Discord/Twitch/Snapchat age verification bypass

Exploit and current system design

• The bypass targets Discord’s k-ID selfie-based age check, which runs a model locally and sends only encrypted “metadata” (prediction arrays, process details) back to the provider.
• Commenters note the crypto (AES-GCM, HKDF) protects transport, not input authenticity: if the client can be controlled, the model outputs can be faked.
• The exploit initially worked (users received “adult group” confirmations), then appears to have been partially or fully patched; people now report errors or no verification status change.
• Some users warn the script is now broken and may get accounts flagged into “ID only” flows.

Effectiveness and the cat‑and‑mouse game

• Many see digital age verification as an unwinnable arms race: users can spoof webcams (virtual cameras, pre-recorded video, high‑res screens, VTuber-style 3D faces).
• Others argue vendors can escalate with liveness checks (rapid color changes, head movements, depth/IR cameras, hardware-attested environments), though these raise cost and compatibility issues.
• Several claim platforms mainly need “friction” and plausible compliance, not perfect enforcement; teens and savvy users will always find workarounds.

ID vs. biometrics vs. government eID

• One camp expects the endgame to be mandatory government ID checks or national eID systems (EU eID, BankID-style schemes), possibly with privacy-preserving “is over 18?” attestations.
• Critics worry such systems either leak identity to platforms or browsing habits to governments, and can be abused for broader surveillance.
• There’s debate over how many adults lack IDs and whether that exclusion is acceptable; some point out teens often have no ID at all.

Privacy, tracking, and free speech

• Many see age verification as a pretext to tie real-world identity (face, ID) to social activity, enabling profiling, ad targeting, or political repression.
• Sending “just metadata” is viewed as misleadingly reassuring: facial feature vectors and depth data are themselves biometric fingerprints.
• Commenters warn that normalizing ID-for-speech erodes anonymity and chills dissent, even if today’s implementations are weak.

Responsibility and child protection

• One side argues platforms and regulators are mis-targeting: robust parental controls and education would address child safety without panopticon-style identity systems.
• Others counter that many parents are unwilling or unable to manage this, so governments offload responsibility onto platforms, especially in places like Australia and the UK.

User reactions, network effects, and alternatives

• Some users delete accounts or cancel paid tiers on principle; others say most people will comply and don’t care about sharing IDs or selfies.
• A large subthread emphasizes network effects: Discord concentrates gaming and social communities, history, and tooling; migrating to Matrix, Zulip, Mumble, etc. is socially and technically costly and often kills communities.
• A few argue that bypasses are counterproductive: they keep users in the walled garden, provide cover for “checkbox” compliance, and may justify even more invasive schemes later.
• There’s concern about teaching users—especially kids—to paste arbitrary JavaScript in consoles, and about scammers exploiting “age verification bypass” searches.