopian.

 

[fruitbane]

While I get the "frustrating customer (lack of) support experience" going on in this situation — Discord clearly needs to fix their process — I am left SMH at the parent's ultimate idea of a "reasonable solution." When he realized it wasn't possible to re-categorize her account (by correcting her age), presumably limiting what parts of the platform she could access, how was "we're done with Discord" not the preferred solution??

Even if Discord had not been associated with previous breaches where many users' personal information was exposed / stolen, in what world does it make sense to provide extremely sensitive documents like a birth certificate copy, or scanning of a driver's license, or scanning of a passport, to a fucking social media company (!!), so that your not-yet-18 kid can continue "interacting with friends online in novel ways"??

Fucking hell.... I'm sure I'll get downvoted by a few "you don't get the pressure parents are under to give their kids access" types, and OK — there will be different philosophies — but:

Hey Dad, did the "we're done here and closing / deleting your account; you do not need to be on Discord," idea ever enter your thought process? And if not, why not? If the answer is "because my kid has so many gadgets or access points that I can't keep track of what she is doing," then you are the problem. Try this:

1. educate yourself (and your spouse or ex-spouse) on the platforms daughter and friends are using, by any means necessary -- using logs or other software to monitor her activity (i.e. don't take her word for it when asked), talking to other parents who have some form of real enforcement WRT social media, etc.
   
   
2. reign in her shit (including taking away a smart phone or tablet or whatever else, if existing parental controls for that device don't allow you to do exactly what you want).
   
   
3. teach the time-honored ethic of "when you're 18 and free, you can do whatever you like. But as long as you're a minor having every aspect of your life provided for by me and your Mom, you have choices x, y, or z for online interaction, because these are the ones I've vetted and can monitor and control in a way that minimizes the risks. Pick one or don't, but you're not using Facebook / TikTok / Discord... (or whatever mediums are applicable that can only serve as one more distraction from homework, one more more vector to harm mental health, and one more potential attack surface for predators.)

I get the feeling you do not understand the complexity of the intersection of pervasive technology and parenting. Even if you have your own kids, what you propose is simply too draconian and unworkable for many families.

 

[Castellum Excors]

Imagine if we got an actual presidential candidate who had data privacy as the tent pole to their entire campaign?

I wonder if they'd get JFK'd before or after winning the election.

 

[KrookedRooster]

So they say they will automatically set people BACK to being teens based on their review of accounts - and following the new age-gating rules - but they also say that they CAN'T do that once an account is created?

Then in this case they prove that they CAN they just don't WANT to.

It should just be a flag, which it looks like it is. I mean they have to be able to reset the account to be "of age" when they do become 18.

They just don't want to disentangle it from all the additional bs the account got associated with.

Also, why did she need to say she was 18? If you only need to be 13 why didn't she just only say one year was different? Did all of her friends lie then?

And throwing it back saying "well, she wasn't even supposed to BE here" is just top level BS. You didn't have a plan in place for situations where people would -gasp- lie?

 

[jm_leviathan]

I recall briefly using Discord for voice chat in World of Warcraft, like, a decade ago? When I hear about it now, it sounds like it's become Facebook or something. Kids these days...

 

[Rival Vector Plot]

Are these platforms and maintaining access critical to their future lives?

 

[buddhalite]

This seems to be par for the course for nearly all services these days. Last year an elderly family member lost control of an email address tied to a bunch of paid services. Surprisingly AOL actually offers support and helped with the account recovery, but a bunch of other services offered no help at all. The only way to cancel some services was to do a CC charge back which triggers a TOS violation and account closure.

Teaching that family member to use a password manager and 2FA is something I wouldn't wish on anyone. Ultimately with their knowledge we setup another device with all their credentials that we control to monitor notifications and emails.

 

[Golgatha]

I guess I’m old, but I fail to see how giving Discord a copy of your passport is a good idea with as many times as it’s been proven they subcontract that out to less than reputable companies. I think it should be illegal for any non-government entity to request a ‘copy’ of identity information.

I’d have made my kid start a new account or not engage on that platform, seems like a lot of effort for a ‘free’ platform to have accurate marketing data for a minor.

Indeed. Start a new account with correct information and have your friends block the old account. Lesson learned and move on with life. Also, although the Dad claims to be tech savy, he utterly failed to teach the importance of 2FA.

 

[Golgatha]

This is going to be an unpopular opinion.

Discord has a lot of problems to resolve with reguards to community safety, but when it comes to authenticating another person's identity they'll need accurate information (even if it's only your age). It honestly did not help that a kid lied about their age just to get on the platform.

I've worked in helpdesk where part of my job role was authenticating other people's user identities over the phone. A former employer relied on the outdated security question scheme, and users would put in BS answers to throw off any would be attackers. The problem would arise when the time came to authenticate, and the user couldn't remember their BS answer. Without authenticating, only their manager would have the authority to reset their password, and the user's shit outta luck of they happened to be on PTO.

Parents should teach the habit of using a password manager and storing the mismatching security questions and answers in said database. Said password manager should only be ran locally as well.

 

[Rombobjörn]

But the ticket was ignored, and the hacker wasn’t booted until Ars intervened.

That process also proved difficult, with two support tickets ignored before Ars intervened again.

a Discord spokesperson told Ars that the platform “takes situations like this seriously, [...]”

where "this" means a call from a journalist, apparently.

 

[Fatesrider]

We need to be able to also help the old. These types of issue with platforms are common and there needs to be better systems in place to help victims and the caregiver/family members resolve issues. I've dealt with something similar trying to help my mom who had her Facebook account hijacked and was scammed through Facebook. It was impossible for me to effectively help in this situation.

The best way to "intervene" is to be proactive, not reactive. If you're reacting, you're already fucked.

And it's NOT THAT HARD. The trick is to assume all new contacts are soul sucking vampire zombies and treat them accordingly. And that's it. Everything else should follow. I mean, it's not like us old fucks are just out of the cradle. We've seen some shit. So tell them that NO ONE can be FULLY trusted.

Ever. Anywhere.

As it SHOULD be everywhere, and especially on the Internet, trust is earned. That applies to all ages, all genders, all everything. It should be a VERY high bar to clear, and never given unconditionally. And anyone who asks you for any PII for any reason should be treated like they have the plague.

If that's the attitude people used all the time online, a lot less of this shit would happen.

It's not about what they say or do that should set you off. It's that they exist in the first place and are talking to you. Be suspicious, always.

 

[CuriouslySane]

“There’s no age recorded at signup, but there’s something worth flagging: her data includes an age_group field set to ’13–17,’ confirming Discord’s system knows she’s a teen,” Frey told Ars.

According to the data, Discord updated this field on March 9, about nine days before the account was hacked on March 18.

Isn't this more likely to be part of the teen by default policy that's been widely reported on?

“That they would not recategorize a minor’s account demonstrates this clearly,” Baldwin said. “Discord is in the business of making money by selling their users’ personal data. They are implementing ‘age verification’ to meet regulatory compliance and to collect more data about their customers, not protect children.”

I wouldn't dispute that this tension is there (for every platform), but I'd like to see a more substantial argument that it's sweepingly true of Discord, which remains mainly subscription based so far as I'm aware. Neither the author, nor the EFF spokesperson have shown their work to get to this conclusion.

 

[Hichung]

My son used a false birthday years ago and the end result was that 5 years later discord permanently locked his account (I don't recall why it came up that his birthday was wrong), and he can't create a new one using any contact information linked to the locked one. He's 18 now and has just written it all off and accepts that he has an extra email account just for Discord. We live in a stupid world.

If he’s only using 2 emails he’s got it pretty easy. I use a different email for every single website/service I use, including one dedicated to discord (a domain I own).

 

[cfenton]

Regardless of age Discord should be able to lock down the account in case of emergency.

Also couldn't the user just reset the password? It is tied to an email - unless the hacker commandeered that too. I didn't see a mention of email in the article.

It sounds like the hacker enabled two-factor authentication, which might have made email recovery impossible.

“Regardless of what age the account was set to at creation, my daughter is 13,” Frey said. “She was hacked. The attacker locked her out via 2FA, used her account to propagate the same attack to other children at her school, and attempted to solicit financial information from her and her peers.”

 

[Robin-3]

Did I miss the part where there were any consequences for this lying kid causing all this trouble?

IMO, not relevant to the story.

And frankly, while it's not ideal to lie about your age online, it's also (as the article pointed out) pretty damn common - and that's not totally bad either. My concern here is that she said she was an adult, not an older teen. But kids in the tween/teen age range want to push boundaries, to interact with their friends in ways parents can't directly monitor, to break some rules and feel like they're in control of some part of their life. That's age-appropriate, developmentally.

I'm not trying to suggest there shouldn't ever be consequences for any of this, but this also isn't a case of a kid doing something extraordinarily wrong. It's pretty par-for-the-course behavior for a teen.

 

[graylshaped]

They are implementing ‘age verification’ to meet regulatory compliance and to collect more data about their customers

Love of (advertising) money is the root of all (corporate) evil.

 

[Robin-3]

I really hate that the show-your-ID/AI-enabled-verification approach is being positioned as a solution to all this.

The underlying concern is real, and is made worse by platforms' realization that it isn't necessary to invest in actual customer support.

But the problem isn't one that will be fixed by us all agreeing to send images of sensitive and personally identifiable information to be ingested by huge tech companies and whatever AI hook-in they're using this week. No, that'll just give them more data to sell/abuse.

The underlying issue is that they really don't give a damn about individual user experience, because that's not where the money comes from. And I don't see that changing with the age-verification stuff; that's 100% a way to provide plausible deniability for the companies while profiting off user data.

 

[GaidinBDJ]

How could the site positively confirm a person's age without someone surrendering their government ID?

Site generates a token like this:

{ hash( site + userid + secret_salt ), age >= 18 }

User gives the site to some kind of trusted holder of personal information (say, your state DMV). If the rule is true, the DMV signs the token. The user then returns the signed token to the site. The site then checks the signature against the public key for the DMV.

The site knows the user is over 18 but nothing else about their identity, the DMV knows they verified the someone ages but doesn't know why/for what site. Because you're the one handling the token, you can see the information they're asking to be verified.

This is incredibly easy to implement. There are a buch of existing information-holders that could implement this (DMVs, Login.gov, credit bureaus, etc.) with pretty small amounts of effort. The scheme could also be used to verify all kinds of information and could be used by anybody.

 

[Ardrid]

Obligatory: fuck Discord!

 

[sennecca]

Asked for comment, a Discord spokesperson told Ars that the platform “takes situations like this seriously, especially when they involve teens and account security.”

Wrong. The platform is a machine and no machine takes anything "seriously." It responds according to its design, and if its designers didn't anticipate your particular situation, too bad and good luck. A human in the loop might take your situation seriously, but because humans are cost centers which hit shareholder value humans are to be avoided in any startup with ambitions of "scale."

This is the Machine we're building folks. Perhaps the anarchists have a role here after all...

 

[CmdrKeene]

2FA shouldn't be optional

 

[carldjennings]

My son used a false birthday years ago and the end result was that 5 years later discord permanently locked his account (I don't recall why it came up that his birthday was wrong), and he can't create a new one using any contact information linked to the locked one. He's 18 now and has just written it all off and accepts that he has an extra email account just for Discord. We live in a stupid world.

Lesson learned. Actions have consequences. Not always right away.

 

[sennecca]

My son used a false birthday years ago and the end result was that 5 years later discord permanently locked his account (I don't recall why it came up that his birthday was wrong), and he can't create a new one using any contact information linked to the locked one. He's 18 now and has just written it all off and accepts that he has an extra email account just for Discord. We live in a stupid world.

Indeed. A stupid world that we (by some definition of "we") are actively making stupider by the day.

 

[AngryEssay]

I guess I’m old, but I fail to see how giving Discord a copy of your passport is a good idea with as many times as it’s been proven they subcontract that out to less than reputable companies. I think it should be illegal for any non-government entity to request a ‘copy’ of identity information.

I’d have made my kid start a new account or not engage on that platform, seems like a lot of effort for a ‘free’ platform to have accurate marketing data for a minor.

Well the guy was apparently more concerned about letting the minor engage with her "pals" on Discord. Right.

 

[carldjennings]

I have my own support sob story here.. When my son was born I opened a Google account to reserve a sensible name for him in the future. When he was old enough I gave him the account to use. In the duration Google changed their policies and to their credit there was an near-automatic system to correct the age. Great, it a proper minor account and it gets linked to the parental supervision.

Now step in Fitbit. He had a kids Fitbit device and it was working great. Then Fitbit forced an upgrade to Google accounts. No problem right? Somehow Fibit thinks his account is an adult account and you absolutely cannot pair a child Fitbit device to an adult Google account. Lots of stories on the internet about this exact problem. Crying children at Christmas when the parents can't make their Gift work. Fitbit support couldn't fix it or perhaps understand what was wrong. We ended up throwing out the Fitbit. Years later it is still broken.

Support said make a new Google account. No, I'm not doing that, he already has stuff in his account I want to keep, and you certainly can't have Fitbit use a different Google account from the Android phone's base account!

Writing this motivated me to look at the current state of affairs, perplexity says I have to remove the Fitbit service from the google account, wait 90 days and then it might start working again. So at least they recognize the problem..

There is a story in our local news, Meta decided to randomly cancel one of the local restaurants Instagram accounts. They never got it back. Lost all the marketing they had done, no recourse.

Sigh, it's dystopian.

I would create a separate google account specifically for the fitbit. first.last.fitbit@gmail.com or something similar. Have that email account automatically forward to his real email account, sync calendars, etc.

Nothing says you have to get rid of the old account when you create the fitbit account.