Let's Reverse Engineer Discord
medium.com
Let's Reverse Engineer Discord
1–10 of 115 posts
Re: Let's Reverse Engineer Discord
#2Yikes
> We tested this malformed audio packet dispatch at various points during a voice call and consistently watched all malformed audio packets dropped by the server, which means that Discord servers are actively decrypting and inspecting all audio/video communications in real-time and not just some.
Re: Let's Reverse Engineer Discord
#3The problem is... There still isn't a clear business model for discord, the advantages of having premium (nitro) are almost non-existing. That's not an excuse for privacy, I know...
They tried to create a small competitor to Steam's game marketplace but it didn't work out. They're back to the drawing table. Honestly, that's actually really good for free users, like myself, because we can simply use discord's wide array of functionalities for free: Seamless audio and video sharing, wide extensibility of the platform through APIs and bots, simple file-sharing, chat persistency, mobile clients + web client, ability to pick server location, codecs, moderation tools...and the best feature in my opinion...their amazing changelogs popups.
Honestly security wise it might not be very clear, as per this article, where they stand today, I am still super stoked about every other aspect.
Re: Let's Reverse Engineer Discord
#4Yikes > We tested this malformed audio packet dispatch at various points during a voice call and consistently watched all malformed audio packets dropped by the server, which means that Discord servers are actively decrypting and inspecting all audio/video communications in real-time and not just some.
fuck.
Is it really too much to ask for/expect a modicum of decency with these services?
Re: Let's Reverse Engineer Discord
#5Yikes > We tested this malformed audio packet dispatch at various points during a voice call and consistently watched all malformed audio packets dropped by the server, which means that Discord servers are actively decrypting and inspecting all audio/video communications in real-time and not just some.
I don't understand why Discord doesn't just work on a copy of the stream and send the original through. Would have prevented anyone from ever knowing.
Re: Let's Reverse Engineer Discord
#6The problem is... There still isn't a clear business model for discord, the advantages of having premium (nitro) are almost non-existing. That's not an excuse for privacy, I know... They tried to create a small competitor to Steam's game marketplace but it didn't work out. They're back to the drawing table. Honestly, that's actually really good for free users, like myself, because we can simply use discord's wide arr…
But how can you remain super stoked by features of a service that may be decrypting your communication in real time? Does that sour the whole thing for you? If they can decrypt our communications I would think the 3 letter agencies would want to get access to it as well.
Re: Let's Reverse Engineer Discord
#7This is common and necessary for WebRTC SFUs, which perhaps is why Discord does it to support the least common denominator of their web browser based clients.
Edit: Yep, I thought I remembered reading this. Their voice servers are WebRTC SFUs. So this is basically state-of-the-art when it comes to voice over WebRTC. End to end encryption in WebRTC is not possible if you are using a SFU. https://blog.discordapp.com/how-discord-handles-two-and-half...
Re: Let's Reverse Engineer Discord
#8Yikes > We tested this malformed audio packet dispatch at various points during a voice call and consistently watched all malformed audio packets dropped by the server, which means that Discord servers are actively decrypting and inspecting all audio/video communications in real-time and not just some.
fuck. Is it really too much to ask for/expect a modicum of decency with these services?
When you are paying $0.00 for the service? And in this case they are dropping malformed data, which could easily protect their users from malware that exploits weaknesses in the media codecs.
Re: Let's Reverse Engineer Discord
#9The problem is... There still isn't a clear business model for discord, the advantages of having premium (nitro) are almost non-existing. That's not an excuse for privacy, I know... They tried to create a small competitor to Steam's game marketplace but it didn't work out. They're back to the drawing table. Honestly, that's actually really good for free users, like myself, because we can simply use discord's wide arr…
I'm not sure why they haven't tried the business communications angle with an alternate branded Slack competitor.
As a remote worker on an almost entirely remote team, we would benefit from a sort of voice channel huddle on-demand or even just watercooler chatting. There is something more casual about jumping into a premade voice channel where people may already be chatting than starting a Webex or initiating a Slack call that could introduce more "togetherness".
Something with this functionality was on my list when we were evaluating SaaS for our team and I really wanted something similar to Discord.
Of course no one would go for it as its branded, but having a forked version that doesn't bear any resemblance should be doable with minimum work.
Re: Let's Reverse Engineer Discord
#10The problem is... There still isn't a clear business model for discord, the advantages of having premium (nitro) are almost non-existing. That's not an excuse for privacy, I know... They tried to create a small competitor to Steam's game marketplace but it didn't work out. They're back to the drawing table. Honestly, that's actually really good for free users, like myself, because we can simply use discord's wide arr…
I'm not sure why they haven't tried the business communications angle with an alternate branded Slack competitor. As a remote worker on an almost entirely remote team, we would benefit from a sort of voice channel huddle on-demand or even just watercooler chatting. There is something more casual about jumping into a premade voice channel where people may already be chatting than starting a Webex or initiating a Slack…
They are vehemently against this. There is still no way to turn ON email notifications once you "unsubscribe".