3 ms·
A few seconds of research would have revealed that their API requires an authentication token[1] [1]https://discordapp.com/developers/docs/reference https://di
by kbhn 10y ago
A few seconds of research would have revealed that their API requires an authentication token[1]
[1]https://discordapp.com/developers/docs/reference https://discordapp.com/developers/docs/reference
- lightedman 10y agoA few seconds of pen-testing tells me their token revocation is pretty shoddy. I'm now spying on my fiance's Discord chat. Bravo to those that downvoted me without even bothering to use their brains (let alone test something.)
- Vishnevskiy 10y agoThe normal token system revokes on password change, if you want to revoke and have extra security we offer MFA login which has unique tokens per login. If security is of importance to you then use MFA.
- lightedman 10y agoWhy are you not revoking tokens after session end across the board? Token re-use is one of the faster-rising security breach factors now days.
- Sacho 10y agoYour first claim seems to be wrong - why wouldn't people downvote it?
- lightedman 10y agoAs one of the project coders notes - "The normal token system revokes on password change" Very bad security practice. Token revocation is hard, folks. If you aren't making that token expire every session then you're doing it wrong. In fact, this was even discussed here on HN 1600+ days ago - http://homakov.blogspot.com/2012/07/saferweb-most-common-oauth2.html http://homakov.blogspot.com/2012/07/saferweb-most-common-oau...
- lightedman 10y agoAnd a few extra additional seconds of research shows that they don't change the token unless you change your password, as opposed to having the token expire after every session. Very bad security practice.