LTT Discord is being scraped by a company that wont let you delete the data they have

[limegorilla]

First off, if your on the LTT Discord this has affected you.

 

Long and short of it - https://dis.cool are scraping servers, acting as real people - and they have scraped the LTT server, along with other big ones like dbrand.

They have

• Linked accounts (Twitch, Spotify, etc)
• Status
• Online info
• Chat logs
• Game info

THIS IS IN VIOLATION OF GDPR. THEY ARE NOT ALLOWED TO GET THIS DATA WITHOUT YOUR PERMISSION IN THE FIRST PLACE, AND TO TOP IT OFF YOU CANT DELETE IT.

There is a reddit post with more info - here: 

 

I have contacted discord support, as well as all of the mods (including the LTT ones) of every server i'm in that has been affected.

This is the message:

Quote

 

Hi, not sure who to contact about this, but here we go.

There is a webpage: https://dis.cool/ who are scraping your server. They are scraping a large amount of servers, and taking a lot of userdata, such as status, online state, what games your playing, usernames, chatlogs and more. They have the accounts your account is connected to. For more info, See https://www.reddit.com/r/privacy/comments/f5bbz4/discool_is_creating_profiles_of_discord_users_who/

This data is personally identifiable, in breach of GDPR, and when you go to delete your data on their webpage, get redirected to an image mocking you for not just completely deleting your Discord Account. I.E: the info they have on you, there is no way for you to delete any of it. They are also profiting off the data they do have.

While this may not seem like a massive deal to all, it is in breach of the law in a very large part of the world. It's invasive, and just leaves a bad taste in everyones mouth. Privacy is one of the last things we have left. Please spread the word, as we need attention to get action taken on them.

 

 

Again, this is very much in breach of privacy. 

Make noise.

[Dedayog]

FYI, in your signature use a comma after "me" and before "humans" since you're addressing them.  

 

I'd probably be more upset that servers are "scrapable" than that someone is "scraping".

 

Security > intentions.

[Lurick]

They have a "removal" link which, when clicked, will automatically redirect you to this url:

 

Edit:

Looks like the removal link is a troll link because they think they are above whatever laws for whatever country they might be hosting the server in

 

[vanished]

Interesting.  I'm not involved in the discord in any way but I'm going to link this thread to the rest of the mod team to ensure it gets due attention, whatever that may be.

[WkdPaul]

3 minutes ago, Lurick said:

*snip*

 

[limegorilla]

3 minutes ago, jstudrawa said:

FYI, in your signature use a comma after "me" and before "humans" since you're addressing them.  

 

I'd probably be more upset that servers are "scrapable" than that someone is "scraping".

 

Security > intentions.

Fully agree. Annoyingly its down to the way discord works  

And lol thanks, I'll change my signature

1 minute ago, wkdpaul said:

 

 See attached image 

[WkdPaul]

They are completely aware that users don't really have powers to stop them and are taunting on Twitter ;

 

 

[.Apex.]

39 minutes ago, Lurick said:

They have a "removal" link which, when clicked, will automatically redirect you to this url:

 

which shows this:

Just tried that, they're clearly trolling because it instantly directs you to a "removed.png" but it doesn't actually remove anything, the image is purposefully put there.

https://i.imgur.com/removed.png

 

Edit: they've said themselves that it is a troll https://twitter.com/discoolsupport/status/1214976698145374209

[limegorilla]

I've contacted quite a few people, and managed to get responses from the mods of two different servers so far - not the LTT one yet. Apparently Discord is aware of dis.cool, but no action has (currently) been taken as far as them being "forced to implement a data removal page" - and as several have noted, it just redirects to a meme

 

How the fuck is this still a thing.

[divito]

While any user can technically record that information, being able to automate it is more on Discord than dis.cool.

[limegorilla]

Just now, divito said:

While any user can technically record that information, being able to automate it is more on Discord than dis.cool.

It is on discord, but every platform has holes. While I wish they hadn't had this happen in the first place I'm actually glad it has - I want to see if they will actually do anything.

 

[LukeSavenije]

stupid question maybe... did you send this to Jake and Momo? they are from what i know the main people of the ltt discord

 

just to make sure

[jiyeon]

This isn't the first time Discord has had an incident regarding user data, and certainly won't be the last. I feel like this is more on Discord's security moreso than the actual scraping itself as I've been part of a scrape before, which is why I tend to not connect anything major to my Discord, not join any huge Discord servers, and certainly not connect any sensitive information excluding my phone number for two-factor authentication.

[limegorilla]

Just now, LukeSavenije said:

stupid question maybe... did you send this to Jake and Momo? they are from what i know the main people of the ltt discord

 

just to make sure

I've definitly sent it to Jake (still no response) and Lilithly but couldnt see momo on the mod role. Lilithty has told me they will look into it

[limegorilla]

Just now, sowon said:

This isn't the first time Discord has had an incident regarding user data, and certainly won't be the last. I feel like this is more on Discord's security moreso than the actual scraping itself as I've been part of a scrape before, which is why I tend to not connect anything major to my Discord, not join any huge Discord servers, and certainly not connect any sensitive information excluding my phone number for two-factor authentication.

Why can't we tho. We should be able to live in a world where we do, and companies actually fight for out privacy.

 

Maybe I'm just naive but

[LukeSavenije]

1 minute ago, limegorilla said:

I've definitly sent it to Jake (still no response) and Lilithly but couldnt see momo on the mod role. Lilithty has told me they will look into it

oh, then it's probably at momo too already

 

as long as it's inside the team, that should be fine

[LogicalDrm]

And this is why there are extended security measures like phone number verification's in place. Or what now-bad-Blizzard tried to get going years ago with RealID for games. Though still even real users could cause this kind of thing.

[Meadowflaw]

I've reported them to OVH (Their hosting provider) but I wouldn't be surprised if they don't do anything

 

also taunted them on twitter lol 

 

[resynth1943]

 

1 hour ago, limegorilla said:

This is in violation of GDPR.

I totally agree, as I have made obvious in my comment to the Reddit thread that has, quite frankly, blown up. I'd like to make it known that I wholeheartedly disagree with the ethics behind this service, and that of the developers.

 

This service has radically abused the privacy of, as stated by them on their homepage, "100 million users". With the personal data of millions of people in mind, I believe that this service should be either completely drained of all remaining data and restarted to comply with GDPR, or shut down.

 

Following the above, I'd like to direct you to my Reddit comment, which explains the "ins and outs" of this very clearly.

 

My response to the Reddit thread.

 

I'd like to thank each and every one of you for jumping on this, so to speak. This abuse needs to be met with extreme pushback.

 

Thanks,

Resynth

 

[Roswell]

I feel like I'm missing something.

 

Public Discord servers are... public, and you're upset that someone is scraping public information that you willingly put out into the public, on purpose, for anyone to view. 

 

Where's the issue here?

[SpikeSpiegel]

9 minutes ago, Vitamanic said:

I feel like I'm missing something.

 

Public Discord servers are... public, and you're upset that someone is scraping public information that you willingly put out into the public, on purpose, for anyone to view. 

 

Where's the issue here?

Just don't put your Facebook info in Discord.  That's one way of staying safe.

[GDRRiley]

10 minutes ago, Vitamanic said:

I feel like I'm missing something.

 

Public Discord servers are... public, and you're upset that someone is scraping public information that you willingly put out into the public, on purpose, for anyone to view. 

 

Where's the issue here?

that they are collecting it and combining it with no approval or way to stop it.

[Roswell]

Just now, GDRRiley said:

that they are collecting it and combining it with no approval or way to stop it.

But you voluntarily gave the information to the general public. You chose to do it, you can't cry foul when someone looks at it and documents it.

 

Easy solution is not to give the public information you don't want them to see.

 

 

[GDRRiley]

2 minutes ago, Vitamanic said:

But you voluntarily gave the information to the general public. You chose to do it, you can't cry foul when someone looks at it and documents it.

 

Easy solution is not to give the public information you don't want them to see.

 

 

Not really. You can and should if they sell it or refuse to stop.

 

If someone sat outside my window and looked in and recorded every program I opened and for how long according to you that is fine. I can't tell them to stop or go away nor can I be mad if they sell that.

[WereCatf]

13 minutes ago, Vitamanic said:

But you voluntarily gave the information to the general public. You chose to do it, you can't cry foul when someone looks at it and documents it.

Under GDPR, you can.