age verifies your account automatically as an adult on any website using k-id
made by xyzeva and Dziurwa, greetz to amplitudes (for previous work)
it doesn't matter if you are in the UK or similar region that currently has access to this, this will verify your account for the future global rollout in march aswell as current. to use, simply paste this script into your discord console by going to discord.com/app, pressing F12, going to Console and copying and pasting and hitting enter on the following script and solving the captcha that pops up (typing "allow pasting" before if necessary):
// add a chunk to get all of the webpack chunks
_mods = webpackChunkdiscord_app.push([[Symbol()],{},r=>r.c]);
webpackChunkdiscord_app.pop(); // cleanup the chunk we added
// utility to find a webpack chunk by property
findByProps = (...props) => {
for (let m of Object.values(_mods)) {
try {
if (!m.exports || m.exports === window) continue;
if (props.every((x) => m.exports?.[x])) return m.exports;
for (let ex in m.exports) {
if (props.every((x) => m.exports?.[ex]?.[x]) && m.exports[ex][Symbol.toStringTag] !== 'IntlMessagesProxy') return m.exports[ex];
}
} catch {}
}
}
// find the discord api client
api = findByProps('Bo','oh').Bo
// send a api request to discord /age-verification/verify and then redirect the page to our website
window.location.href = `https://age-verifier.kibty.town/webview?url=${encodeURIComponent((await api.post({ url: '/age-verification/verify', body: { method: 3 }})).body.verification_webview_url)}` (feel free to read the code, we made it readable and we have nothing to hide)
it should navigate to a link (or give you a link to navigate to), from there, you can just wait until the page says success
congrats! your discord account is now age verified.
navigate to the age verification page and choose selfie, from there, get the url of the qr code and put it in this input box, and press verify
k-id, the age verification provider discord uses doesn't store or send your face to the server.
instead, it sends a bunch of metadata about your face and general process details. while this is
good for your privacy (well, considering some other providers send actual videos of your face to their servers), its also bad for them, because we can just send legitimate looking metadata to their servers
and they have no way to tell its not legitimate.
while this was easy in the past, k-id's partner for face verification (faceassure) has made this significantly
harder to achieve after amplitudes k-id verifier was released, (which doesn't work anymore because of it.)
with discord's decision of making the age verification requirement global, we decided to look into
it again to see if we can bypass the new checks.
the first thing we noticed that the old implementation doesn't send when comparing a legitimate
request payload with a generated one, is its missing encrypted_payload, auth_tag, timestamp and iv in the body.
looking at the code, this appears to be a simple AES-GCM cipher with the key being nonce + timestamp + transaction_id, derived using HKDF (sha256). we can easily replicate this and also create the missing
parameters in our generated output.
heres where it kind of gets tricky, even after perfectly replicating the encryption, our
verification attempt still doesn't succeed, so they must also be doing checks on the actual
payload.
after some trial and error, we narrowed the checked part to the prediction arrays, which are outputs, primaryOutputs and raws.
turns out, both outputs and primaryOutputs are generated from raws. basically, the raw
numbers are mapped to age outputs, and then the outliers get removed with z-score (once for primaryOutputs and twice for outputs).
there is also some other differences:
xScaledShiftAmt and yScaledShiftAmt in predictions are not random but
rather can be one of two values
with all of that done, we can officially verify our age as an adult. all of this
code is open source and available on github, so you can actually see how we do this exactly.