Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unlocking Discord Nitro features for free

blog.0x7d0.dev

Post reply on HN
Print view View original

61–70 of 145 posts

Re: Unlocking Discord Nitro features for free

#61

Post by imtringued »

rise-remold wrote: post #14
userbinator wrote: post #7

Currently, Discord doesn’t appear to validate on their servers whether the stream being transmitted truly adheres to the criteria of a non-subscribed user I wonder who thought that would be a good implementation. Client-side validation seems like a very novice mistake.

It's because this isn't a Discord API component, this is their "voice" server of which they have hundreds deployed across the world. Their voice server only checks with the API to verify if you're allowed to join. Beyond that, it becomes a one-to-many packet broadcaster.

I don't know about "voice servers" but if you use something like coturn, there is no way to finely tune this, because it is just a generic "gateway" that is relaying packets to bypass NAT. You could try to connect to the stream and then check the stream quality after the fact but if there are false positives you are mistreating paying customers, which you certainly don't want to do.

Re: Unlocking Discord Nitro features for free

#62

Post by rvnx »

whelp_24 wrote: post #51
userbinator wrote: post #8

Earlier quoted context omitted.

Perhaps closer to "cracker", but I agree that this is the sort of knowledge that the corporates don't want us to know --- so they can attempt to squeeze more $$$ out of us without resistance.

I mean cracker in the current sense of the world. And he did the equivalent of inspect element. It was clever, but no real harms were done to any parties.

From a legal perspective you could argue that he is cracking a software, and sharing the crack, and the result is potential revenue loss for Discord

Re: Unlocking Discord Nitro features for free

#63

Post by mythz »

berbec wrote: post #15
its_a_random_ac wrote: post #5

I'm not accusing the author of doing this, but providing a simple base64 encoded blob at the end to run to enable everything would be a pretty easy attack vector, wouldn't it? edit: just decoded it and touché

For those to lazy to run base64 --decode, here's the result: // Here's a cake if you thought about inspecting the code before executing it: let css = 'font-size: 36px; font-weight: bold; color: red'; console.log("%cNEVER paste code you don't understand into the development console.", css); console.log("%cThis is the best way to compromise your account.", css);

> For those to lazy to run base64 --decode, here's the result:

Or just strip the eval and use JS's native base64 decoder:

atob(base64)

Re: Unlocking Discord Nitro features for free

#64

Post by intelVISA »

simmerup wrote: post #22
userbinator wrote: post #7

Currently, Discord doesn’t appear to validate on their servers whether the stream being transmitted truly adheres to the criteria of a non-subscribed user I wonder who thought that would be a good implementation. Client-side validation seems like a very novice mistake.

Discord is doing so well it's hard to say whether this is actually a problem for them or not. Maybe focusing on this security would have stopped them performing so well

> Discord is doing so well

It's remarkable how much data they are extracting, if the average user knew there would likely be multiple scandals or legal proceedings

Re: Unlocking Discord Nitro features for free

#65

Post by nonima »

zebracanevra wrote: post #13
userbinator wrote: post #7

Currently, Discord doesn’t appear to validate on their servers whether the stream being transmitted truly adheres to the criteria of a non-subscribed user I wonder who thought that would be a good implementation. Client-side validation seems like a very novice mistake.

Non-nitro users can stream in 1080p60, all they have to do is join a "boosted" server. Which is very easy to do - you can find tons of freely joinable 'official' servers for games, which are boosted, and then join one of the available voice channels.

>all they have to do is join a "boosted" server.

I didn't think of this thank you! I wanted to stream in my friend's server for my friends to watch but his server isn't boosted, but now I'm gonna join a random server and stream for strangers instead!

Re: Unlocking Discord Nitro features for free

#66

Post by _joel »

mythz wrote: post #63
berbec wrote: post #15

Earlier quoted context omitted.

For those to lazy to run base64 --decode, here's the result: // Here's a cake if you thought about inspecting the code before executing it: let css = 'font-size: 36px; font-weight: bold; color: red'; console.log("%cNEVER paste code you don't understand into the development console.", css); console.log("%cThis is the best way to compromise your account.", css);

> For those to lazy to run base64 --decode, here's the result: Or just strip the eval and use JS's native base64 decoder: atob(base64)

"Don't cross the streams!", although I take your point...

Re: Unlocking Discord Nitro features for free

#68

Post by didntcheck »

dejawu wrote: post #16
userbinator wrote: post #7

Currently, Discord doesn’t appear to validate on their servers whether the stream being transmitted truly adheres to the criteria of a non-subscribed user I wonder who thought that would be a good implementation. Client-side validation seems like a very novice mistake.

It's also possible to see the names, topics, and timestamp of the last message of hidden channels through their API. The channels are only hidden on the client-side. (To be clear, it's still not possible to view the contents of these channels.)

And also who is in the channel (more generally, you can see the permission overrides on all channels)

It's been a long time since I did any Discord API work but I had assumed they would have fixed this by now. I realise it makes things simpler and more cacheable, but IMO it's a critical and inexcusable user privacy issue to have this behavior with no indication to ordinary users that their hidden channel is in fact quite visible to savvy users. This would be like Google Drive allowing anyone to query filenames (just not content) of private folders

Re: Unlocking Discord Nitro features for free

#69

Post by didntcheck »

intelVISA wrote: post #64
simmerup wrote: post #22

Earlier quoted context omitted.

Discord is doing so well it's hard to say whether this is actually a problem for them or not. Maybe focusing on this security would have stopped them performing so well

> Discord is doing so well It's remarkable how much data they are extracting, if the average user knew there would likely be multiple scandals or legal proceedings

Can you elaborate? What data are they extracting?

Re: Unlocking Discord Nitro features for free

#70

Post by didntcheck »

Jowsey wrote: post #41
deevus wrote: post #2

It rightly warns that you could get banned for using these tricks, but is there any precedent for Discord banning users for this kind of thing?

From the README of Vencord, one of the most popular mods: > Client modifications are against Discord’s Terms of Service. However, Discord is pretty indifferent about them and there are no known cases of users getting banned for using client mods! So you should generally be fine as long as you don’t use any plugins that implement abusive behaviour. But no worries, all inbuilt plugins are safe to use [...]

I have definitely known people be banned for "selfbots" (and I mean personal utility ones, not actually using a user account as a public service account), however they were almost always doing something unwise and conspicuous, like spamming username change requests for "animations", or showing it off in the API server literally in front of a Discord dev
Post reply on HN