Discord Servers asking for Phone Numbers and 'Verification Levels'
cross-posted from: https://lemmy.world/post/10799766
(Edit: Cross-posted OP (link above) was mod removed by the Discord forum 'admin' on 2024-01-19 as being "False claim, false interpreted", so the above link will no longer work.)
Recently read this on a Steam game's reviews section ...
User Comment...
The game's Discord REQUIRES your personal phone number to get access at all. This is a very intrusive, and 100% unnecessary requirement, in order to just be able to interact with others about the game, it's content, player experiences, and many other things. It's also intrusive in regards to being able to contribute any input to help other players in any way at all.
Dev Response...
It's Discord that's asking you for verification of the account. We're not getting your phone number. This is standard practice on bigger servers that allows for a better user experience, filtering bots/ spam accounts, trolls, etc.
Could companies please STOP lying about it being Discord's choice, its not, is the Discord server's choice to ask for it.
Its a "Verification Levels" setting that the server op sets, and they have multiple options that they can choose from, its not an on/off switch. They can dial it back one notch and still have spam/bot protections.
The only difference between "High" and "Highest" verification levels is the addition of asking for a phone number, all other features of "High" is in "Highest", and "Highest" has no other extra features besides asking for the phone number.
Makes it really hard to have an pseudonym account on the Internet, for gaming purposes, and then be asked for your real phone number. I don't need to be tracked 24/7.
The language on that is very plain, and a lie, as it is the server admins, and not the Discord corporation, who are asking for it, by having the ‘Highest’ verification level setting, vs. just the ‘High’ setting.
The only difference between the 'High' and 'Highest' verification level setting is the asking of the phone number. All other verification features (email validation/verification, time on the server before approval, etc.) are the same.
How exactly does that prevent spam, vs just using other existing established verification methods like email validation? If the only goal is preventing spam, its overkill, and other web sites who also have to contend with spam don't use it.
Finally, I'd feel allot better about it if a trusted third party verified that its not used for marketing reasons, and that we all just didn't take Discord's word for it. I don't know this as fact, but I can't help thinking that we are being lied to, and that the number is used to link our Internet pseudomnames to real-life persons (via agregate gathering/purchasing of data via third-party brokers).
Having said all that, my post wasn't about what is done with the number (that's a whole other topic), just the fallacy of stating who is requesting the number (Discord vs server admins).
It's trivial to create new accounts and emails to verify those accounts. It is not trivial to get a new phone number since virtual numbers are blocked by the verification process.
Is it really that trivial, especially while having to spend your own money to do so?
And can't that be detected in the same way that virtual phone numbers are detected by Discord currently?
You get your ISPs email address, and you could have your Google address, what else?
Granted, a phone number is better than email for verification, but plenty of websites work off email verification today successfully.
What are you talking about? There are endless services where you can get a free email address without spending a cent. Verifying that an email is genuine is a much harder ask than you might think.
Fair enough, but then how is it used today successfully by websites?
That's the thing, it's not. Lots, and I mean lots of sites are plagued by bot activity. The ones hardest hit are the ones that only have email validation.
I could go to Google and create a new account right now, absolutely free.
Hell, I could write a script that creates a million for me for barely any money, just paying a CAPTCHA farm a nominal sum to solve the robot tests for me. This is why sites like discord are plagued with advertisement bots, the bar to entry is literally nothing.
Phone numbers cost money to create, and are in finite supply. Even PAYG (pre paid numbers for you Americans) numbers require you to go outside and purchase a SIM card from a store. They aren't foolproof, but they stop the vast majority of fake accounts.
But those other websites that suffer the same kind of issues work successfully without asking for a phone number, just via email verification. I don't see why Discord should be any different.
I understand all of those ramifications, and not arguing against it.
However, it's moving the onus of dealing with the issue from the website owners to the users who use the website. It causes the users to lose their anonymity, and allows their website usage to be tracked and sold. That's a step too far.
How else is the platform owner to prove that the account is linked to an actual person without defeating the check being trivial? They can't without something being tied to you. An email address may have been a good one to use back when AOL gave out addresses as part of their subscription service, but the availability of free email has destroyed this possibility. Out of the many things that could be asked for you to provide, a phone number is the least nefarious.
You reserve the right to not give your phone number to Discord. You do not need to give Discord your number in order for you to be able to use it. Likewise, the server owner reserves the right to ask Discord to only allow accounts that have been verified to not be burner accounts. Email verification does not do this, and the time limits on membership only go as far as slowing down accounts used in bad faith in a server, whether that be scams, trolling or otherwise.
Like many things in life, it's a trade-off. You value your right to privacy more than being granted access to this particular server. The server owner values the reduced ability of trolls and bad actors over the loss of membership from users like you. Unfortunately you cannot have your cake and eat it too.
The only alternative I can think of is just buying a pre-paid number and a cheap second hand phone and using that only to verify with services. It's good for 2FA too as it makes you immune to SIM swap attacks.
As the owner of a 2000+ user server, this setting is an absolute necessity because yes, disposable email accounts are plentiful and Discord still does a poor job of detecting them. Server raids still happen, and temporarily restricting access to non-verified accounts helps mitigate this.
However, Discord's phone number verification blocks most VoIP or burner numbers from being registered. It's one of the few things Discord does pretty well these days, IMO.
I host my own email. I have literally billions of email addresses available if I want them and getting billions more only costs however much I can get a new domain registration for, which isn't often more than $10. I already own a dozen domains or more and I can have any username I want at any of those domains for any email at no additional cost.
Now I'm not some dickhead harassing people online or spamming discord servers, but I will admit that Wendy's once had a deal where you could get a free frosty for creating a new account and I had free frosty coupons for weeks before they realized that email only verification for unique users was a losing proposition and they switched to requiring that new accounts attach a phone number.
Email verification only works if you've got nothing to lose. As soon as there's anything on the line, you'd better look for something more concrete like a phone number, a credit card, or a government ID. Personally I'm more comfortable with Discord having one of those pieces of info before the other two, but that's just me, you do you.