IT Essentials: Chronicle of a hack foretold

Can’t say we weren’t warned

They said it would happen. There are valid arguments for age verification in theory, they said, but it’s the practice you need to watch out for.

No-one wants to see children exposed to all the horrors that exist on the internet, but you need to approach it as an engineering problem, not just a moral one. Otherwise sites will outsource age authentication to a third-party provider in what is still a wild west of largely untested solutions.

And lo, it came to pass. Social messaging app Discord, whose Ts&Cs state “the image of your identity document and the ID face match selfie are deleted directly after your age group is confirmed,” nevertheless appears to have leaked 70,000 proof-of-age IDs, and counting, into the hands of hackers unknown.

Details of exactly what happened are still emerging, with third-party verification provider Zendesk denying that it is at fault. But the only surprising thing is that it happened so soon after the Online Safety Act started enforcing age verification on “risky” sites.

There are ways to ensure privacy preserving and reasonably secure and accurate age verification but storing unencrypted images of passports and driving licences isn’t one of them. As illustrated by the long list of attacks on outsourced CRMs recently (JRM, Co-op, M&S, Qantas...), organisations need to be much more vigilant about the quality of what they’re paying for when it comes to safeguarding sensitive materials.

IT Essentials: Chronicle of a hack foretold

Can’t say we weren’t warned

Recommended reads