7 ms·

Is anyone else pretty bothered that popular services like Discord can and do read all of your 'private' messages in plaintext, and when/if they are bought out,

by ve55 7y ago

Is anyone else pretty bothered that popular services like Discord can and do read all of your 'private' messages in plaintext, and when/if they are bought out, all of your chat and usage history will be sold to an unknown third party along with the company? I wish at some point we'd see mainstream messengers that put actual effort into respecting the user, along with their autonomy and privacy. It'd be amazing if we could actually directly (from a technical perspective) message other people, without needing central servers between us.

techslave 7y ago
iMessage isn’t mainstream enough for you?
- jfkebwjsbx 7y ago
  iMessage is not really used outside US.
- drewbug 7y ago
  isn't it closed-source and centralized?
  - chc 7y ago
    I think that was responding to the call for "mainstream messengers that put actual effort into respecting the user, along with their autonomy and privacy." iMessage is closed-source and centralized, but from what I know of it, it does seem fair to say it doesn't violate people's autonomy or privacy in a significant way.
throwaway5752 7y ago
I am concerned the Discord might not be financially viable or unable to scale to what we need during this unprecedented crisis.
kgraves 7y ago
WhatsApp? Name one messenger that is not closed source and the masses use.
- drewbug 7y ago
  Email
  - kgraves 7y ago
    I agree that the masses use this, but I'm not sure that you can compare email to WhatsApp, maybe a fair comparison would be _instant_ messengers. Also open source?, I doubt it.
    - contravariant 7y ago
      The protocol is open, even if the most commonly used implementations may not be. As for secure, well that's a whole other matter.
    - gsich 7y ago
      Mails are usually instant. Yes, open source.
  - UncleMeat 7y ago
    Terrible ergonomics. The probability that somebody replies with a quote of the entire unencrypted thread when attempting to use PGP approaches 1 for long email chains. Encrypted email also leaks not just metadata but data since you can't encrypt subject headers.
    - Multicomp 7y ago
      Delta.Chat fixes this
- doorbellguy 7y ago
  Signal?[1] 1: https://en.wikipedia.org/wiki/Signal_%28software%29 https://en.wikipedia.org/wiki/Signal_%28software%29
anchpop 7y ago
> It'd be amazing if we could actually directly (from a technical perspective) message other people, without needing central servers between us. There is no reason this should not be possible, I'm hoping that tools like Dat or IPFS will enable stuff like this to be better than the alternatives
api 7y ago
That's SaaS.
rwallace 7y ago
I agree, it's not the most user-friendly of business models. Do you know how to make a more user-friendly business model profitable enough to appeal to investors? This is not a rhetorical question. If I knew a way to make a more user-friendly service profitable enough to have a reasonable shot of gigadollar return on investment (which is what it takes to be interesting to venture capitalists), I might very well go ahead and put together a YC application, but right now, I don't know a way to do that. Do you?
- kgraves 7y ago
  I would prefer not having to use VC money to fund such an endeavour. This model needs to stop, maybe a change to a bootstrapped model + pay to use is the way to go.
  - rwallace 7y ago
    Okay. I personally do not have the financial reserves to bootstrap something like this, though if someone else does, I by all means wish them luck.
dmos62 7y ago
> It'd be amazing if we could actually directly (from a technical perspective) message other people, without needing central servers between us. Me too. The keywords you might be looking for are encryption and traffic analysis counter-measures. In my eyes it's largely a political problem.
- denkmoon 7y ago
  Why a political problem? What I see is that in general people don't care enough. It's not that they don't care about privacy, they just don't care enough to change platform over it.
  - dmos62 7y ago
    In my view, people caring is part of politics. The word politics, as I use it, is acquisition, organization and exertion of power. That's directly connected to what peoples' perceptions and incentives are.
jkilpatr 7y ago
The interesting problem with decentralized messaging is not technical but with spam, moderation,and user acquisition
ubercow13 7y ago
Yep, and of course it's all linked to your real life identity because they basically require a phone number to use their service. This was true too of, say, WhatsApp before it enabled encryption, but with Discord it's even more insidious because most users think they are using an online pseudonym to communicate, unconnected to their real identity.
- Krasnol 7y ago
  > because they basically require a phone number to use their service. I have two accounts, none needed my phone number. Just e-mail. Is this new?
  - catalogia 7y ago
    From what I've gathered there is some sort of reputation system in place, such that most users creating accounts from reputable residential ISP IP addresses aren't asked for a phone number, but those creating accounts from Tor/VPNs/datacenters/etc often are. Either way, you're effectively de-anonymized.
    - ubercow13 7y ago
      Yes, but I am guessing also if your IP has been used for other accounts and certainly if you use multiple residential accounts from different places (I had my account disabled while travelling). It's pretty sensitive.
sneak 7y ago
https://ricochet.im/ https://ricochet.im/
- gsich 7y ago
  no audio like in Discord.
sneak 7y ago
Not only that: if you send links to people in DM, their surveillance ability gives them a shoot-first-ask-questions-later option to counteract spam (or any false positives they mistakenly deem spam). They suspended my account for linking three people I know personally to my own website. In DM. Not twenty, not some spam site, not strangers. They nuked my whole account with no recourse. The ToS, of course, says you can't sue them, either in a class action or outside of one. Their ToS also bans political cartoons that "mock" anyone, again, even in DMs. It's not possible to use Discord without agreeing to these terms.
- seoulsubway 7y ago
  I don't see how anyone could find issue with that rule against political cartoons mocking people. If you don't respect someone, that doesn't give you the right to mock them. Take for instance Singapore, Singapore does not allow mocking or political cartoons of their public officials. Not only does this maintain a civil air around politics, it stops it degrading into a mainstream popularity contest. With the side effect that Singapore politicians are actually able to be seen as a respected figure.
- meowface 7y ago
  Wait wait wait, what? You got banned for sharing a link in DMs? Are you certain none of the people you DM'd it to reported it? And it wasn't something blatantly malicious like a malware EXE? If so, that would be a massive story that would get thousand of upvotes in the subreddit very quickly. That makes me think there might be something more to this.
  - sneak 7y ago
    This was the link: https://sneak.berlin/20200220/discord-is-not-an-acceptable-choice-for-free-software-projects/ https://sneak.berlin/20200220/discord-is-not-an-acceptable-c... My account was less than a day old, and both the initial registration, as well as the connection at the time of suspension were via Tor, which may account for the fact that it was incorrectly identified as spam. Censorship is censorship, though; connecting via a privacy network should not suddenly mean you can't link your friends to your own website without getting summarily deleted. It's not really a massive story; people simply don't give a shit that Discord is a surveillance/censorship platform. I think amongst younger people there is a general sense of "they can read all of it on every platform, who cares anymore" fatalism, and anyone who refuses to participate on that basis or complains about it is seen as an inconvenient whiner who should just click AGREE on the ToS without reading it like everyone else did, and leak their physical location/residential address to Discord via their home IP or phone number, like everyone else did. Unfortunately, I (and others like me) do not have that luxury. For physical safety reasons, if I cannot participate without leaking my location, I cannot participate at all.
hi5eyes 7y ago
tru but at least if you search discord delete on github the top result is a pretty thorough script that nukes ur history
chapium 7y ago
Not bothered at all, I never had any reason to believe it was a private system.
gsich 7y ago
And audio.
meowface 7y ago
>It'd be amazing if we could actually directly (from a technical perspective) message other people, without needing central servers between us. How could you do this while also preserving network privacy between users? One of the big selling points of Discord is users can't see each other's IP addresses when they message or call each other. I believe you would need at least a simple relay in the middle to prevent that. Or layer it on some Tor-like anonymizing network, but I think that wouldn't be practical for this use case (especially video calls). This is especially important for not just the typical privacy reasons: Discord is marketed heavily towards gamers, and some gaming communities are filled with script kiddies who rent "booter" (DDoS-for-hire) services to knock opponents online, to torment them and/or to gain an upper hand in games where disconnection means automatic forfeiture. This was one reason a lot of people switched from Skype to Discord, because Skype had many ways of seeing other users' IP addresses.

by ve55 7y ago

techslave 7y ago

iMessage isn’t mainstream enough for you?

jfkebwjsbx 7y ago
iMessage is not really used outside US.
drewbug 7y ago
isn't it closed-source and centralized?
- chc 7y ago
  I think that was responding to the call for "mainstream messengers that put actual effort into respecting the user, along with their autonomy and privacy." iMessage is closed-source and centralized, but from what I know of it, it does seem fair to say it doesn't violate people's autonomy or privacy in a significant way.

throwaway5752 7y ago

I am concerned the Discord might not be financially viable or unable to scale to what we need during this unprecedented crisis.

kgraves 7y ago

WhatsApp? Name one messenger that is not closed source and the masses use.

drewbug 7y ago
Email
- kgraves 7y ago
  I agree that the masses use this, but I'm not sure that you can compare email to WhatsApp, maybe a fair comparison would be _instant_ messengers. Also open source?, I doubt it.
  - contravariant 7y ago
    The protocol is open, even if the most commonly used implementations may not be. As for secure, well that's a whole other matter.
  - gsich 7y ago
    Mails are usually instant. Yes, open source.
- UncleMeat 7y ago
  Terrible ergonomics. The probability that somebody replies with a quote of the entire unencrypted thread when attempting to use PGP approaches 1 for long email chains. Encrypted email also leaks not just metadata but data since you can't encrypt subject headers.
  - Multicomp 7y ago
    Delta.Chat fixes this
doorbellguy 7y ago
Signal?[1] 1: https://en.wikipedia.org/wiki/Signal_%28software%29 https://en.wikipedia.org/wiki/Signal_%28software%29

anchpop 7y ago

> It'd be amazing if we could actually directly (from a technical perspective) message other people, without needing central servers between us. There is no reason this should not be possible, I'm hoping that tools like Dat or IPFS will enable stuff like this to be better than the alternatives

api 7y ago

That's SaaS.

rwallace 7y ago

I agree, it's not the most user-friendly of business models. Do you know how to make a more user-friendly business model profitable enough to appeal to investors? This is not a rhetorical question. If I knew a way to make a more user-friendly service profitable enough to have a reasonable shot of gigadollar return on investment (which is what it takes to be interesting to venture capitalists), I might very well go ahead and put together a YC application, but right now, I don't know a way to do that. Do you?

kgraves 7y ago
I would prefer not having to use VC money to fund such an endeavour. This model needs to stop, maybe a change to a bootstrapped model + pay to use is the way to go.
- rwallace 7y ago
  Okay. I personally do not have the financial reserves to bootstrap something like this, though if someone else does, I by all means wish them luck.

dmos62 7y ago

> It'd be amazing if we could actually directly (from a technical perspective) message other people, without needing central servers between us. Me too. The keywords you might be looking for are encryption and traffic analysis counter-measures. In my eyes it's largely a political problem.

denkmoon 7y ago
Why a political problem? What I see is that in general people don't care enough. It's not that they don't care about privacy, they just don't care enough to change platform over it.
- dmos62 7y ago
  In my view, people caring is part of politics. The word politics, as I use it, is acquisition, organization and exertion of power. That's directly connected to what peoples' perceptions and incentives are.

jkilpatr 7y ago

The interesting problem with decentralized messaging is not technical but with spam, moderation,and user acquisition

ubercow13 7y ago

Yep, and of course it's all linked to your real life identity because they basically require a phone number to use their service. This was true too of, say, WhatsApp before it enabled encryption, but with Discord it's even more insidious because most users think they are using an online pseudonym to communicate, unconnected to their real identity.

Krasnol 7y ago
> because they basically require a phone number to use their service. I have two accounts, none needed my phone number. Just e-mail. Is this new?
- catalogia 7y ago
  From what I've gathered there is some sort of reputation system in place, such that most users creating accounts from reputable residential ISP IP addresses aren't asked for a phone number, but those creating accounts from Tor/VPNs/datacenters/etc often are. Either way, you're effectively de-anonymized.
  - ubercow13 7y ago
    Yes, but I am guessing also if your IP has been used for other accounts and certainly if you use multiple residential accounts from different places (I had my account disabled while travelling). It's pretty sensitive.

sneak 7y ago

https://ricochet.im/ https://ricochet.im/

gsich 7y ago
no audio like in Discord.

sneak 7y ago

Not only that: if you send links to people in DM, their surveillance ability gives them a shoot-first-ask-questions-later option to counteract spam (or any false positives they mistakenly deem spam). They suspended my account for linking three people I know personally to my own website. In DM. Not twenty, not some spam site, not strangers. They nuked my whole account with no recourse. The ToS, of course, says you can't sue them, either in a class action or outside of one. Their ToS also bans political cartoons that "mock" anyone, again, even in DMs. It's not possible to use Discord without agreeing to these terms.

seoulsubway 7y ago
I don't see how anyone could find issue with that rule against political cartoons mocking people. If you don't respect someone, that doesn't give you the right to mock them. Take for instance Singapore, Singapore does not allow mocking or political cartoons of their public officials. Not only does this maintain a civil air around politics, it stops it degrading into a mainstream popularity contest. With the side effect that Singapore politicians are actually able to be seen as a respected figure.
meowface 7y ago
Wait wait wait, what? You got banned for sharing a link in DMs? Are you certain none of the people you DM'd it to reported it? And it wasn't something blatantly malicious like a malware EXE? If so, that would be a massive story that would get thousand of upvotes in the subreddit very quickly. That makes me think there might be something more to this.
- sneak 7y ago
  This was the link: https://sneak.berlin/20200220/discord-is-not-an-acceptable-choice-for-free-software-projects/ https://sneak.berlin/20200220/discord-is-not-an-acceptable-c... My account was less than a day old, and both the initial registration, as well as the connection at the time of suspension were via Tor, which may account for the fact that it was incorrectly identified as spam. Censorship is censorship, though; connecting via a privacy network should not suddenly mean you can't link your friends to your own website without getting summarily deleted. It's not really a massive story; people simply don't give a shit that Discord is a surveillance/censorship platform. I think amongst younger people there is a general sense of "they can read all of it on every platform, who cares anymore" fatalism, and anyone who refuses to participate on that basis or complains about it is seen as an inconvenient whiner who should just click AGREE on the ToS without reading it like everyone else did, and leak their physical location/residential address to Discord via their home IP or phone number, like everyone else did. Unfortunately, I (and others like me) do not have that luxury. For physical safety reasons, if I cannot participate without leaking my location, I cannot participate at all.

hi5eyes 7y ago

tru but at least if you search discord delete on github the top result is a pretty thorough script that nukes ur history

chapium 7y ago

Not bothered at all, I never had any reason to believe it was a private system.

gsich 7y ago

And audio.

meowface 7y ago

>It'd be amazing if we could actually directly (from a technical perspective) message other people, without needing central servers between us. How could you do this while also preserving network privacy between users? One of the big selling points of Discord is users can't see each other's IP addresses when they message or call each other. I believe you would need at least a simple relay in the middle to prevent that. Or layer it on some Tor-like anonymizing network, but I think that wouldn't be practical for this use case (especially video calls). This is especially important for not just the typical privacy reasons: Discord is marketed heavily towards gamers, and some gaming communities are filled with script kiddies who rent "booter" (DDoS-for-hire) services to knock opponents online, to torment them and/or to gain an upper hand in games where disconnection means automatic forfeiture. This was one reason a lot of people switched from Skype to Discord, because Skype had many ways of seeing other users' IP addresses.