News for hackers. Stuff that matters.
Re:Discord ends deal talks with Microsoft by echelon on Tuesday April 20, 2021 @03:02PM (#26879645)
My username and favorite aliases were taken.

Discord allows anyone to share the same username. It appends a nearly invisible hash to disambiguate, and you can even change it.

Discord does usernames right.

Re:Discord ends deal talks with Microsoft by toolz on Tuesday April 20, 2021 @03:19PM (#26879973)
hmm, so on public discord servers if someone copies my nickname and pretends to be me, someone might not easily notice?

Seems like a pretty readily used vulnerability. I remember back in high school on AIM someone made a username very similar to mine and said some nasty things to a girl I was talking to - she told me to stop talking to her and I didn't figure out why until years later. I imagine the same exploit could be done more easily if you can use the same username and discord actively tries to hide the hash.

Maybe I'm just overly sensitive since impersonation has hurt me, though.

Re:Discord ends deal talks with Microsoft by kemitche on Tuesday April 20, 2021 @04:56PM (#26881549)
I'd argue the opposite - it's harder to get away with impersonation.

In the AIM situation, users go in "knowing" that usernames are unique, so if you see a message from user abc123, you "know" it's that person. Which means user abcl23 ("el" instead of "one") can impersonate the real user.

In Discord situations, (1) the user is more likely to know that usernames can be reused, since they weren't required to make a unique one to start - so they can be more cautious of impersonation attempts, and more importantly (2) the Discord devs know names can be reused/abused, and can build better mitigations if they so choose to (like e.g. putting a disclaimer at the top of any message from a user you've never contacted before, etc.)

Re:Discord ends deal talks with Microsoft by Sohcahtoa82 on Tuesday April 20, 2021 @03:46PM (#26880437)
Depends on the setup of the Discord server.

Many servers have different "roles" created, though often they're just nothing more than a title and a different color for your name when chatting on the server. If you don't have the default role on your server, then anybody would probably notice the fake person is a fake because they'd have the default role color.

Second, servers can require that your account have a verified phone number for you to join or chat on it, which raises the barrier a bit for creating fake accounts.

Finally, even if they join a mutual server and send you a private message, when you view the message, you won't see the private message history of the conversation with the real account, giving away that it's at the very least a new account.

Overall, it's harder to impersonate on Discord than it is on AIM, but still certainly not impossible.

Re:Discord ends deal talks with Microsoft by feanaro on Tuesday April 20, 2021 @06:47PM (#26882957)
This sounds wrong. Since Matrix is federated, you can still be echelon, just not @echelon:theserveryoutried.com.

Furthermore, this is just the MXID, the Matrix ID. This is usually de-emphasized in the UI and only used to disambiguate and add users (as you say).

What is usually displayed to users are display names and these are allowed to have collisions, in which case they get disambiguated via MXIDs.

Re:Discord ends deal talks with Microsoft by hpfr on Tuesday April 20, 2021 @03:49PM (#26880480)
Usernames don’t even matter that much thanks to nicks (display names) which are available in Matrix (and unlike Discord, they are available in DM’s), and furthermore, you can get an account with a smaller provider that federates if you really want a username taken on matrix.org.

Other Discord features like servers aren’t there yet, but “usernames” doesn’t seem like a real deficiency.

Re:Discord ends deal talks with Microsoft by rakoo on Tuesday April 20, 2021 @03:56PM (#26880604)
They were taken on one server. Matrix is a federated protocol so any account on any domain works anywhere. If @echelon:matrix.org is taken, you can have @e:chelon.org if you want.