News for hackers. Stuff that matters.
Re:Microsoft in talks to buy Discord for more than $10B by c0nducktr on Tuesday March 23, 2021 @01:32AM (#26551452)
Would you elaborate a bit? Are they scanning for other devices / other details about your network?
Re:Microsoft in talks to buy Discord for more than $10B by ev1 on Tuesday March 23, 2021 @02:41AM (#26551797)
They do Bluetooth, which by proxy gives location access, block VPNs and ban your accounts if you ever try to sign in with one or anonymisers, require a phone number non-VOIP, collect virtually every interaction way past what normal analytics would do and send them via the same or a similar route to prevent route-based adblock.

Desktop client also continually scans running processes.

Very aggressive client fingerprinting.

Re:Microsoft in talks to buy Discord for more than $10B by square_usual on Tuesday March 23, 2021 @03:24AM (#26552051)
Discord doesn't require a phone number AFAIK. I have used an account without a phone number attached for nigh on three years now.
Re:Microsoft in talks to buy Discord for more than $10B by dasyatidprime on Tuesday March 23, 2021 @04:07AM (#26552318)
That rather depends on your usage pattern, I expect. Twitter has similar inconsistent reports, and I can confirm personally that I was suddenly asked for one as soon as I tried to post anything; I believe I also had something like that happen with Discord, but I don't remember as clearly.

Not that it's necessarily malicious in intent—requiring “extra verification” only on suspected misuse isn't entirely unreasonable, and that's awfully hard to distinguish from things like targeted privacy attacks—but it would be nice to establish this sort of thing as common knowledge, especially since I imagine the chaff of “huh? no they don't” is only to their benefit.

Re:Microsoft in talks to buy Discord for more than $10B by ev1 on Tuesday March 23, 2021 @04:15AM (#26552361)
Every major discord server (if you are not just strictly in DM with friends or make your own with friends) requires phone verification with virtually no exceptions.

Using any form of datacentre IP or anonymiser requires phone verification randomly within a few minutes or hours of starting interaction [regardless of server].

You get a different error message and cannot use discord at all: https://i.imgur.com/T57xcff.png

Re:Microsoft in talks to buy Discord for more than $10B by Ennea on Tuesday March 23, 2021 @06:17AM (#26553200)
I cannot confirm either of these claims. Although the former depends on the exact definition of "major", I guess.
Re:Microsoft in talks to buy Discord for more than $10B by 1_player on Tuesday March 23, 2021 @05:52AM (#26553010)
And don't block VPNs either. At least not mine. Not sure where GP got this information.
Re:Microsoft in talks to buy Discord for more than $10B by ev1 on Tuesday March 23, 2021 @03:18PM (#26559141)
I can nearly guarantee an account ban if you are on Firefox with uBlock + resistFingerprinting and use any popular VPN provider (Hetzner, OVH, etc).
Re:Microsoft in talks to buy Discord for more than $10B by gsich on Tuesday March 23, 2021 @05:14AM (#26552727)
It depends on the "server" owner.
Re:Microsoft in talks to buy Discord for more than $10B by alternatetwo on Tuesday March 23, 2021 @09:34PM (#26562516)
I think the internal term is "guild".
Re:Microsoft in talks to buy Discord for more than $10B by filleduchaos on Tuesday March 23, 2021 @07:29AM (#26553747)
> Desktop client also continually scans running processes.

Isn't this in order to update current game status?

Re:Microsoft in talks to buy Discord for more than $10B by jodrellblank on Tuesday March 23, 2021 @09:02AM (#26554466)
Yes; see this Reddit post by their CTO from 5 years ago: https://old.reddit.com/r/discordapp/comments/43lqyb/why_is_d... which says:

"CTO of Discord here.

We do not record all your processes and send them to our servers.

We watch the process list for 3 reasons.

    Detect games to show on your status message. You can turn this off anytime in the privacy tab of settings.
    Detect games to hook the overlay into if it is enabled.
    Detect games run as administrator to warn that Push to talk won't work.
You cannot disable the scanning as the 3rd reason is always required.

If you use the overlay we send information about your DirectX and GPU to our metrics server to track success rate of the overlay as we test it and improve it. We will probably stop sending this to our server as soon as overlay moves out of the experimental phase.

Nothing else is ever saved to disk or sent over the network.

Also the IP address you listed is an address of one of our US East voice servers which has no relation to our primary data center. Nothing is sent over it that would involve games. Our primary IPs (where we send your status) would be something else. Whatever data you saw being sent continuously was probably related to voice chat."