I love how EU always, no matter what, proves American companies that you don't and can't mess with EU laws, it's not the USA. The first was Apple and them being forced for USB-C. Now Discord. I can't wait to see more of this, it's so fun.
Article 13 is also used to make sure any user can demand (by right) the company to disclose ALL information they have about you and your right to demand that informations deletion.
I'm a bit weirded out by this, Discord implemented an automated data dumping too for your own account years ago when GDPR passed. It's in options > confidentiality > Ask for your data, and it's been that way for years. The issue here is that the package was slightly incomplete, it lacked a few timestamps... The confidentiality policy is also right here, and article 6 clearly states a 2 year data retention limit after account deletion (which you can do in the app). Some of it is new, the vast majority isn't. Discord got fined on technicalities here.
i actually feel bad over the account deletion as a couple of my friends have people they knew who died and their little profile there was a sad but sweet reminder of the person
Sadly they have no obligation to hold up account that are inactive. As long as it's here you can look at their messages, take screenshots and keep it. It's not the same but it's not the end
@@Chronor Sure. Let me burn all the letters from my loved one, their clothing, and any pictures/videos I might have had. It's not like people want to be able to remember someone /s
Most of these are just minor privacy issues IMO. The biggest two problems I know of when it comes to privacy on Discord are users being unable to delete messages from a server they're not in anymore, and people being able to share uploaded user media across server without the original poster being aware of it or able limit the publicity.
a lot of big servers already got bots which keep logs of everything including every deleted and edited message there with the id of the user in a channel only the mods can see (I was just stating this as something that exists I would also prefer if deleting stuff on servers you aren't in was an option) "people being able to share uploaded user media across server without the original poster being aware of it or able limit the publicity." by this you mean the .cdn links well people can easily download the media and upload it again without using those links but having those links helps discord by not keeping redundant data stored I suppose if someone is gonna download a media and upload it to another server leads to more data being stored on discord servers so other to save on data it would be beneficial for discord to have those users send those links instead. also one more thing I noticed is if you delete a media and someone's got a link of it. the link stays active for like a week after the the media got deleted
Kind of confused by what you mean by "people being able to share uploaded user media across server without the original poster being aware of it or able limit the publicity". So I post this meme on a server, several people find it funny and decide to download and repost it in other servers. Is Discord meant to track *everyone* who downloads the file and notify you when it gets uploaded to some random server, group chat or DM? Is Discord meant to pull all of these files down if the 'original uploader' wishes to 'limit publicity'? I'm fairly certain that most privacy-focussed social media aren't even able to do this. Though I agree that there should be an option presented to users to delete all their messages when deactivating their account.
@@Hati_0x this TBH, most important comment right here. "Most of these are just minor privacy issues IMO. The biggest two problems I know of when it comes to privacy on Discord are users being unable to delete messages from a server they're not in anymore, and people being able to share uploaded user media across server without the original poster being aware of it or able limit the publicity." love this comment, with more privacy protections , discord could feel like you are conversating in real life, without character assasination , blackmailing and etc stuff being as a possibility or atleast limiting it to a very low degree
3:33 i believe this refers to the right, that every user is allowed to demand from discord ALL information they hold about them, so they can see it. so discord is obligated to provide to you every single message you've ever sent that's not deleted, etc. so you can review, correct, or delete that information. apparently they weren't doing it.
@@erikkonstas discord keeps the deleted messages stored in the servers and not visible in the client, if that deleted message had personal info, people at the discord hq can still see it! thats how betterdiscord plugins allow you to see deleted messages! - the more you know.
@@viirless $830k is nothing for a company as large as Discord... It's a slap on the wrist, if that. They will most certainly continue with disregarding user privacy.
@@Pengasaurus2 830k for Discord is not that much, but its the same as getting 90€ of fine for you, you're not gonna die from it, but it's gonna piss you off, so you're gonna avoid to make the same mistake again, because you know the next time you're not gonna take 90€ but 170€, wich is nearly twice as much It's basically the same for Discord, 830k will piss them off, but they don't want to take a 2nd fine, and really don't want the second to be doubled
While it's cool to see discord getting legal repercussions it deserves, 800k is basically nothing to them, a multibillion dollar company at this point. Which makes this a bit sad that discord will most likely bandaid a few of the issues and move on acting like nothing is wrong. Hopefully there's more organizations out there trying to dig up discord's shadiness, and hopefully give them the reprimanding they really deserve.
With all of these huge companies doing layoffs as much as they have been because of the economical issues this year. I wouldn't be surprised if Discord starts hemorrhaging millions like a slow poison. And if it does happen... Good riddance and farewell Felicia to their spyware.
The best part about this is that there's literally a setting for turning off Discord completely instead of letting it rest in your taskbar/tray.. It's called minimize to tray, and you can just turn it off and click X and Discord will close completely..
it needs to be by default. Just like young people who are popular and rich but are stupid and still can force things to change, same applies with old people (organizations or governments) that are rich,
I don’t know how I feel about the account deletion thing. I like it because anything tied to inactive accounts or an account you lost access to won’t be a problem for the person anymore but my dead friend’s account is just gonna disappear and a lot of people are going to be confused and it’ll be harder to look at his old messages.
@1:50, the reason they got angry was that Discord didn't make it obvious to new users that it was still running in the background when you hit the X button. Discord is probably just going to put up a little pop up warning you the first few times you close it when you're still in a voice call and leave it at that.
With the one on Article 13, it’s when you send an email to the company requesting your data specifically on what they retain, and they refuse to share it. I know there’s the option to request your data, but it’s probably referring to a different method of data request.
The password crack time checker mentioned in the video is a bit inaccurate. It assumes that you alredy have the hashed/encrypter version of the password your cracking locally. However, if your attempting to crack someone's account on discord, you DON'T have a local copy of the encrypted password. What this means is that you need to try a password, and wait for Discord's servers to tell you if it's right or not. In addition to that, you'd be solving captchas every time you check a single password. And don't forget about API ratelimiting. That being said, the password that would have taken just 4 days to crack would instead take millions of years if you have to ommunicate with the Discord servers every time.
@Kolonyaa Bare in mind the comment im making is for everyone. People who aren't the best with computers, and still make mistakes. Hell, theres even people who have used computers for years and still make mistakes. However. Having a password cracked is still a major problem, especially if they know you have other accounts. They can try the password on a different account somewhere that doesn't have the restriction of needing email permission or anything else. From here they can know your email, and from there they can try it onto your email and possibly get in. Having a password cracked at all is a major security risk for some, and for others, it's not the end of the world. Education on the matter of account security is the same as a TOS. Unless someone specifically wants to know, they won't care. At its absolute best they will scroll through it just so discord then allows you to make an account. 2FA a bunch don't use because it requires an authentication app. On Andriod, the google auth is a 3.6 rating on average. That's insanely low for a security-based app. And authy? got hacked like 2 months ago. If a security-based thing can get hacked? I'm not sure I really want to trust them with running my 2FA. For the majority of people, they wont have someone targetting them specifically with any account cracker or else wise. They would probably use a scam instead, but even so an account security risk is an account security risk. Now do I have any qualification in saying all this? kind of. I do not work in the security field, but I did take a class relating to computer and networking security. The principles of account confidentiality, integrity, and availability are all well there. So while I am just arguing things with online strangers, I do have reasoning to say what I'm saying.
@Kolonyaa Hey thanks for taking my comment seriously, I would like to speak further of my opinions and what I would imagine would occur. For the first thing in roblox, I actually do play roblox myself, however I hadn't heard of that event before, seems interesting and i like the idea of it on discord. However im not sure what the reward could be for people to be interested. I still like the idea from it however. For the point of don't have the same credentials on two different sites if one has more problems. That is true indeed. However a lot of sites even now don't require any verification from an email. And some people either require those websites, or have a sense of nostalgia and keep them around. Of course there is other variables, but as a general thing there is a alternative to finding and testing ways of breaking into a person's stuff. A lot of people nowadays just have one or two passwords, if you don't need email confirmation on one thing, it can cause problems. And for 90% of users that have the same password on most sites, that would be the most likely thing to occur for them to be completely breached with nothing more then just spamming passwords. Its not likely to happen overall, but thats the most likely assuming that it was just spamming passwords. For 2fa. I referred to it as just for a discord thing. My original comment was mostly intended, outside of using other websites that are not as good for just general password security and direct log in. To be just discord. Yes other methods do exist in order to use 2fa, however for discord that is not the case. You just have the two apps. Your not necessarily wrong in that other methods exist, and that you could use multiple. However, my exact reasoning was. Both options currently available arnt exactly good. And. Thats all that exists on discord as of now. While I do appreciate the story to providing a reasoning as to why someone would target you, and why you like to "preach" for lake of better wording, about computer security. However, my comment was purely based on passwords and the assumption that the person wasn't exactly the best to handle their accounts. As based on "even if one password is cracked, it could be a major problem" As a final clarification. My reasoning that i originally replied was to your "why do people care if they account password is breached they shouldnt care if they pay attention to the other things" and to that i say, theres valid reason to care. Its one more step to losing accounts. If you act fast it wont matter, but it only takes a few days of being inactive for any reason. And it depends on each individuals security. Talking about account security in such a broad fashion is difficult. However Il try and do a summerization of each of my assumptions. My first assumption is that the majoity use the same, or very similar passwords for each account. My second is that even though thats the case, the person still tried to look at things like 2fa (specifically on discord) and realized that both options on there could cause problems, or that they don't trust either or. My third is that they probably wouldn't read through account security if it was similar to TOS, however that was already discussed plenty for work arounds. My fourth is that they wouldn't have someone target them to much anyways. Which is more of a side point for the people that are knowledgeable in account security, specifically the people that wouldn't be effected by DM scams because they have them disabled for example. And my final main assumption is that the other sites are also needed, or really wanted by some shape or form, but have in some way worse security. Maybe its not a lot, but even just a tiny bit of a difference can cause problems. Maybe one doesn't say the location of where it signed in from. Maybe it doesn't show whats currently logged in on the site. Maybe it doesn't have a captcha for every password fail, regardless of what it is. There is still going to be at least one site that is at least slightly worse in security. Especially if that person isn't a security freak to the point of making a new email for every single individual account. It only takes a little bit of information to find more and more rapidly.
In terms of the impact assignment and the engineer ethics stuff, I'm not really sure why no one realized that either but every time I worked with/for a company impacted by GPDR, I had to take a literal course on those laws, sign a bunch of NDAs, agreements to not look into anyones personal data unless specifically needed for the current work and so much more. I'm honestly surprised Discord appears to not have done that, it'd have been a lot cheaper to just have a bunch of engineers that know like the major privacy regulations. The password character thing and app not closing is something I find quite dumb, you could also argue "oh but MacOS doesnt close apps if you hit the close button" and fine them for it. The account deletion after X time honestly somewhat surprises me it wasn't a thing already as it'd save them a decent amount of database space and should be done similar to for example Telegram, have a sane default but also an option not to delete it. TL:DR Parts of this are just stupid both on Discord and the CNILs sides. Just get some privacy people.
Telegram doesn't have an option not to delete the data. You can only extend the time up to 1 year from the default of 6 months, but that is it. You have to log in.
@@R1ch4rd I know it doesn't, I mentioned Telegram for comparison as it at least has the setting and was the first to come to my mind. I would never recommend Telegram for privacy either
@@R1ch4rd I never said it does have that. I said that Discord should have the setting in a similar way to how Telegram has it, with a sane default BUT also an option not to delete it at all.
The account deletion part has me curious. If they're going to email about a potential schedule for deletion I wonder if you can email them back to prevent it. Knowing their support it would take to long to stop it. :) Edit: I should have clarified that my account was hacked and then locked out since the hacker placed their own 2FA on my account. I've had the account "disabled" or suspended and it requires you to reset the password, but you still need 2FA which I have no access to.
@@Conductor01 I should have clarified that my account was hacked and then locked out since the hacker placed their own 2FA on my account. I've had the account "disabled" or suspended and it requires you to reset the password, but you still need 2FA which I have no access to. Can't login to prevent it.
@@pankudev i had the same issue but i emailed discord support, they replied within 2 days but i did mention i had nitro for a while. you could try that
I can kinda understand why Discord never got a Data Protection Impact Assessment until now. Back when Discord was founded it was just a replacement for Skype, no important data would have been on the platform in the first place, but as it evolved more data was linked and now it is necessary for data protection to be a priority
If you are not a prime target the 6 letter password thing is actually kinda okay because in big data breaches they don't make the effort of cracking a password if it takes more than ~30 minutes. However, if you are a target for hackers they'll probably take the time to crack it but targets like these should be aware of that.
@internet admiral asn True but their email can be spoofed and if they cracked the password most people use the same password everywhere so they can possibly have more than just a discord acc compromised
In regards to the password of cracking, the concern would mostly be discourse suffered a day to breach and the password hashes themselves were found, while this wouldn't immediately give the passwords away, it would allow an attacker to essentially guess the password unlimited times without ever using discords servers.
I suggest doing this now, go to all your discord friends and write a brief note about them in their notes description, Because now that discord deletes inactive accounts after 2 years, it would be really annoying going to a deleted dm of some good friend from years past and not remember them at all and have to play goose chase by looking through their dm
i mean my biggest issue is that deleting an account does literally nothing. it removes your access to your data, changes your username, and removes your pfp your messages across EVERYTHING are still saved, people can still go back and look at DMs with you, and they can still access messages you sent in servers you can do the exact same thing by just removing your pfp, changing your name to 'deleted user' and cleaning all your servers/friends/gcs. youd still have access to your private information, and you would be doing, essentially, what discord does when you delete your account.
I think they have forgotten to add that they are not deleting the messages when a user deletes their account they just delete the account but save/keep the messages which could contain some personal information and data which leads to breaking an additional Lawsuit.
Yes that is true. That alone they need sued over and over. People seriously need to stop being afraid to sue these companies for evading their rights and privacy.
another thing people dont know about discord but if you look into the ToS they have permission to view your private messages whenever they please. Some bored discord mod could see ur account and just snoop into your private messages and they dont need reasoning
This is in section 3 of discord's tos: The information we collect *INFORMATION YOU PROVIDE TO US* "*Content you create*. This includes any content that you upload to the service. For example, you may write messages (including drafts), create custom emojis, or upload and share files through the services. This also includes your profile information and the information you provide when you create servers. We generally do not store the contents of video or voice calls or channels. If we were to change that in the future (for example, to facilitate content moderation), we would disclose that to you in advance. We also don’t store streaming content when you share your screen, but we do retain the thumbnail cover image for the stream for a short period of time." "*Information from actions you take*. We collect information about your use of and activities on the services. This includes the friends you add, the servers or other communities you join, your roles in servers, content moderation decisions you make, and other related actions."
There are good reasons why the inclusion of special characters makes cracking your password a lot more difficult. In addition to there being more characters, there are also many more options per character. You probably know this already. And I'm not an expert in my field. But yes, it is very important to consider potential consequences when running an application/service/platform like Discord. EU is definitely not perfect - there are so many bad sides to it - but at least GDPR is a thing. And that's a very good thing.
People will minimise the special characters and make them easy ones to get to on keyboard if you try to enforce it like this, and as a cracker I can now disregard all passwords that don't meet these rules. Finally a totally randomly generated password by chance failing these rules may not be accepted now. NIST retired this recommendation long ago, and in 2017 put out a set of new standards (NIST Special Publication 800-63, 800-63B is the one with the how to password 101 in it) that totally and uterly covers the yeah, our bad, here is how you should do it. Check against commonly used password list, minimum character length and allow any character you can.
Even tho discord got fined AFTER getting sued (otherwise the probably wouldn't do anything about their problem) the improved the password security Which is a massive W for discord. P.S. your guitar skills are amazing
Discord: *Gets charged for breaking a whole collection of laws, then forced to change their behavior without wanting to* Mr_Drip: YOOOO massive W for Discord!!!1!1!!!1!
though, password cracking isn't how people get into accounts, people use various ways to get your token, which allows direct access to an account without the credentials no matter where you are (which is kinda sussy)
@@chlorobyte_projects It's a form of cookie. Anyone can get access to your accounts through cookies. Most company already use cookies for account sessions, so that's got nothing to do with Discord, just how accounts work nowadays. Nothing they can do about it. Anyone dumb enough to run something that steals cookies (such as Discord's token) is at fault here.
@Kolonya I'm not sure about the phone number thing. Afaik they only require you to have a phone number on your account if there's something suspicious to Discord going on, like multiple accounts being created on the same computer and IP. As for the credentials, that depends on the website. If a website wants to store your email, phone number and home address, and you allow it to, it might as well, but as far as I know Discord doesn't store any of these (because it doesn't even ask you for permission either way). And as for your password, it's hashed so you can't really get a password just from cookies. But the other information that they store, like your home address, phone number and email... Well, your email is pointless, your phone number is just as pointless since it is easily changeable and you can just block a number if someone annoys you, and your home address, well there are multiple ways of getting someone's home address, but again, this also depends on the website. Not every website stores your home address.
That clicking the X one was funny. Like yeah I guess they could make a little popup by the tray briefly appear the first time and say something like "Discord is still open in the background" or something but I think 99% of people already know that
an $830k fine is nothing for a company of their size, it's a slap on the wrist, they will continue with shitty business practices and not only that, but also failing to enforce child safety on their app as well, as they have been since they launched.
@@variegatus4674 While I agree that many parents can do more to protect their children from pieces of shit online, Discord is HUGELY at fault for lackluster child safety measures, as well as failing to mandatorily report illegal content such as CSAM to authorities. They will purposely delete servers/evidence instead of archiving such content to report to authorities (they are required by law, like any tech company in the USA, to report illegal material). Cybertip/The National Center for Missing and Exploited Children is the best way to report such things, and they are well aware of Discord's laziness or purposeful obliviousness to the MASSIVE child safety issue and CSAM issue on their platform. It's not even just child safety, they are also being investigated for being complicit in events such as shootings, where the perpetrator had demonstrated the desire to commit an act of violence/crime. They also make the reporting process purposely tedious and it is simple for any user or server to avoid getting reported by simply deleting their messages. To archive a message (or so they claim) to report, you have to use the mobile app, which is clunky when it comes to reporting and copying each and every message link that you reported, as well as keeping a descriptor. It's sad that more is not done by companies like Discord, and they absolutely need to be held accountable for disregarding privacy, and failure to take measures to ensure the safety and protection of children on their platform, as well as mandatorily reporting illegal content and the users who distribute it. It's sickening.
@@donkeykongisbetterthanmari7495 I also thought of something just now... it's also the childs fault for not having common sense and more than half a brain
@@variegatus4674 Don't blame children for being naive. Blame the parents for not having the integrity to sit down with their kid and teach them about online safety.
Not gunna lie. Kinda glad i took screenshots of me and my Fiancés conversation. I knew this day would come where her account would get deleted. Good memories need persevered at all cost especially in unfortunate circumstances.
@@edu7979 No worries, she passed away unexpectedly upcoming 2 years in February so I would say that is when her account will be deleted based on this video.
@@HKZTHAPIRATE You can download everything if you have access to her account, I did it a few weeks ago and it looks like everything I've ever said is inside. I don't think replies are included and such, I haven't actually checked closely. But if you download your own account's data too, you'll have the complete interaction.
I'm surprised how many people are happy about stuff like this, yes discord does need better security & privacy options, but as someone into web design & app development, stuff like this is kind of scary. I don't like the idea of foreign governments deciding they know best for you, forcing password requirements or fining a company over the X button minimizing to the system tray when it's something that many apps do & isn't hiding or exploiting anything, every day more & more laws are being make by different countries & states, they are all trying to regulate the internet. As a web or app developer it's becoming impossible to keep track of every new law & regulation being passed by every government around the world, understanding them & making sure you comply with all of them just to avoid the risk of being sued & fined. It seems recently every government trying to be your parents. It's easy to hate on big companies like Facebook, Google, Microsoft, Apple, Discord but I worry more about how these new laws could effect smaller companies or kill new start ups because of too much legal risk to even make it worth trying to make something new.
finally, inactive accounts will be deleted. all our personal info we accidently shared in messages when we were younger and stupid. 2 years is still a pretty long time to delete all that data. i wanna wipe all my account info right now
I don't think the messages will be gone for example even if you delete your account rn the messages will still be there but your account info won't be showing
@@James-un8io you can information in messages. thats the whole point. its also why every single message you send is given to you when you request account info
This is why I love EU, they're seriously people and they know what to do I remember that I saw video on twitter that EU is actually going to reduce waste of chargers by having the same charger for phones to everyone else to save resources and whatever, this would make Apple mad lmao
I mean it’s not really as a normal routine. Imagine logging off discord by clicking the x while in vc and not being aware of still being in chat, letting everyone else hear your mic and potentially letting discord record it
this episode gave me whiplash 😭 maybe because I find it so hard to focus on one thing on the screen... when there's a game in the background, I kept trying to focus on that instead of anything else
@@modernmarrow1411 True, plus a lot of applications and games have the same feature, it’s a fairly common thing. If the user wants to quit discord they can just right click on the task bar icon. I personally find it practical and fast to be able to minimize discord by just clicking on the very corner of my screen.
im glad they fix this honestly the ammount of times i had to go into tm to close discord is ridiculous, and its always been hit or miss too i dont always have the application stop whem it was closed by the X even though i never use the X just the minus to actually minimize it like a normal human would. But i think this was honestly needed especially for those that may be new to discord in the future and could have been unaware of that flaw
Bro this thing happened with my friend so many times this is literally a privacy issue for many users who only know that clicking on the 'X' will close it. They don't even know that some thing called "tray" exists on their pc. Many people also asked discord earlier to make this change but they didn't, I am very happy that they charged them. Now they will surely default it or did it. 😂
french person here. I don't think this kind of thing deserved a fine, but I agree with the principle behind it: for a year or two after creating my account back in late 2016 I had to use the task manager to close discord because I couldn't find how to actually close it :p
You right click the Discord Icon on the tray and click quit. No seriously I can't be the only person who didn't struggle with the X button not fully closing Discord.
The fact that there is a setting in the Discord App that changes whether it goes to your tray or actually closes off is disturbing, they just have to come up with some issue
discord have an option to fully close the app when pressing the x button in the "advance" setting..so i dont really get that.. did they just not try to check the discord client settings?
It's a common thing, this is more for the old people that do not understand modern times and most likely don't bother understanding anything new. 12 out of say 15 processes in the tray are either already only there or can be toggled to be only there. They are not on the task bar and pressing x does not close the program. That's most programs I currently have on that do not close on x, it's not an issue. Imagine you see a window and you try to bust the window open to get out instead of using the door handle for the door the window is attached to. It's not a person that wants to understand.
I hope some hacker prevention gets added to Discord. I was a RUclipsr and used discord sooo much. I was scammed into downloading what I thought was a game to Beta test and the person took over my pc. He stole a ton of my accounts and I had to wipe my phone and pc :(
*With regards to a user's right to their data. However, it seems a lot of people are meaning "I don't want anything reposted about me if I don't like it" instead of "I don't want my data becoming a liability to me."
That's... the side effect of not having a potential liability bomb brewing. Sucks, but inactive accounts being deleted is a tale as old as the internet itself.
Except it does mean the password itself and not any (salted or not) hash of it. The question is whether Discord's servers will allow it (they won't because they don't want to be DDoS-ed with login requests).
I think the biggest sin is that if you're using the desktop version (not browser, not sure about mobile), any image, gif, or video you see anywhere in chat will be DOWNLOADED to your hard drive. It's not even encrypted. It just puts it as a non-attachment file name comprised of numbers and letters and all you have do is at .png/.gif or any other attachment that relates to what the file actually is, and you'll be able to see the content. So if you sent something and deleted it, anyway who saw it already has access to it regardless if you delete it. Likewise, if someone post something illegal, it gets downloaded onto your PC and now all it takes is them snitching that you have it on your PC and how to find it and you're gonna be in a hard position explaining that one to the police.
@@ShiroIsMyName Well where'd you get those numbers from lmao if you had used your braincells and googled it you'll know they got $300m in 2021 and they only lost $820,000 which is just 0.27% of 2021 revenue
@@xClairy 300M is their revenue, not their benefits. One is before tax and cost, the other one after. the numbers are from the Forbes article regarding Discord.
I hate it when you are forced to follow password guidelines. I get that they are trying to make it more secure for you, but at the end of they day its my info and my security that's at risk... I should be responsible for myself and if I chose to have a weak password then its my fault.
Besides the password and data breach parts, this whole thing was pretty much bs... After the "x to close the window" thing idk if I should just laugh it off or be worried, Discord isn't to blame for people's stupidity after all, at least not with something like that. Btw, I'm pretty sure that Microsoft Teams does something like that too lol
The "by default" part of that first violation is important. It's okay for Discord to have the weird close behavior so long as a user needs to opt into it before it happens. The rule isn't just for boomers. I started using Discord when I was 17, and I didn't notice the weird close behavior until I was about 21 (although maybe it wasn't added until I was 21). At the time, it was just a source of irritation -- I closed it because I didn't want it running. If I wanted it running but not in my face, I would minimize it -- as is the norm for applications. But now, life circumstances have changed to where the behavior would be a privacy hazard for me.
For the first problem: The only thing I could see discord doing differently is while you are in a voice room and you go to hit x to put the application into the tray, it can add yet another prompt to take action or ignore. For the rest, it makes sense. Follow standards.
I’m really annoyed honestly, specifically with the 2 year rule for deletion. I have an alt account that I archive old servers in as evidence or for memories. I don’t log in a lot, and now I have to be scared they’ll take it away because I don’t log in, and because when I do I don’t send any messages.
As a fluent french speaker, your french sounds like a canadian who failed french class. better than most americans lol. good job, 11/10, and thanks for the video
There’s literally a “Keep Discord open in background” option in settings. You turn that setting off, and just like magic, when you click the X to close the window, discord closes completely! Wow!
Sadly the account deletion thing could severely screw me over, my main account is one I don't have access to anymore because discord locked it last year and put a phone requirement on it and as I don't have a phone to link to it there is a fairly high chance it will end up getting deleted so yeah that's great.
One thing that I was surprised not to see is about the protection of accounts in general, as it's also the job of the CNIL to ensure that user security is not at risk. It still baffles me that in 2022, with a software released in 2015/2016, token grabbing software are still around
You're talking about a company that abandoned their last online service without notice, and to this day, exposes their token-incompetence by failing to base64 encode userids.
I am a Data Controller (company staff member personally liable if a i don't make sure we follow the rules of GDPR in a UK company) and there are some thing to comment here: The first one Article 25.2 breach will not stand up in appeals, it will go to the EU courts out of France and they will tell the french courts they are wrong, there has not been the expectation that clicking the "X" on a window will close the application even windows 3.1 has MS services running in the background, all Discord need to do is prove one of the many hundreds of Services that are included in Windows by Microsoft, or the thousands if not millions of pieces of software that have not exited when clicking the "X" including but not limited to Teams,Skype and (for much older software) all the way back to MSN Messenger, the Tray has been in windows since Windows 95, and even then an application does not have to be in the tray and still working in the background. Article 5.1.e they has them bang to rights Discord were violating that by not having a data retention period in the Privacy Policy. Article 13 actually has nothing to do with discord-keeping data (So nothing to do with the violation of 5.1.e), when ever you collect information from a user E.G Email Address, Name, Address, Eye Colour, IP Address anything that can be used with other information to help identify a user, it must be explicitly clear why your collecting that data, E.G if the user is filling out a contact us form it's intrisically clear they are collecting that information to assist with what ever your reason for filling that form out. however, if they are tracking what discord servers your a member of for advertising networks that is not clear and they must by GDPR explicitly state in there Privary Policy we're collecting XXXX data for the purpose of YYYY. E.G following the same example as before "We're Collecting information about the servers your a member of to provide information to 3rd Party companies to better target you with advertising" Article 32 again i outright agree, that was not secure enough especially for something that can be used to login to other systems with, Article 35 i agree with you discord most certainly should have done that, but the impact assessment must include information about how to deal with different types of breaches as well, exactly who to report detected breaches to and such that's why they are so damn important.
Oh and just to add a little more context to Article 25.2, if that goes to Appeals and is allowed to stay, every desktop & mainframe operating system in the world will be banned from the EU because they all use background applications you can't see or close to work.
![Megan Thee Stallion - Bigger In Texas [Official Video]](http://i.ytimg.com/vi/QxTkZTLWdo4/mqdefault.jpg)
I love how EU always, no matter what, proves American companies that you don't and can't mess with EU laws, it's not the USA. The first was Apple and them being forced for USB-C. Now Discord. I can't wait to see more of this, it's so fun.
Apple will just become solely wireless charging so they don’t use USB-C.
@@JackFoxtrotEDM makes me think of a 5 year old lmao if they do
They said they'd comply not use USB-C.
If they force USB C its for pollution. Having multiple charger is causing more polution. Also Apple are scamming with those bad charger
@@Bready- well, they are a 5 year old in a lot of aspects
Article 13 is also used to make sure any user can demand (by right) the company to disclose ALL information they have about you and your right to demand that informations deletion.
I'm a bit weirded out by this, Discord implemented an automated data dumping too for your own account years ago when GDPR passed.
It's in options > confidentiality > Ask for your data, and it's been that way for years. The issue here is that the package was slightly incomplete, it lacked a few timestamps... The confidentiality policy is also right here, and article 6 clearly states a 2 year data retention limit after account deletion (which you can do in the app). Some of it is new, the vast majority isn't.
Discord got fined on technicalities here.
You were already able to request your data, but I’m not sure about the deletion part
I thought Article 13 was also a thing related to copyright, but that might be in another thing.
discord lets you request your data, idk if they let you ask for deletion tho
I uh... I don't think that's what article 13 is.
I’m honestly not surprised an app like discord managed to fail at such an important task
I’m not either, I’ve never really trusted Discord with security
In terms of the application not quitting after pressing the x button, many other applications do this too, such as Spotify
Same
@@AmSleepyJay spotify has an option to turn it on or not dumbo
@@AmSleepyJay don't forget steam
Discord never fails to amaze me.
@@Used exactly
@@Used shut up
@@Used bro why the uwu?
@@Used truly
@@Used fr
i actually feel bad over the account deletion as a couple of my friends have people they knew who died and their little profile there was a sad but sweet reminder of the person
Exactly. There's one in one of my servers and everyone liked them. I don't wanna see the account deleted
oh well you have to move on
Sadly they have no obligation to hold up account that are inactive. As long as it's here you can look at their messages, take screenshots and keep it. It's not the same but it's not the end
@@Chronor Sure. Let me burn all the letters from my loved one, their clothing, and any pictures/videos I might have had. It's not like people want to be able to remember someone /s
@@billcipher8645 What the video is saying is that they have an obligation not to keep them now, not just no obligation to keep them.
Most of these are just minor privacy issues IMO. The biggest two problems I know of when it comes to privacy on Discord are users being unable to delete messages from a server they're not in anymore, and people being able to share uploaded user media across server without the original poster being aware of it or able limit the publicity.
And to add to this, messages and media posted by a user aren't deleted when the user deletes their account.
a lot of big servers already got bots which keep logs of everything
including every deleted and edited message there
with the id of the user in a channel only the mods can see
(I was just stating this as something that exists I would also prefer if deleting stuff on servers you aren't in was an option)
"people being able to share uploaded user media across server without the original poster being aware of it or able limit the publicity."
by this you mean the .cdn links well people can easily download the media and upload it again without using those links
but having those links helps discord by not keeping redundant data stored I suppose if someone is gonna download a media and upload it to another server leads to more data being stored on discord servers so other to save on data it would be beneficial for discord to have those users send those links instead.
also one more thing I noticed is if you delete a media and someone's got a link of it. the link stays active for like a week after the the media got deleted
@@James-un8io with the "media links work a week after deleted", turns out if you delete it quickly its immediately destroyed.
Kind of confused by what you mean by "people being able to share uploaded user media across server without the original poster being aware of it or able limit the publicity". So I post this meme on a server, several people find it funny and decide to download and repost it in other servers. Is Discord meant to track *everyone* who downloads the file and notify you when it gets uploaded to some random server, group chat or DM? Is Discord meant to pull all of these files down if the 'original uploader' wishes to 'limit publicity'? I'm fairly certain that most privacy-focussed social media aren't even able to do this.
Though I agree that there should be an option presented to users to delete all their messages when deactivating their account.
@@Hati_0x this TBH, most important comment right here.
"Most of these are just minor privacy issues IMO. The biggest two problems I know of when it comes to privacy on Discord are users being unable to delete messages from a server they're not in anymore, and people being able to share uploaded user media across server without the original poster being aware of it or able limit the publicity."
love this comment, with more privacy protections , discord could feel like you are conversating in real life, without character assasination , blackmailing and etc stuff being as a possibility or atleast limiting it to a very low degree
$800k is basically pocket change to Discord
@@shinycompi We dont care its funny seeing companies like discord lose money, also they probably they make that much a week
@@shinycompi it is most definitely their pocket money.
@@shinycompi Well it's not their 2022 valuation
@@3kz why?
@@shinycompi I think you added a few zeros in your calculation, it's 800k, not 800 million
the fact that some people still think that the only money discord gets is from nitro is insane
Tencent owns the world
Then please educate us all and tell us all the other sources of income discord has
What other sources does it get revenue from?
@@Mai.Calico I think their youtube channel could be one?
@@Mai.Calico Google does it with advertising and data selling, discord does it with nitro and data selling
3:33 i believe this refers to the right, that every user is allowed to demand from discord ALL information they hold about them, so they can see it.
so discord is obligated to provide to you every single message you've ever sent that's not deleted, etc. so you can review, correct, or delete that information.
apparently they weren't doing it.
but what about the privacy package?
discord does have an option if you want to review but you can't correct, or delete that information
its also stupid that they dont let you delete that data EVEN THO DELETED MESSAGES ARE STILL saved within the servers.
@@nolongergabe ?
@@erikkonstas discord keeps the deleted messages stored in the servers and not visible in the client, if that deleted message had personal info, people at the discord hq can still see it! thats how betterdiscord plugins allow you to see deleted messages! - the more you know.
Damn. How Karma bites back in various ways really amazes me a lot.
Not karma
@Jashonn How is it not karma? They decided to not secure their platform correctly and karma got their ass with a 800k fine easy
@@viirless they could be bad at math
@@viirless $830k is nothing for a company as large as Discord... It's a slap on the wrist, if that. They will most certainly continue with disregarding user privacy.
@@Pengasaurus2 830k for Discord is not that much, but its the same as getting 90€ of fine for you, you're not gonna die from it, but it's gonna piss you off, so you're gonna avoid to make the same mistake again, because you know the next time you're not gonna take 90€ but 170€, wich is nearly twice as much
It's basically the same for Discord, 830k will piss them off, but they don't want to take a 2nd fine, and really don't want the second to be doubled
While it's cool to see discord getting legal repercussions it deserves, 800k is basically nothing to them, a multibillion dollar company at this point. Which makes this a bit sad that discord will most likely bandaid a few of the issues and move on acting like nothing is wrong. Hopefully there's more organizations out there trying to dig up discord's shadiness, and hopefully give them the reprimanding they really deserve.
With all of these huge companies doing layoffs as much as they have been because of the economical issues this year. I wouldn't be surprised if Discord starts hemorrhaging millions like a slow poison. And if it does happen... Good riddance and farewell Felicia to their spyware.
The best part about this is that there's literally a setting for turning off Discord completely instead of letting it rest in your taskbar/tray.. It's called minimize to tray, and you can just turn it off and click X and Discord will close completely..
Okay but what about the other shit Discord does?
@@ElIisL4D2 that stuff is just regular shit thats fine to be charged against
that doesn’t close it completely. to close it completely you have to stop it from running in the background
@@オジーはビッチだ okay but does it still give you notifications on your desktop and keep you in voice chats?
it needs to be by default. Just like young people who are popular and rich but are stupid and still can force things to change, same applies with old people (organizations or governments) that are rich,
I don’t know how I feel about the account deletion thing. I like it because anything tied to inactive accounts or an account you lost access to won’t be a problem for the person anymore but my dead friend’s account is just gonna disappear and a lot of people are going to be confused and it’ll be harder to look at his old messages.
Deleting inactive accounts is as old as time
@@billcipher8645 I’ve heard, though I still see some oooold inactive accounts in some servers I’m in.
@@Oretal Then why have them if you don't even use them?
@@modernmarrow1411 I never mentioned owning the account. I only have my own.
@@billcipher8645 i had an account that was inactive from september 2016-early 2021 that never got deleted lol
@1:50, the reason they got angry was that Discord didn't make it obvious to new users that it was still running in the background when you hit the X button. Discord is probably just going to put up a little pop up warning you the first few times you close it when you're still in a voice call and leave it at that.
it seems to already do that for me now, got a notification a few times when closing discord
They'll just find another way to spy on their users and ban them for having different political views.
With the one on Article 13, it’s when you send an email to the company requesting your data specifically on what they retain, and they refuse to share it. I know there’s the option to request your data, but it’s probably referring to a different method of data request.
This reminded me that discord's RUclips channel and discord's executives are two very different people
The password crack time checker mentioned in the video is a bit inaccurate. It assumes that you alredy have the hashed/encrypter version of the password your cracking locally. However, if your attempting to crack someone's account on discord, you DON'T have a local copy of the encrypted password. What this means is that you need to try a password, and wait for Discord's servers to tell you if it's right or not. In addition to that, you'd be solving captchas every time you check a single password. And don't forget about API ratelimiting. That being said, the password that would have taken just 4 days to crack would instead take millions of years if you have to ommunicate with the Discord servers every time.
yup
Exactly
@Kolonyaa Bare in mind the comment im making is for everyone. People who aren't the best with computers, and still make mistakes. Hell, theres even people who have used computers for years and still make mistakes.
However. Having a password cracked is still a major problem, especially if they know you have other accounts. They can try the password on a different account somewhere that doesn't have the restriction of needing email permission or anything else. From here they can know your email, and from there they can try it onto your email and possibly get in. Having a password cracked at all is a major security risk for some, and for others, it's not the end of the world.
Education on the matter of account security is the same as a TOS. Unless someone specifically wants to know, they won't care. At its absolute best they will scroll through it just so discord then allows you to make an account.
2FA a bunch don't use because it requires an authentication app. On Andriod, the google auth is a 3.6 rating on average. That's insanely low for a security-based app. And authy? got hacked like 2 months ago. If a security-based thing can get hacked? I'm not sure I really want to trust them with running my 2FA.
For the majority of people, they wont have someone targetting them specifically with any account cracker or else wise. They would probably use a scam instead, but even so an account security risk is an account security risk.
Now do I have any qualification in saying all this? kind of. I do not work in the security field, but I did take a class relating to computer and networking security. The principles of account confidentiality, integrity, and availability are all well there. So while I am just arguing things with online strangers, I do have reasoning to say what I'm saying.
@Kolonyaa Hey thanks for taking my comment seriously, I would like to speak further of my opinions and what I would imagine would occur.
For the first thing in roblox, I actually do play roblox myself, however I hadn't heard of that event before, seems interesting and i like the idea of it on discord. However im not sure what the reward could be for people to be interested. I still like the idea from it however.
For the point of don't have the same credentials on two different sites if one has more problems. That is true indeed. However a lot of sites even now don't require any verification from an email. And some people either require those websites, or have a sense of nostalgia and keep them around. Of course there is other variables, but as a general thing there is a alternative to finding and testing ways of breaking into a person's stuff. A lot of people nowadays just have one or two passwords, if you don't need email confirmation on one thing, it can cause problems. And for 90% of users that have the same password on most sites, that would be the most likely thing to occur for them to be completely breached with nothing more then just spamming passwords. Its not likely to happen overall, but thats the most likely assuming that it was just spamming passwords.
For 2fa. I referred to it as just for a discord thing. My original comment was mostly intended, outside of using other websites that are not as good for just general password security and direct log in. To be just discord. Yes other methods do exist in order to use 2fa, however for discord that is not the case. You just have the two apps. Your not necessarily wrong in that other methods exist, and that you could use multiple. However, my exact reasoning was.
Both options currently available arnt exactly good.
And. Thats all that exists on discord as of now.
While I do appreciate the story to providing a reasoning as to why someone would target you, and why you like to "preach" for lake of better wording, about computer security. However, my comment was purely based on passwords and the assumption that the person wasn't exactly the best to handle their accounts. As based on "even if one password is cracked, it could be a major problem"
As a final clarification. My reasoning that i originally replied was to your "why do people care if they account password is breached they shouldnt care if they pay attention to the other things" and to that i say, theres valid reason to care. Its one more step to losing accounts. If you act fast it wont matter, but it only takes a few days of being inactive for any reason. And it depends on each individuals security. Talking about account security in such a broad fashion is difficult. However Il try and do a summerization of each of my assumptions.
My first assumption is that the majoity use the same, or very similar passwords for each account.
My second is that even though thats the case, the person still tried to look at things like 2fa (specifically on discord) and realized that both options on there could cause problems, or that they don't trust either or.
My third is that they probably wouldn't read through account security if it was similar to TOS, however that was already discussed plenty for work arounds.
My fourth is that they wouldn't have someone target them to much anyways. Which is more of a side point for the people that are knowledgeable in account security, specifically the people that wouldn't be effected by DM scams because they have them disabled for example.
And my final main assumption is that the other sites are also needed, or really wanted by some shape or form, but have in some way worse security. Maybe its not a lot, but even just a tiny bit of a difference can cause problems. Maybe one doesn't say the location of where it signed in from. Maybe it doesn't show whats currently logged in on the site. Maybe it doesn't have a captcha for every password fail, regardless of what it is. There is still going to be at least one site that is at least slightly worse in security. Especially if that person isn't a security freak to the point of making a new email for every single individual account. It only takes a little bit of information to find more and more rapidly.
You have been ratelimted - discord
Fyi, if you have $10k in your bank account, then this is like playing a $5 fine.
As a french... the cnil prononciation with liberT was... beautiful 😂
And yes it's a french organisation who regulate a lot of things.
In terms of the impact assignment and the engineer ethics stuff, I'm not really sure why no one realized that either but every time I worked with/for a company impacted by GPDR, I had to take a literal course on those laws, sign a bunch of NDAs, agreements to not look into anyones personal data unless specifically needed for the current work and so much more.
I'm honestly surprised Discord appears to not have done that, it'd have been a lot cheaper to just have a bunch of engineers that know like the major privacy regulations. The password character thing and app not closing is something I find quite dumb, you could also argue "oh but MacOS doesnt close apps if you hit the close button" and fine them for it.
The account deletion after X time honestly somewhat surprises me it wasn't a thing already as it'd save them a decent amount of database space and should be done similar to for example Telegram, have a sane default but also an option not to delete it.
TL:DR Parts of this are just stupid both on Discord and the CNILs sides. Just get some privacy people.
Telegram doesn't have an option not to delete the data. You can only extend the time up to 1 year from the default of 6 months, but that is it. You have to log in.
@@R1ch4rd I know it doesn't, I mentioned Telegram for comparison as it at least has the setting and was the first to come to my mind. I would never recommend Telegram for privacy either
@@rbdm if you knew, why did you say it does meanwhile it doesn't?
@@R1ch4rd I never said it does have that. I said that Discord should have the setting in a similar way to how Telegram has it, with a sane default BUT also an option not to delete it at all.
@@rbdm my English is bad, my bad
Woohoo! They forced people to waste $10 on nitro by changing the plans... Now 830,00 USD is wasted on their side HAHA
Gotta love the karma
they can make that money back in under a month
@@cuminthesink It will be a pain tho, greedy people don't even like to pay 1k dollars
edit: 1 dollar
€800 000 actually 🤓🤓🤓
@@lxdixd 🤡 There was no need for correction they wrote it in USD
The account deletion part has me curious. If they're going to email about a potential schedule for deletion I wonder if you can email them back to prevent it. Knowing their support it would take to long to stop it. :)
Edit: I should have clarified that my account was hacked and then locked out since the hacker placed their own 2FA on my account. I've had the account "disabled" or suspended and it requires you to reset the password, but you still need 2FA which I have no access to.
I mean you can log in the acount then leave Takes like 10 minutes to do
@@Conductor01 I should have clarified that my account was hacked and then locked out since the hacker placed their own 2FA on my account. I've had the account "disabled" or suspended and it requires you to reset the password, but you still need 2FA which I have no access to.
Can't login to prevent it.
@@pankudev i had the same issue but i emailed discord support, they replied within 2 days but i did mention i had nitro for a while. you could try that
how was it hacked im curious
Your fault for not setting up your own 2FA first and clicking on that nitro scam link :^)
Damn, I LIKE that when you close the window it doesn't turn discord off tho! It makes anything else I'm doing lag less.
idk but your voice don't let me to close the video, your voice is great man!
You are the only discord related RUclipsr that doesn’t sound like a nerd
except he is one
🤓
@@vixer9950 oh my god who cares
I can kinda understand why Discord never got a Data Protection Impact Assessment until now. Back when Discord was founded it was just a replacement for Skype, no important data would have been on the platform in the first place, but as it evolved more data was linked and now it is necessary for data protection to be a priority
You where in my recommended, didn't know why will the very end. Sweet rift sub earned.
If you are not a prime target the 6 letter password thing is actually kinda okay because in big data breaches they don't make the effort of cracking a password if it takes more than ~30 minutes. However, if you are a target for hackers they'll probably take the time to crack it but targets like these should be aware of that.
@internet admiral asn True but their email can be spoofed and if they cracked the password most people use the same password everywhere so they can possibly have more than just a discord acc compromised
I am curious how you know this.
@@dusaprukiyathan1613 It's common sense tbh no one is gonna waste more than 30 min of their time unless it's worth it
@@dusaprukiyathan1613thats just basic IT security knowledge
In regards to the password of cracking, the concern would mostly be discourse suffered a day to breach and the password hashes themselves were found, while this wouldn't immediately give the passwords away, it would allow an attacker to essentially guess the password unlimited times without ever using discords servers.
It needs good behavior from the staff to do so. I'm sorry for what happened to one of the biggest social medias
little shoutout from france, your accent is amazing ahahah I just studied this case in my law class
I suggest doing this now, go to all your discord friends and write a brief note about them in their notes description,
Because now that discord deletes inactive accounts after 2 years, it would be really annoying going to a deleted dm of some good friend from years past and not remember them at all and have to play goose chase by looking through their dm
i mean my biggest issue is that deleting an account does literally nothing. it removes your access to your data, changes your username, and removes your pfp
your messages across EVERYTHING are still saved, people can still go back and look at DMs with you, and they can still access messages you sent in servers
you can do the exact same thing by just removing your pfp, changing your name to 'deleted user' and cleaning all your servers/friends/gcs. youd still have access to your private information, and you would be doing, essentially, what discord does when you delete your account.
I think they have forgotten to add that they are not deleting the messages when a user deletes their account they just delete the account but save/keep the messages which could contain some personal information and data which leads to breaking an additional Lawsuit.
Yes that is true. That alone they need sued over and over. People seriously need to stop being afraid to sue these companies for evading their rights and privacy.
i love the gameplay n music it makes the videos so much more enjoyable
another thing people dont know about discord but if you look into the ToS they have permission to view your private messages whenever they please. Some bored discord mod could see ur account and just snoop into your private messages and they dont need reasoning
What part of the TOS? Just curious
yea but you cant do anything about that since u agreed to the TOS when signing up
This is in section 3 of discord's tos: The information we collect
*INFORMATION YOU PROVIDE TO US*
"*Content you create*. This includes any content that you upload to the service. For example, you may write messages (including drafts), create custom emojis, or upload and share files through the services. This also includes your profile information and the information you provide when you create servers. We generally do not store the contents of video or voice calls or channels. If we were to change that in the future (for example, to facilitate content moderation), we would disclose that to you in advance. We also don’t store streaming content when you share your screen, but we do retain the thumbnail cover image for the stream for a short period of time."
"*Information from actions you take*. We collect information about your use of and activities on the services. This includes the friends you add, the servers or other communities you join, your roles in servers, content moderation decisions you make, and other related actions."
@Kolonya Please take a little trip to the psycho ward
@@raj.r412 I'm not sure I Don't read tos I use a tos checker site that tells you the privacy stuff you agree too
There are good reasons why the inclusion of special characters makes cracking your password a lot more difficult. In addition to there being more characters, there are also many more options per character.
You probably know this already. And I'm not an expert in my field. But yes, it is very important to consider potential consequences when running an application/service/platform like Discord. EU is definitely not perfect - there are so many bad sides to it - but at least GDPR is a thing. And that's a very good thing.
People will minimise the special characters and make them easy ones to get to on keyboard if you try to enforce it like this, and as a cracker I can now disregard all passwords that don't meet these rules. Finally a totally randomly generated password by chance failing these rules may not be accepted now. NIST retired this recommendation long ago, and in 2017 put out a set of new standards (NIST Special Publication 800-63, 800-63B is the one with the how to password 101 in it) that totally and uterly covers the yeah, our bad, here is how you should do it. Check against commonly used password list, minimum character length and allow any character you can.
Even tho discord got fined AFTER getting sued (otherwise the probably wouldn't do anything about their problem) the improved the password security Which is a massive W for discord.
P.S. your guitar skills are amazing
Discord: *Gets charged for breaking a whole collection of laws, then forced to change their behavior without wanting to*
Mr_Drip: YOOOO massive W for Discord!!!1!1!!!1!
@@XenorioWasTaken Maybe they meant Discord as the people using it.
though, password cracking isn't how people get into accounts, people use various ways to get your token, which allows direct access to an account without the credentials no matter where you are (which is kinda sussy)
@@chlorobyte_projects It's a form of cookie. Anyone can get access to your accounts through cookies. Most company already use cookies for account sessions, so that's got nothing to do with Discord, just how accounts work nowadays. Nothing they can do about it. Anyone dumb enough to run something that steals cookies (such as Discord's token) is at fault here.
@Kolonya I'm not sure about the phone number thing. Afaik they only require you to have a phone number on your account if there's something suspicious to Discord going on, like multiple accounts being created on the same computer and IP. As for the credentials, that depends on the website. If a website wants to store your email, phone number and home address, and you allow it to, it might as well, but as far as I know Discord doesn't store any of these (because it doesn't even ask you for permission either way). And as for your password, it's hashed so you can't really get a password just from cookies. But the other information that they store, like your home address, phone number and email... Well, your email is pointless, your phone number is just as pointless since it is easily changeable and you can just block a number if someone annoys you, and your home address, well there are multiple ways of getting someone's home address, but again, this also depends on the website. Not every website stores your home address.
That clicking the X one was funny. Like yeah I guess they could make a little popup by the tray briefly appear the first time and say something like "Discord is still open in the background" or something but I think 99% of people already know that
First the HM Treasury making a LITERAL Discord server, Now Discord is getting sued for 800K Euros
A LITERAL discord server?
are you sure it wasn’t a LITERARY server? I’m kinda sceptical on the LITERAL part
@@Worsterest Yes it's true that they did make a Discord server, Im not sure if it's still up.
this is a nice channel i wanna keep it as my favs
an $830k fine is nothing for a company of their size, it's a slap on the wrist, they will continue with shitty business practices and not only that, but also failing to enforce child safety on their app as well, as they have been since they launched.
If a child is in danger on discord, it's usually always the parents fault.
@@variegatus4674 While I agree that many parents can do more to protect their children from pieces of shit online, Discord is HUGELY at fault for lackluster child safety measures, as well as failing to mandatorily report illegal content such as CSAM to authorities. They will purposely delete servers/evidence instead of archiving such content to report to authorities (they are required by law, like any tech company in the USA, to report illegal material).
Cybertip/The National Center for Missing and Exploited Children is the best way to report such things, and they are well aware of Discord's laziness or purposeful obliviousness to the MASSIVE child safety issue and CSAM issue on their platform.
It's not even just child safety, they are also being investigated for being complicit in events such as shootings, where the perpetrator had demonstrated the desire to commit an act of violence/crime.
They also make the reporting process purposely tedious and it is simple for any user or server to avoid getting reported by simply deleting their messages. To archive a message (or so they claim) to report, you have to use the mobile app, which is clunky when it comes to reporting and copying each and every message link that you reported, as well as keeping a descriptor.
It's sad that more is not done by companies like Discord, and they absolutely need to be held accountable for disregarding privacy, and failure to take measures to ensure the safety and protection of children on their platform, as well as mandatorily reporting illegal content and the users who distribute it. It's sickening.
@@variegatus4674 That too.
@@donkeykongisbetterthanmari7495 I also thought of something just now... it's also the childs fault for not having common sense and more than half a brain
@@variegatus4674 Don't blame children for being naive. Blame the parents for not having the integrity to sit down with their kid and teach them about online safety.
Hey man just found your channel today i think your pretty dope this is my typa content, you’ve earned my sub foshooo❗️
Not gunna lie. Kinda glad i took screenshots of me and my Fiancés conversation. I knew this day would come where her account would get deleted. Good memories need persevered at all cost especially in unfortunate circumstances.
Sorry to bother you but out of curiousity, what happened to her?
@@edu7979 No worries, she passed away unexpectedly upcoming 2 years in February so I would say that is when her account will be deleted based on this video.
@@HKZTHAPIRATE You can download everything if you have access to her account, I did it a few weeks ago and it looks like everything I've ever said is inside. I don't think replies are included and such, I haven't actually checked closely. But if you download your own account's data too, you'll have the complete interaction.
@@Herkan97 That is smart, thank you.
Ps: CNIL prononciation is knile (ignore the E, consider the K as C)
They should make it a setting to make it so if you were inactive for 2 years, the account would be deleted.
I don't think you can legally consent to that but I'm unsure...
@@erikkonstas I don’t think you can legally deny their ability to remove their services entirely without reason.
@@notchs0son I mean legally consenting to permanent retention of account data.
Pretty sure they added that several months ago worldwide.
@@yoshicake
nah they definitely haven’t I just logged into my account from like 2017 and I stopped using in 2020
Amazing ending, you have my respect.
I'm surprised how many people are happy about stuff like this, yes discord does need better security & privacy options, but as someone into web design & app development, stuff like this is kind of scary. I don't like the idea of foreign governments deciding they know best for you, forcing password requirements or fining a company over the X button minimizing to the system tray when it's something that many apps do & isn't hiding or exploiting anything, every day more & more laws are being make by different countries & states, they are all trying to regulate the internet. As a web or app developer it's becoming impossible to keep track of every new law & regulation being passed by every government around the world, understanding them & making sure you comply with all of them just to avoid the risk of being sued & fined.
It seems recently every government trying to be your parents. It's easy to hate on big companies like Facebook, Google, Microsoft, Apple, Discord but I worry more about how these new laws could effect smaller companies or kill new start ups because of too much legal risk to even make it worth trying to make something new.
france is suing a shit ton of companies for violating privacy and its a rare W
A rare sight of the french actually doing something right
The wumpus crying emoji is perfect for any occasion whenever it's discord in drama.
honey, turn on the television. NTTS uploaded
bro fr that guitar riff at the end was so good
finally, inactive accounts will be deleted.
all our personal info we accidently shared in messages when we were younger and stupid.
2 years is still a pretty long time to delete all that data.
i wanna wipe all my account info right now
I don't think the messages will be gone
for example even if you delete your account rn the messages will still be there
but your account info won't be showing
@@James-un8io
you can information in messages. thats the whole point.
its also why every single message you send is given to you when you request account info
actually i want them to stay
@@Nobody00008 y
better delete all those messages yourself then because discord certainly wont to it
This is why I love EU, they're seriously people and they know what to do
I remember that I saw video on twitter that EU is actually going to reduce waste of chargers by having the same charger for phones to everyone else to save resources and whatever, this would make Apple mad lmao
Apple is already being forced to use USB-C
@@Smileyreal yeah that's what i meant i just forgot what USB
@@Smileyreal thing is, they gonna go wireless to not use usb c
Companies: *possibly harming the security of their customers/users *
US: "I'll allow it"
EU: "OMAE WA MOU SHINDEIRU"
Can we all agree though that you have to be some sort of psychopath to close discord while in a call as a normal routine when chatting XD
I mean it’s not really as a normal routine. Imagine logging off discord by clicking the x while in vc and not being aware of still being in chat, letting everyone else hear your mic and potentially letting discord record it
Yes yesss finally someone talks about the problems of discord thank you
at 1:24 he explains vc not leaving when closing discord in the settings you can disable that so that you do leave
I DIDNT KNOW YOU PLAYED RUNESCAPE LETS GOOO W I PLAYED THAT GAME SINCE 2008 LOL
"We don't like the fact when you press the X button it keeps the app open but minimized!"
macOS windowing system:
Yeah almost all Mac software behaves this way iirc haha
this episode gave me whiplash 😭 maybe because I find it so hard to focus on one thing on the screen... when there's a game in the background, I kept trying to focus on that instead of anything else
Try not looking at the video instead just listen
i am glad the closing tab issue finally is getting talked about
It's a setting you can turn off, it's a completely optional thing
@@modernmarrow1411 True, plus a lot of applications and games have the same feature, it’s a fairly common thing. If the user wants to quit discord they can just right click on the task bar icon. I personally find it practical and fast to be able to minimize discord by just clicking on the very corner of my screen.
im glad they fix this honestly the ammount of times i had to go into tm to close discord is ridiculous, and its always been hit or miss too i dont always have the application stop whem it was closed by the X even though i never use the X just the minus to actually minimize it like a normal human would. But i think this was honestly needed especially for those that may be new to discord in the future and could have been unaware of that flaw
do they not know that there is a toggle in "windows settings" that will make it so discord actually closes instead of minimizing
The point was that this option should be the default and not the other way around, to comply with GDPR
it isnt set on by default, if a user doesnt know that option exists or doesnt know that discord runs in the background thats a big problem
Bro this thing happened with my friend so many times this is literally a privacy issue for many users who only know that clicking on the 'X' will close it. They don't even know that some thing called "tray" exists on their pc. Many people also asked discord earlier to make this change but they didn't, I am very happy that they charged them. Now they will surely default it or did it. 😂
french person here.
I don't think this kind of thing deserved a fine, but I agree with the principle behind it: for a year or two after creating my account back in late 2016 I had to use the task manager to close discord because I couldn't find how to actually close it :p
You right click the Discord Icon on the tray and click quit.
No seriously I can't be the only person who didn't struggle with the X button not fully closing Discord.
The fact that there is a setting in the Discord App that changes whether it goes to your tray or actually closes off is disturbing, they just have to come up with some issue
a lot of programs have that unfortunately,so I always check the task manager after closing a new one
discord have an option to fully close the app when pressing the x button in the "advance" setting..so i dont really get that.. did they just not try to check the discord client settings?
I think the issue is that it's not that way by default.
@Kolonya The "-" button literally exists to minimize programs at user's will though
It's a common thing, this is more for the old people that do not understand modern times and most likely don't bother understanding anything new.
12 out of say 15 processes in the tray are either already only there or can be toggled to be only there. They are not on the task bar and pressing x does not close the program. That's most programs I currently have on that do not close on x, it's not an issue. Imagine you see a window and you try to bust the window open to get out instead of using the door handle for the door the window is attached to. It's not a person that wants to understand.
That guitar riff... Sea Shanty 2... Ah, memories.
I hope some hacker prevention gets added to Discord. I was a RUclipsr and used discord sooo much. I was scammed into downloading what I thought was a game to Beta test and the person took over my pc. He stole a ton of my accounts and I had to wipe my phone and pc :(
same thing happened to me, but he fucked off after a while
That guitar riff of Sea Shanty 2 was beautiful.
As an American, we need to be more strict on our laws involving corporations. We honestly need to start limiting corporate control.
*With regards to a user's right to their data. However, it seems a lot of people are meaning "I don't want anything reposted about me if I don't like it" instead of "I don't want my data becoming a liability to me."
Problem is, most of these corporations have large sways in politics, so they won't vote to actually limit themselves.
you are funny and entertaining, im subbing :)
Wait, inactive accounts will be deleted after 2 years of activity!?
So someone’s dead friend’s accounts will be deleted? CUZ THATS TOTALLY ACCEPTABLE
That's... the side effect of not having a potential liability bomb brewing. Sucks, but inactive accounts being deleted is a tale as old as the internet itself.
@@bakerboat4572 Tell that to Steam.
This was a pretty good video. Really liked the rifffff.
The part about password cracking doesnt mean your password can be cracked in 4 days, hash of it can, so they would need to have data leak
Except it does mean the password itself and not any (salted or not) hash of it. The question is whether Discord's servers will allow it (they won't because they don't want to be DDoS-ed with login requests).
Reading youtube coments about security is always enlightening...
@@Darkxellmc true, you can just slap on a email and slap on the 2nd verification thing as well and it wont be cracked
I think the biggest sin is that if you're using the desktop version (not browser, not sure about mobile), any image, gif, or video you see anywhere in chat will be DOWNLOADED to your hard drive. It's not even encrypted. It just puts it as a non-attachment file name comprised of numbers and letters and all you have do is at .png/.gif or any other attachment that relates to what the file actually is, and you'll be able to see the content. So if you sent something and deleted it, anyway who saw it already has access to it regardless if you delete it. Likewise, if someone post something illegal, it gets downloaded onto your PC and now all it takes is them snitching that you have it on your PC and how to find it and you're gonna be in a hard position explaining that one to the police.
800,000 is pocket change lmao
Yeah 800 buckeroos for discord is nothing
18.75% of their 2021 value is not what I would call "pocket change"
@@ShiroIsMyName Well where'd you get those numbers from lmao if you had used your braincells and googled it you'll know they got $300m in 2021 and they only lost $820,000 which is just 0.27% of 2021 revenue
@@xClairy 300M is their revenue, not their benefits. One is before tax and cost, the other one after. the numbers are from the Forbes article regarding Discord.
@@ShiroIsMyName Unfortunately i can't find it can you link it or give the search query you used?
I hate it when you are forced to follow password guidelines. I get that they are trying to make it more secure for you, but at the end of they day its my info and my security that's at risk... I should be responsible for myself and if I chose to have a weak password then its my fault.
Besides the password and data breach parts, this whole thing was pretty much bs... After the "x to close the window" thing idk if I should just laugh it off or be worried, Discord isn't to blame for people's stupidity after all, at least not with something like that.
Btw, I'm pretty sure that Microsoft Teams does something like that too lol
Teams does but the call is a separate window so it would close the call
6:09 No, they didn’t. Don’t forget these are the same people who openly supported CP on their platform until their userbase made them ban it.
The thing with close to tray is against this law is the same opinion as "if I shut down my computer, it should delete Al my files"
800k is nothing for discord
The "by default" part of that first violation is important. It's okay for Discord to have the weird close behavior so long as a user needs to opt into it before it happens.
The rule isn't just for boomers. I started using Discord when I was 17, and I didn't notice the weird close behavior until I was about 21 (although maybe it wasn't added until I was 21). At the time, it was just a source of irritation -- I closed it because I didn't want it running. If I wanted it running but not in my face, I would minimize it -- as is the norm for applications. But now, life circumstances have changed to where the behavior would be a privacy hazard for me.
literally a setting to make it actually close when x is pressed. its optional so how can you get fined for that
ikr
it's not the default is why, I'd assume they'll be making it the default setting going forward
true but i would say they should make it default the app closes and just have the setting to minimize it instead
there is a setting, just not default and twitch and etc also doesnt have it defaulted
@@yamiru3417 I know there is I was just saying it should be default to close fully
For the first problem: The only thing I could see discord doing differently is while you are in a voice room and you go to hit x to put the application into the tray, it can add yet another prompt to take action or ignore.
For the rest, it makes sense. Follow standards.
Oh no, not 800K Dollars, that's definitely gonna put a dent in their wallet for sure
18.75% of their 2021 value is not what I would call "a dent"
@@ShiroIsMyName Nice statistics bro where the sauce at?
as someone french i can confirm your prononciation isn't... well it's not very baguette
I’m really annoyed honestly, specifically with the 2 year rule for deletion. I have an alt account that I archive old servers in as evidence or for memories. I don’t log in a lot, and now I have to be scared they’ll take it away because I don’t log in, and because when I do I don’t send any messages.
great video and YEAHHHH THEY FINALLY LOST MONEY
As a fluent french speaker, your french sounds like a canadian who failed french class. better than most americans lol.
good job, 11/10, and thanks for the video
There’s literally a “Keep Discord open in background” option in settings. You turn that setting off, and just like magic, when you click the X to close the window, discord closes completely! Wow!
Sadly the account deletion thing could severely screw me over, my main account is one I don't have access to anymore because discord locked it last year and put a phone requirement on it and as I don't have a phone to link to it there is a fairly high chance it will end up getting deleted so yeah that's great.
One thing that I was surprised not to see is about the protection of accounts in general, as it's also the job of the CNIL to ensure that user security is not at risk.
It still baffles me that in 2022, with a software released in 2015/2016, token grabbing software are still around
You're talking about a company that abandoned their last online service without notice, and to this day, exposes their token-incompetence by failing to base64 encode userids.
"oh no! i lost my pocket change! whatever will i do! what a devastating blow!"
I am a Data Controller (company staff member personally liable if a i don't make sure we follow the rules of GDPR in a UK company) and there are some thing to comment here:
The first one Article 25.2 breach will not stand up in appeals, it will go to the EU courts out of France and they will tell the french courts they are wrong, there has not been the expectation that clicking the "X" on a window will close the application even windows 3.1 has MS services running in the background, all Discord need to do is prove one of the many hundreds of Services that are included in Windows by Microsoft, or the thousands if not millions of pieces of software that have not exited when clicking the "X" including but not limited to Teams,Skype and (for much older software) all the way back to MSN Messenger, the Tray has been in windows since Windows 95, and even then an application does not have to be in the tray and still working in the background.
Article 5.1.e they has them bang to rights Discord were violating that by not having a data retention period in the Privacy Policy.
Article 13 actually has nothing to do with discord-keeping data (So nothing to do with the violation of 5.1.e), when ever you collect information from a user E.G Email Address, Name, Address, Eye Colour, IP Address anything that can be used with other information to help identify a user, it must be explicitly clear why your collecting that data, E.G if the user is filling out a contact us form it's intrisically clear they are collecting that information to assist with what ever your reason for filling that form out. however, if they are tracking what discord servers your a member of for advertising networks that is not clear and they must by GDPR explicitly state in there Privary Policy we're collecting XXXX data for the purpose of YYYY. E.G following the same example as before "We're Collecting information about the servers your a member of to provide information to 3rd Party companies to better target you with advertising"
Article 32 again i outright agree, that was not secure enough especially for something that can be used to login to other systems with,
Article 35 i agree with you discord most certainly should have done that, but the impact assessment must include information about how to deal with different types of breaches as well, exactly who to report detected breaches to and such that's why they are so damn important.
Oh and just to add a little more context to Article 25.2, if that goes to Appeals and is allowed to stay, every desktop & mainframe operating system in the world will be banned from the EU because they all use background applications you can't see or close to work.
as a French, I have a long experience of the CNIL who condemns in court companies, even big ones for non-respect of the rules 😂
Discord has a feature that you can enable to close when clicking the X… It’s just not enabled by default.
as a non french person, your pronounciation was perfect.
Bruh 😂 ntts vids are too entertaining sometimes I feel like they have eye drugs
Wake up babe, NTTS uploaded a video
fr
Noo! Staying in the call when minimizing the window is a feature!