News for hackers. Stuff that matters.
Re:Email addresses are not good 'permanent' identifiers for ... by oooyay on Sunday December 31, 2023 @11:49AM (#38825359)
I liked Discords old scheme where you had an email and a display name. Everyone had the numbers so they didn't matter. When they switched to unique account IDs I was kind of bummed, but I'm still curious why they switched.
Re:Email addresses are not good 'permanent' identifiers for ... by Groxx on Sunday December 31, 2023 @11:53AM (#38825390)
Yeah, same here. I thought it did a good job of resolving username conflicts without it really being an issue inside active social circles. Everyone can just always use their normal username, and it's only a minor friction when sharing your name outside Discord without a link or something.
Re:Email addresses are not good 'permanent' identifiers for ... by sgjohnson on Sunday December 31, 2023 @02:03PM (#38826541)
> but I'm still curious why they switched.

Because it was trivial to impersonate someone. The old usernames supported full UTF-8, enabling a wide variety of attacks.

And by paying for nitro, you could choose the numbers too, so step 1. Find someone you want to impersonate, copy their username, and replace one character with a visually identical one, but a different one. Step 2 - pay for nitro, and choose the numbers too.

As usual, malicious actors are the reason why we can’t have nice things.

Re:Email addresses are not good 'permanent' identifiers for ... by jrockway on Sunday December 31, 2023 @02:29PM (#38826771)
I don't think they solved the impersonation problem. You can still look exactly like someone else, and you can only figure out that person X isn't who you think they are upon investigation. Most people don't investigate anything except the display name and profile picture, so are still vulnerable to impersonation.

As far as I can tell, this hasn't been a big problem in practice. Calls can forge caller ID. Emails can forge the From field. It's irritating but isn't exactly halting society.

I am really not sure why Discord made the change. Wanted to prune inactive users? Wanted to sell Nitro Super Mega Premium to jump ahead in line to get your username of choice? Just bored?

Re:Email addresses are not good 'permanent' identifiers for ... by sgjohnson on Sunday December 31, 2023 @02:59PM (#38827024)
> You can still look exactly like someone else

But you can’t have a username that looks exactly the same anymore.

I’m in some 140 discord servers. The amount of spam from people impersonating someone popular has reduced drastically since this change.

I wouldn’t call “one click” an investigation.

Re:Email addresses are not good 'permanent' identifiers for ... by forgotpwd16 on Sunday December 31, 2023 @04:55PM (#38827833)
So the change that mattered is dropping utf-8. Otherwise if was still supported all someone had to do is step 1.