Discord Servers asking for Phone Numbers and 'Verification Levels'
Discord Servers asking for Phone Numbers and 'Verification Levels'
cross-posted from: https://lemmy.world/post/10799766
(Edit: Cross-posted OP (link above) was mod removed by the Discord forum 'admin' on 2024-01-19 as being "False claim, false interpreted", so the above link will no longer work.)
Recently read this on a Steam game's reviews section ...
User Comment...
The game's Discord REQUIRES your personal phone number to get access at all. This is a very intrusive, and 100% unnecessary requirement, in order to just be able to interact with others about the game, it's content, player experiences, and many other things. It's also intrusive in regards to being able to contribute any input to help other players in any way at all.
Dev Response...
It's Discord that's asking you for verification of the account. We're not getting your phone number. This is standard practice on bigger servers that allows for a better user experience, filtering bots/ spam accounts, trolls, etc.
Could companies please STOP lying about it being Discord's choice, its not, is the Discord server's choice to ask for it.
Its a "Verification Levels" setting that the server op sets, and they have multiple options that they can choose from, its not an on/off switch. They can dial it back one notch and still have spam/bot protections.
The only difference between "High" and "Highest" verification levels is the addition of asking for a phone number, all other features of "High" is in "Highest", and "Highest" has no other extra features besides asking for the phone number.
Makes it really hard to have an pseudonym account on the Internet, for gaming purposes, and then be asked for your real phone number. I don't need to be tracked 24/7.
I came across this issue on my own discord server, the system kinda encourages you towards those higher security levels without really being especially clear about what it will do to the user experience.
One thing I would clear up though:
I think both sides in the OP are correct here.
Yes, the server admin sets the security level that triggers those requirements.
But it's also true that the server/admins do not get your phone number, that private information is only kept within discord's verification system. It is not sent to the server admins.
Interesting. I assumed Discord itself aggressively demands your phone number regardless of the "server" you join... At least, that's been my experience.
Of course, even if the company is wrong (and just dumb), they're still choosing to use Discord as an official channel.
Interesting. I assumed Discord itself aggressively demands your phone number regardless of the “server” you join… At least, that’s been my experience.
That's the impression that is being given, but its not true.
I've been successful in a very few cases of getting a Discord server admin to dial back the verification level from 'highest' to 'high' on their server, so that I was not prompted for a phone number. They agreed that the highest setting was overkill.
Most times though server admins refuse to do so.
Gotta wonder at this point if they actually see the phone numbers or not.Other server admins say they can't see the number, so will assume that's correct.on quite a number of servers that are 18+, higher verification usually sounds a little bit more safe. But then on most of the servers I run or moderate, we tend to have our own in-house verification methods instead of the built levels for discord.
the idea of the verification levels is attractive, however. anything to keep the kids out. though I'm not sure I'd go as far as requiring a phone number, I might consider it for future.
it depends on how the server is going to be used. why a gaming server should be highest level, I don't know. I would think "high" is enough.
Hopefully, Matrix [Element & al ] and Revolt will catch up to discord
I mean, I sort of get why the developers say it's Discord's policy even if it's a bit misleading.
Game developers don't really want to moderate their own discord server and simply want to use the strictest automated filtering system available and this just happens to include phone number linking. The operators of the servers themselves do not have access to these phone numbers and they are only stored by discord directly to prevent spam.
I would personally prefer games to not have their communities tied to discord, akin to how forums were big deal for games back in the day, but even then they do need some kind of automated way to filter out all the crap. This is a problem with moderating any community, including a lemmy/kbin/mastodon, and I don't blame them for simply picking the strictest option to ease the burden on the 1 or 2 people who are charged with managing these servers (especially if they are unpaid or volunteers, which is a whole other can of worms that shouldn't happen...)
I mean, I sort of get why the developers say it’s Discord’s policy even if it’s a bit misleading.
“It’s Discord that’s asking you for verification”
The language on that is very plain, and a lie, as it is the server admins, and not the Discord corporation, who are asking for it, by having the ‘Highest’ verification level setting, vs. just the ‘High’ setting.
Game developers don’t really want to moderate their own discord server and simply want to use the strictest automated filtering system available and this just happens to include phone number linking.
The only difference between the 'High' and 'Highest' verification level setting is the asking of the phone number. All other verification features (email validation/verification, time on the server before approval, etc.) are the same.
The operators of the servers themselves do not have access to these phone numbers and they are only stored by discord directly to prevent spam.
How exactly does that prevent spam, vs just using other existing established verification methods like email validation? If the only goal is preventing spam, its overkill, and other web sites who also have to contend with spam don't use it.
Finally, I'd feel allot better about it if a trusted third party verified that its not used for marketing reasons, and that we all just didn't take Discord's word for it. I don't know this as fact, but I can't help thinking that we are being lied to, and that the number is used to link our Internet pseudomnames to real-life persons (via agregate gathering/purchasing of data via third-party brokers).
Having said all that, my post wasn't about what is done with the number (that's a whole other topic), just the fallacy of stating who is requesting the number (Discord vs server admins).
How exactly does that prevent spam, vs just using other existing established verification methods like email validation? If the only goal is preventing spam, its overkill, and other web sites who also have to contend with spam don’t use it.
It's trivial to create new accounts and emails to verify those accounts. It is not trivial to get a new phone number since virtual numbers are blocked by the verification process.
The times I have run into this verification stuff, it's for servers that want to be for adults only. And so would much rather just give Discord my phone number than a copy of my ID to the server owner, like most of them want to verify I am over 18.
It's not hard to get a toss away phone number you can use for these things or for 2FA stuff. Like a throwaway email.
How does one go about doing that? Because Google Voice doesn't seem to cut it.
I could stop trying to use Discord and drive to Best Buy and buy a cell phone and pay for a month of service. Then I could add the number to the account. Then if I stop paying for the monthly service, there's a good chance that Discord or whoever won't believe I'm me at some future login and will demand I give them a code they sent to the phone number on file.
I could stop trying to use Discord and drive to Best Buy and buy a cell phone and pay for a month of service. Then I could add the number to the account. Then if I stop paying for the monthly service, there’s a good chance that Discord or whoever won’t believe I’m me at some future login and will demand I give them a code they sent to the phone number on file.
That's a lot of effort/cost that the user of a website/server has to do, just to access that website/service, when email validation already works (not as well, but still works).
The onus of the effort/difficulty of dealing with bots/etc. has been shifted from the website/server owner, to the user base.
The times I have run into this verification stuff, it’s for servers that want to be for adults only.
I'm an avid gamer, and most Discord servers that have to do with a certain game, like WoW private servers, etc., require them.
It’s not hard to get a toss away phone number you can use for these things or for 2FA stuff.
I've attempted that a couple of times, and Discord has detected them and rejected them every time. There's some kind of identifier associated with a phone number that allows Discord to determine if it comes from a third party source.
There's many articles and Reddit style conversations about the issue, if you want to read up on it further.
Use a google voice number or give it bunk data. But it is BS.
As someone who had run & managed a Discord server with 10,000+ users, there's only so many options available to us to try and limit bot spam and throwaway account raids.
Yes it's needlessly intrusive to an extent, but you really should try and look at it from their perspective. We didn't run that setting 24/7, but we were also a pretty niche (albeit relatively popular) server. For a server that exists for a fully advertised steam game, I can kinda understand the urge to lock down the security settings to the maximum.Even some of the best server-ran bots which try and stop / catch suspicious accounts just can't do the trick sometimes, and the best solution after that is unfortunately the nuclear option.
Yes it’s needlessly intrusive to an extent, but you really should try and look at it from their perspective.
As someone who worked in the computer software field his whole career, I sincerely emphasize, I truly do.
But we're talking about recreational access to forums to discuss things like a video games with someone else.
To give up that level of personal information, information that's stored without clear legal specifications of what's done with it, that can be hacked and stolen and used for nefarious reasons, is a bridge too far.
It's putting the security onus on the user, where server security should be the onus of the server admins.
information that’s stored without clear legal specifications of what’s done with it
First of all, this is just patently false, Discord lays out precisely what they will and won't do with information you provide to them in their Privacy Policy. That said, I'm not exactly championing giving every website or service you log into your phone number.
Regardless, you're still putting the blame in the wrong place. The onus for securing the server is still on the server admins, and they're doing exactly that by leveraging the security options made available by Discord. Don't blame the admins for taking necessary steps, blame one-click spam bot SAAS providers for making it a necessary step in the first place. I would even argue blaming Discord is even a step too far, because phone number verification does actually work to limit account creation spam.
As crippling as it might be to your sense of privacy, phone numbers are still a decent enough way to limit account spam since most spam creators are taking the path of least resistance and not going through the effort to set up a voip / prepaid throwaway phone line for every new account they create.
They can dial it back one notch and still have spam/bot protections.
This is a ridiculous claim to make, because of how useless the tier before phone verification is:
High is the next step security setting you can lockdown your server with. Including requiring a verified email AND being registered on Discord for more than 5 minutes. You must also be present in the server for longer than 10 minutes.
Those are not legitimate restrictions, please do not pretend like they are.
You have to balance privacy / security with convenience in the modern age. If you put more weight on your phone number than on your desire to interact with that video game community, then just don't join the server and claim the moral highground.
FYI, the cross-posted OP (link above) was mod removed by the Discord forum ‘admin’ on 2024-01-19 as being “False claim, false interpreted”, so the above link in the OP will no longer work.
Discord has 5 levels of user verification.
None.(none)
Verified email. (Low)
Verified email + more than 5 minutes old account. (Medium)
Verified email + >5 mins old account + member of server for more than 10 mins. (High)
Verified email + >5 mins old account + server member >10 mins + verified phone number. (Highest)Server admins can set the level. Some server sizes or types (community severs etc.) have a discord-mandated minimum level to qualify for the server type.
Normally (Medium) or (High) security is more than enough. Servers that experience raiding or high levels of trolling are recommended to choose (Very High) security as it makes it harder to make multiple accounts and evade bans or brigade a server.
Discord store the number. The server never sees those details.
Servers that ask for ID to ensure you are over age, are doing that in their own, and probably illegally handling that data, without adequate security.
The server sets the security level. Discord does the enforcing. It IS discord asking for the phone number. But only because the server asked Discord to. But the server definately doesn't see your phone number.
I run a game community server, and normally have security set at medium.
If raided, it goes to High.
If persistently trolled by a user or users that are ban evading (has happened only once), I turn it to highest for a bit.But I turn it back down after a bit.
A bigger server might not get that luxury.
If a server has stupid high security settings, chances are they have active troublemakers.Discord has 5 levels of user verification.
Just wanted to add that my OP has a link to the Discord page that breaks down each of the verification levels, if you want to read more about it.
it sucks, and it is absolutely necessary for some communities. i work for a small game company and we have one or two people that have gone to extreme lengths to contribute hate and saltiness to everyone there. im talking dozens of alt accounts made over the course of years. discord provides the tools for these verification paths. its a choice on behalf of the discord managers to enforce the different levels of verification, but it is absolutely discord that stores and verifies that data. we've tried other methods before, like alt identifier bots, and ive been in communities that do personal ID verification, and neither of those are trustworthy. discord is doing their best, and the kinds of people that complain about these things either are ignorant of the challenges such communities face, or are themselves the problem.
Or you could just ban people when they get out of line like we've done since the dawn of time, dont act like modding a discord is a high level job
You did read how these trolls have alts built up over years, right? These aren't normal trolls OP is dealing with
As Discord is still unable to provide a GDPR compliant process for the phone number thing (and let's not even start about personal ID), if I were a small game dev I would rather not make myself liable the way one does when using this - it's simply fucking expensive.
discord is doing their best, and the kinds of people that complain about these things either are ignorant of the challenges such communities face, or are themselves the problem
Did you really have to end a decent comment on a personal attack?
Have you not considered that people just want to keep their anonymity for other reasons?
That asking for such a personal piece of information, that has ramifications if it gets out in the wild, for such a minor thing like a discussion of a video game website, wouldn't want to give their phone number? (Lots of server hacks these days on the news where people's personal information gets out on the dark web, etc.)
I can't prove a negative, that I'm not something, but for what it's worth, I'm not the kind of person you described. I'm a retired computer programmer who is a decent human being.