_wkvo

3 ms·

1.
Discord won't fix the invisibility bypass CVE, so I made a PoC(greasyfork.org)
9 points by _wkvo 8mo ago|2 comments
2.
Invisible modes on Steam and Discord are useless
2 points by _wkvo 8mo ago|0 comments
3.
by _wkvo 8mo ago
Usually discord ignores all issues related to invisibility leaks but responds very fast to other types of issues which is why i decided not to wait for weeks for a fix, instead publish it and watch it get fixed.
4.
Discord Invisible Mode Is UI Illusion(cve.org)
5 points by _wkvo 8mo ago|3 comments
5.
by _wkvo 8mo ago
https://xmrcat.org/discord-invisibility-bypass seems like steam is not alone :D
6.
Discord WebSocket leaks 'Invisible' users by explicitly sending 'offline' status(xmrcat.org)
4 points by _wkvo 8mo ago|0 comments
7.
by _wkvo 8mo ago
here you go https://i.ibb.co/39GRMySs/png.png
8.
by _wkvo 8mo ago
Incorrect. "Invisible" is a privacy control, not just a UI filter. While the official client freezes the text, the backend still broadcasts live last_logon and last_logoff Unix timestamps in the ClientPersonaState packet. This lea
9.
by _wkvo 8mo ago
In this context, 'Logoff' triggers whenever the socket disconnects. So every time you shut down your PC or put it to sleep, that timestamp is updated and broadcast, even if you never explicitly clicked 'Sign Out'.
10.
by _wkvo 8mo ago
Exactly. The 'Offline' feature exists specifically to set that boundary, and the backend completely ignores it.
11.
by _wkvo 8mo ago
Privacy shouldn't require leaving your PC running 24/7.
12.
by _wkvo 8mo ago
True, but a tracking pixel is an active attack that leaves a visible trail. This leak is passive surveillance; I can silently graph the sleep cycles of 200 friends without ever interacting with them. Trust shouldn't imply consent for i
13.
Steam "Offline" status leaks exact login timestamps (Valve: Won't Fix)(xmrcat.org)
79 points by _wkvo 8mo ago|96 comments