Web check, alts and VPNs

What it does

Discord never tells a bot where a member is connecting from. So inside Discord, Bastion can't tell that two accounts belong to one person, or that someone is hiding behind a VPN.

The web check fixes that. The member presses Verify in your server, opens a private link to Bastion's site and presses one button. That one visit is enough to check for a second account and a VPN.

The web check itself is free. Second accounts and the VPN check are part of Pro.

What the member sees

1. 1

   They press Verify

   In your verify channel, same as always.

2. 2

   Bastion shows them a link

   Only they can see it. It works once and lasts 10 minutes. It isn't sent as a private message.

3. 3

   They press one button

   The page shows your server's name and icon, says who the link is for, and has a single button: I'm human, let me in. There's nothing to type. If you've switched on second accounts or a VPN choice, the page first asks them to sign in with Discord, so Bastion knows the person on the page is the member the link was made for. That sign-in asks Discord only who they are and creates no Bastion account.

4. 4

   They're let in

   Bastion gives them the member role in Discord. The page says so, usually within a couple of seconds.

Turn it on

1. 1

   Set up verification first

   You need a verify channel and a member role. See verification.

2. 2

   Choose Open a web page

   In the dashboard, open Verification and set Check to Open a web page. Save.

3. 3

   Post a fresh Verify message

   Run /verification setup again. The message tells members what to expect, so it has to match the check you chose.

4. 4

   Pick what to look for (Pro)

   On the same page, switch on Look for second accounts, and choose what happens with VPNs.

5. 5

   Set a channel for alerts

   Alerts go to the Verification alerts channel if you've set one on the Logs page, otherwise to your security alerts channel. Keep it staff only.

Second accounts (Pro)

When someone passes the web check, Bastion compares them with everyone else who has passed it in your server in the last 90 days. It looks at three things.

Then it checks who the match is with. If the other account is banned or quarantined in your server, that looks like ban evasion and gets the stricter setting. If the other account is an ordinary member, it gets the gentler one.

A shared network on its own never kicks, bans or holds anyone, whatever you choose. It's only ever shown to staff.

The owner and trusted people are never held, kicked or banned by the check. If Bastion can't carry out your choice, for example because the member's role is above Bastion's, it lets them in and tells staff what it couldn't do.

VPNs, proxies and Tor (Pro)

Bastion checks the member's address against free public lists: the Tor Project's list of exit addresses, and a community list of VPN and datacentre address ranges. Bastion's server downloads the lists about twice a day and keeps its own copy. The member's browser never talks to anyone but Bastion.

The lists aren't perfect. Some privacy tools, such as iCloud Private Relay, and some office and school networks show up as a proxy or a datacentre. A brand new VPN server might not be listed yet. That's why we recommend asking nicely instead of kicking.

Sometimes the check can't run, for one of two reasons, and Bastion never calls either a pass.

• The member is on IPv6. The public lists only cover the older IPv4 addresses, so there's nothing to check an IPv6 address against, and trying again wouldn't change that. Bastion lets the member in whichever choice you made, and posts a note in your verification log: Couldn't check this connection for a VPN because it uses IPv6.
• Bastion has no usable copy of a list. This usually clears up within a minute. With Let them in and tell staff, the member gets in and staff are told the check couldn't run. With Ask them to turn it off or Kick them, nobody gets through unchecked: the page says We couldn't check your connection and asks them to try again in a minute. The same link works for 5 tries.

Why members sign in

With second accounts or a VPN choice switched on, the page asks the member to sign in with Discord before the button appears. The link only works for the Discord account it was made for. Without this, someone could pass their own link to another person and have that person's device and connection saved under the wrong account.

This isn't the dashboard's sign-in. It asks Discord only for the account's identity, never the email or the list of servers, and it creates no Bastion account. Bastion uses the Discord ID once to check the link, and remembers the answer in the member's own browser for 10 minutes.

If someone opens a link that was made for another account, the page says so and saves nothing about their device or connection. Signing in doesn't use the link up. With both checks off, there's no sign-in at all.

The staff alert

When something is flagged, Bastion posts in your alerts channel: who verified, what Bastion did, and why, for example Same device as @Sam (banned here). It never shows an address or any scrambled value.

• Let in. Shown when the member is being held. Takes them out of quarantine and gives them the member role. Needs the same permission as /quarantine.
• Kick. Kicks them, with a case. Needs the same permission as /kick.
• Ban. Bans them, with a case. Needs the same permission as /ban.

The buttons check who pressed them every time, the same way the slash commands do. See staff tiers. They're paused during panic mode, like other moderation.

Checking someone by hand

You can also right-click any message, choose Apps, then Check for alts, to check the person who wrote it. Discord only allows five right-click commands on a person and Bastion already uses them, so this one lives on messages.

What's stored, and what isn't

• Scrambled per server. Each server has its own secret key. The same person gets a completely different scrambled value in every server, so nothing can be matched between servers, by you, by another owner or by us looking at the database.
• No fingerprinting. Bastion doesn't read the member's screen, fonts, graphics card or anything else about their device. The only thing saved in the browser is one cookie with a random ID, and only when Look for second accounts is on.
• The page says so. Before the button, the page tells the member about the sign-in, the cookie and what's kept.
• Nothing on the free plan. A free server using the web check stores no scrambled values and sets no cookie.

If you switch Look for second accounts off, Bastion stops saving new values straight away. The ones already saved run out on their own within 90 days. Remove Bastion and they go with everything else, 30 days later. See privacy and data.

Your side of the deal

You decide to switch this on, so data protection law treats it as your decision. Three things are worth doing:

• Tell your members, in your rules or your verify channel, that the server checks for second accounts and VPNs.
• Give people a way to ask a human. A member who's held or removed should be able to reach your staff. Switching on appeals covers bans.
• Prefer the gentle settings. Let them in and tell staff puts a person in the loop before anything happens.