Discussion · bonfire.cafe

Dave "Wear A Goddamn Mask" Cochran :donor:

@dave_cochran@infosec.exchange · 6 hours ago

oh good

@distrowatch@mastodon.social · 7 hours ago

@tinker That is all I needed to read to remove the Duo app and cancel business with the one vendor we work with who insists on us using it.

undead

@undead@masto.hackers.town · 7 hours ago

@tinker

If you work with HIPAA or PCI, this integration is a red flag for risk assessment.

Rin3d

@Rin3d@mastodon.social · 8 hours ago

@tinker discord didn't drop the verification. They delayed it.

Tinker ☀️

@tinker@infosec.exchange · 7 hours ago

@Rin3d - You are correct - halfway. I'm referencing Discord dropping Persona specifically - the current pushback was tied to their use of Persona as well as their intended actions.

https://arstechnica.com/tech-policy/2026/02/discord-and-persona-end-partnership-after-shady-uk-age-test-sparks-outcry/

Ars Technica

Discord and Persona end partnership after shady UK age test sparks outcry

Persona confirmed all age check data from Discord's UK test was deleted.

Synn Fynn :ablobcatneon:

@synnfynn@corteximplant.com · 8 hours ago

@tinker

I can't fucking believe this...I swear... every damn day...

I use DUO MFA to auth into my graduate uni alumni email account. So, are you (implicitly) saying that, by extension, they may block access to alumni uni email accounts until one verifies for restored access to said uni email accounts??

Just putting it out there because it's not too hard to extrapolate into the not-to-distant future..

I mean, you keep running and running to stay just out of their clutches...

Tinker ☀️

@tinker@infosec.exchange · 7 hours ago

@synnfynn - So two things. One, you can ask if they are using this feature to validate people. They'll tell you straight up. If they aren't using this feature, then THAT PART AND ONLY THAT PART does not apply to you.

The second thing is they appear to be using Persona on the backend anyways. So your PII (based on what I'm reading on their own website) is being sent to Persona, then from Persona to 17 other companies, and from those 17 other companies on out.

So they've already shared your stuff.... or so they seem to be saying.

Crookie

@Crookie@mastodon.social · 8 hours ago

@tinker I'm guessing bitching to my Cisco rep won't get me far either...

Tinker ☀️

@tinker@infosec.exchange · 7 hours ago

@Crookie - Actually. It will.

You push back against your rep, and they log it and report it in their meetings.

One of the major jobs of a customer service and sales rep is to document and report on current client trends and perceptions.

Push back. And continue to push back. Make it their problem so they pass the problem on.

They change their product and offerings all the time to get more money from clients. If clients are pushing back, threatening not to spend more money, they will alter their actions to get more money.

The bottom line is the bottom line for a reason.

https://mastodon.social/@Crookie/116143244027444019

Tinker ☀️

@tinker@infosec.exchange · 7 hours ago

@Crookie - Actually. It will.

You push back against your rep, and they log it and report it in their meetings.

One of the major jobs of a customer service and sales rep is to document and report on current client trends and perceptions.

Push back. And continue to push back. Make it their problem so they pass the problem on.

They change their product and offerings all the time to get more money from clients. If clients are pushing back, threatening not to spend more money, they will alter their actions to get more money.

The bottom line is the bottom line for a reason.

https://mastodon.social/@Crookie/116143244027444019

Till Kleisli

@kleisli@mastodon.social · 9 hours ago

@tinker I just left a one-star-review on google play. Just because we can't do much abut it, that doesn't mean we can't do nothing.

Vrimj

@Vrimj@mastodon.sandwich.net · 9 hours ago

@tinker
And in my case, students. My university depends on this.

Tinker ☀️

@tinker@infosec.exchange · 9 hours ago

@Vrimj - Very good point and I hadn't considered that. The knock-on effects are widespread.

Rob Vincent 🎙️

@Rob_T_Firefly@masto.hackers.town · 9 hours ago

@tinker Discord delayed their age verification in the face of user outcry, they didn't drop it. They'll sneak out back in once the heat dies down.

https://discuss.online/post/36057750

Tinker ☀️

@tinker@infosec.exchange · 9 hours ago

@Rob_T_Firefly - Yeah that's trash. They did drop Persona though because of backlash specific to it:

https://arstechnica.com/tech-policy/2026/02/discord-and-persona-end-partnership-after-shady-uk-age-test-sparks-outcry/

Ars Technica

Discord and Persona end partnership after shady UK age test sparks outcry

Persona confirmed all age check data from Discord's UK test was deleted.

Tinker ☀️

@tinker@infosec.exchange · 9 hours ago

Inb4 Duo responds and makes the statement:

"These Persona services are opt-in by the client as additional features. We do not integrate them into our core product."

to which the answer to that response is:

"Yeah, the CLIENT opts in, meaning the COMPANY opts in... the employees have no say. The *employees*, all of us, can only opt out by being fired."

Edit: Reading Duo's privacy statement though, I'm not sure if the client actually can opt out. It looks like its fully integrated right now. Clients may opt to require employees to scan their faces... but it looks like IDV with Persona is fully integrated into the above mentioned services. So yay.

#Duo #Persona #Privacy #AI #infosec #Discord

alien8

@alien8@infosec.exchange · 8 hours ago

@tinker i run a DUO MSSP. I can confirm it is disabled by default per instance and is not integrated into the core auth elements. I have just spent valuable time verifying this. why do they do mind numbing things like this - oh, some people have asked for this..

alien8

@alien8@infosec.exchange · 8 hours ago

@tinker i run a DUO MSSP. I can confirm it is disabled by default per instance and is not integrated into the core auth elements. I have just spent valuable time verifying this. why do they do mind numbing things like this - oh, some people have asked for this..

Tinker ☀️

@tinker@infosec.exchange · 7 hours ago

@alien8 - Yeah, I figure any statement by Duo will absolutely push the whole "its not enabled by default" and its the client's decision to use it.

Which ignores the core point - the employees (once a client enables it) have no say. By even offering this, they put so many people in the position of "accept this or quit" which is not consent.

Especially in the US where one's job is tied to access to healthcare and where many live paycheck to paycheck and if they quit or get fired, they run the real risk of going hungry or losing their house.

#Duo #Persona #AI #infosec #privacy #discord

alien8

@alien8@infosec.exchange · 7 hours ago

@tinker yes, for US i suspect configuration/setup of this will be done by certain orgs.. I don't see anyone in Europe/UK turning this one...

Tinker ☀️

@tinker@infosec.exchange · 6 hours ago

@alien8 - Yeah, indeed. And even if they did, I figure (hope? feel?) that they have more protections to push back on an employer doing this. Not sure, but that's my understanding.

alien8

@alien8@infosec.exchange · 6 hours ago

@tinker depending on the State.. maybe... but considering the 'ask' from the customers to commit to this engineering work (it's a bunch of UI changes plus of course all the API hookup work) it must have been a significant revenue requirement and very sizeable accounts.

Tinker ☀️

@tinker@infosec.exchange · 7 hours ago

@alien8 - Yeah, I figure any statement by Duo will absolutely push the whole "its not enabled by default" and its the client's decision to use it.

Which ignores the core point - the employees (once a client enables it) have no say. By even offering this, they put so many people in the position of "accept this or quit" which is not consent.

Especially in the US where one's job is tied to access to healthcare and where many live paycheck to paycheck and if they quit or get fired, they run the real risk of going hungry or losing their house.

#Duo #Persona #AI #infosec #privacy #discord

jaKa Močnik

@jkmcnk@mastodon.social · 10 hours ago

@tinker iirc, discord dropped persona a while ago. they use k-id in this round of age-gating.

Tinker ☀️

@tinker@infosec.exchange · 9 hours ago

@jkmcnk - The recent backlash was tied to their use of Persona as well:

https://arstechnica.com/tech-policy/2026/02/discord-and-persona-end-partnership-after-shady-uk-age-test-sparks-outcry/

Ars Technica

Discord and Persona end partnership after shady UK age test sparks outcry

Persona confirmed all age check data from Discord's UK test was deleted.

RootWyrm 🇺🇦:progress:

@rootwyrm@weird.autos · 10 hours ago

@tinker and it is a statement of fact that Persona is deeply integrated with Palantir, and both are very actively using the data to assemble lists of "politically exposed" and "undesirables" which are being actively provided to the Nazi regime.

Nina

@bluestocking@sfba.social · 10 hours ago

@tinker oh, fun--my uni uses this :/

Bill

@Sempf@infosec.exchange · 10 hours ago

@tinker Oh for fuck's sake. Who do I recommend now? I have to change my remediation template language for 'lacking MFA'. Shit. Why does everything have to suck?

Denice

@de3ev@infosec.exchange · 10 hours ago

@tinker why do they have to ruin everything ughhh

Christoff, the human

@christoff@yem.bouncingaroundtheroom.online · 9 hours ago

@de3ev @tinker it is beyond exhausting, what's a word for being ground down with anxiety and "are you f*cking serious?! really?!" every day?

Denice

@de3ev@infosec.exchange · 9 hours ago

@christoff @tinker society will collapse because of these idi*ts

Christoff, the human

@christoff@yem.bouncingaroundtheroom.online · 9 hours ago

@de3ev @tinker I mean post-apocalyptic stories and novels are one of my favorite genres, but didn't think I'd be getting a front row seat.

But hey, I got a unique seat! Got to see the rise of the Internet and commodity technology to AI to corporations owning everything, including people's lives via their livelihoods and medical care, with no hope of things changing on the horizon. If anything, prepare for it to be much worse 😞

It's a lot. I don't get how people are making it cause I'm barely

Tinker ☀️

@tinker@infosec.exchange · 9 hours ago

@christoff @de3ev - I loved loved loved cyberpunk.... but yeah, living in a more mundane boring version took its appeal away from me.

Big way I am making it is through solarpunk (for this VERY reason). I need something to hope for and something to build towards. So it's solarpunk literature, art, and in my actual life - building solarpunk apparatus and community.

Christoff, the human

@christoff@yem.bouncingaroundtheroom.online · 8 hours ago

@tinker @de3ev that's true brosif, remember you introducing it to me and it was a spark of hope. I need that again. I introduced it to my girlfriend anyway, mainly when bitching about cement jungles they drape plants down, like they're making a difference in a real way 😞

Had to explain the culture and overall mindset of it all.

1 more replies (not shown)

Denice

@de3ev@infosec.exchange · 9 hours ago

@tinker @christoff

If we think about it, we are just living in borrowed time. Not to be negative and all that. But, if you stop and realize it, its just a very short time. If these billionaires only realize how short this life is, they'd make this world a better place.

I am not sure if they have moral compass to realize that kind of stuff. But anyway, it sucks

1+ more replies (not shown)

Denice

@de3ev@infosec.exchange · 9 hours ago

@tinker @christoff I need to follow all your steps y'all.

1+ more replies (not shown)