Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Reverse Engineer Discord

medium.com

Post reply on HN
Print view View original

41–50 of 115 posts

Re: Let's Reverse Engineer Discord

#41

Post by duskwuff »

mapcars wrote: post #39
Animats wrote: post #26

Discord privacy policy: In an ongoing effort to better understand and serve the users of the Services, we may conduct research on our customer demographics, interests and behavior based on the information collected. This research may be compiled and analyzed on an aggregate basis, and we may share this aggregate data with our affiliates, agents and business partners. We may also disclose aggregated user statistics in…

Is discord known to be used in corporate sector? I think so far it's dominated by Slack and Discord is mostly used by games/communities.

I'm sure there are some businesses using Discord, but they aren't the target audience. The branding and feature set of Discord all make it very clear that it's targeted at PC gamers.

Re: Let's Reverse Engineer Discord

#42

Post by BlueTemplar »

znfi wrote: post #15
nightfly wrote: post #8

Earlier quoted context omitted.

When you are paying $0.00 for the service? And in this case they are dropping malformed data, which could easily protect their users from malware that exploits weaknesses in the media codecs.

I find this notion that you should be absolved of all responsibilities just because you give it away for free to be completely wrong. They should still be transparent about what they are doing. This notion also does not translate very well to things which are not related to IT. I use a very large number of things in my daily life which I am not paying for but I still expect them to work and be safe. Or would be it be…

Did they ever claim that they wouldn't listen to and exploit your communications for profit? Hmm, what does the GDPR say about this, already?

Re: Let's Reverse Engineer Discord

#43

Post by tsukurimashou »

senectus1 wrote: post #4
mmastrac wrote: post #2

Yikes > We tested this malformed audio packet dispatch at various points during a voice call and consistently watched all malformed audio packets dropped by the server, which means that Discord servers are actively decrypting and inspecting all audio/video communications in real-time and not just some.

fuck. Is it really too much to ask for/expect a modicum of decency with these services?

nothing is "free" if you're not paying with money for some service you're paying with something else

Re: Let's Reverse Engineer Discord

#44

Post by saagarjha »

ip26 wrote: post #16
znfi wrote: post #15

Earlier quoted context omitted.

I find this notion that you should be absolved of all responsibilities just because you give it away for free to be completely wrong. They should still be transparent about what they are doing. This notion also does not translate very well to things which are not related to IT. I use a very large number of things in my daily life which I am not paying for but I still expect them to work and be safe. Or would be it be…

If we're going to wander off into metaphor, this seems more analogous to a doorman refusing to allow you to bring your 800lb gorilla (sneakily dressed as your child) onto the elevator.

I think a better one would be the postman unsealing and re-sealing your mail.

Re: Let's Reverse Engineer Discord

#45

Post by kevingadd »

orliesaurus wrote: post #3

The problem is... There still isn't a clear business model for discord, the advantages of having premium (nitro) are almost non-existing. That's not an excuse for privacy, I know... They tried to create a small competitor to Steam's game marketplace but it didn't work out. They're back to the drawing table. Honestly, that's actually really good for free users, like myself, because we can simply use discord's wide arr…

Pay-once-per-user has always seemed like a perfectly clear business model to me. Maybe not one that can properly fund the company, but a reasonable one. In comparison every Slack I use is filled with nag messages scolding us for not paying a per-user fee just to have casual chats about meeting up at local restaurants, as their business model is 'earn $200/mo for every person who uses our service because they have to join multiple slacks'

Due to the fact that I'm on one for work, Slack is already earning more off me than Discord is but they still want more. It makes it impossible for me to like them. Discord having lower friction for joining multiple small servers is a plus here too, because it means I'm not stuck joining a big poorly-moderated community just to chat with a small group of friends.

It's not game-changing but I also think things like 'high quality group video calling', 'screen sharing', and 'high quality group audio calls' are perfectly reasonable things for Discord to sell. IIRC some stuff like that is currently gated behind Nitro. The ability to use emotes cross-server is also quite popular so I see many people buying Nitro just for that. I personally have a small Discord server for my family and I use it for my personal collection of cross-server emotes.

Re: Let's Reverse Engineer Discord

#46

Post by mmis1000 »

franga2000 wrote: post #21
coenhyde wrote: post #14

I don't think Discord makes any claims that the audio is P2P encrypted. There are legitimate reasons why Discord might be dropping malformed packets, apart from an indication that they are spying on you (they may be doing that too). 1) to improve audio quality. 2) to help prevent RCE attacks on the destination client. 3) re-encoding at lower bitrates for low bandwidth clients. I don't really see the issue here unless…

3) is most certainly at play here, as Discord allows clients to set their preferred bitrate (RX&TX), which would not be possible in multi-party calls without re-encoding.

The channel bitrate is just a client hint as far as i know (at least for now).

Bots are able to send whatever bitrate they want to the channel, and other clients received as is.

The server simply relay opus data without re-encode it.

Re: Let's Reverse Engineer Discord

#47

Post by jeltz »

gfodor wrote: post #7

This is common and necessary for WebRTC SFUs, which perhaps is why Discord does it to support the least common denominator of their web browser based clients. Edit: Yep, I thought I remembered reading this. Their voice servers are WebRTC SFUs. So this is basically state-of-the-art when it comes to voice over WebRTC. End to end encryption in WebRTC is not possible if you are using a SFU. https://blog.discordapp.com/ho…

Why don't SFUs support end-to-end encryption? Is it just a missing feature in the WebRTC protocol or am I missing some fundamental reason?

Re: Let's Reverse Engineer Discord

#48

Post by blowski »

kevingadd wrote: post #45
orliesaurus wrote: post #3

The problem is... There still isn't a clear business model for discord, the advantages of having premium (nitro) are almost non-existing. That's not an excuse for privacy, I know... They tried to create a small competitor to Steam's game marketplace but it didn't work out. They're back to the drawing table. Honestly, that's actually really good for free users, like myself, because we can simply use discord's wide arr…

Pay-once-per-user has always seemed like a perfectly clear business model to me. Maybe not one that can properly fund the company, but a reasonable one. In comparison every Slack I use is filled with nag messages scolding us for not paying a per-user fee just to have casual chats about meeting up at local restaurants, as their business model is 'earn $200/mo for every person who uses our service because they have to…

The benefit of paid Slack is more for the company than the user, hence why the company pays for a workspace.

Re: Let's Reverse Engineer Discord

#49

Post by [deleted] »

ip26 wrote: post #16
znfi wrote: post #15

Earlier quoted context omitted.

I find this notion that you should be absolved of all responsibilities just because you give it away for free to be completely wrong. They should still be transparent about what they are doing. This notion also does not translate very well to things which are not related to IT. I use a very large number of things in my daily life which I am not paying for but I still expect them to work and be safe. Or would be it be…

If we're going to wander off into metaphor, this seems more analogous to a doorman refusing to allow you to bring your 800lb gorilla (sneakily dressed as your child) onto the elevator.

[deleted]

Re: Let's Reverse Engineer Discord

#50

Post by moooo99 »

throwaway8879 wrote: post #13
14 wrote: post #6

Earlier quoted context omitted.

But how can you remain super stoked by features of a service that may be decrypting your communication in real time? Does that sour the whole thing for you? If they can decrypt our communications I would think the 3 letter agencies would want to get access to it as well.

This is actually a good indicator for understanding the issue of privacy/surveillance. There are enough hackers and engineers who care little about being spied, despite understanding some of the inner workings of how the spying is done - as long as the benefits of a free service outweigh the slight privacy-violating annoyances. Now try to understand why the average person cares even less.

I don't think this is a reliable indicator. When you take a look at the target market of discord, it becomes pretty clear why no one really cares about the data being decrypted. The main audiences for discord are gamers and massive open communities. The first group is unlikely to discuss any sensitive topic via discord and it's not unlikely that a lot of discord users even stream their sessions publicly. The majority of conversations are likely to be game-related and not of private nature. For the huge open communities, encryption doesn't help to improve privacy when everyone can join anyways. If you want to grow a big and healthy community where everyone can join, the 3-letter agencies might as well join the voice channel rather than being the mitm.

I haven't met anyone who is using discord as an alternative for WhatsApp, Telegram, etc., from my experience, discord is mainly used for on-topic discussions rather than private communications.

And as other comments suggest, there are legitimate reasons why discord might want to decrypt the communications on their end. Plus, I have never seen any claims by discord to be p2p encrypted.

Post reply on HN