My username and favorite aliases were taken.
Discord allows anyone to share the same username. It appends a nearly invisible hash to disambiguate, and you can even change it.
Discord does usernames right.
Discord allows anyone to share the same username. It appends a nearly invisible hash to disambiguate, and you can even change it.
Discord does usernames right.
Seems like a pretty readily used vulnerability. I remember back in high school on AIM someone made a username very similar to mine and said some nasty things to a girl I was talking to - she told me to stop talking to her and I didn't figure out why until years later. I imagine the same exploit could be done more easily if you can use the same username and discord actively tries to hide the hash.
Maybe I'm just overly sensitive since impersonation has hurt me, though.
Many servers have different "roles" created, though often they're just nothing more than a title and a different color for your name when chatting on the server. If you don't have the default role on your server, then anybody would probably notice the fake person is a fake because they'd have the default role color.
Second, servers can require that your account have a verified phone number for you to join or chat on it, which raises the barrier a bit for creating fake accounts.
Finally, even if they join a mutual server and send you a private message, when you view the message, you won't see the private message history of the conversation with the real account, giving away that it's at the very least a new account.
Overall, it's harder to impersonate on Discord than it is on AIM, but still certainly not impossible.
In the AIM situation, users go in "knowing" that usernames are unique, so if you see a message from user abc123, you "know" it's that person. Which means user abcl23 ("el" instead of "one") can impersonate the real user.
In Discord situations, (1) the user is more likely to know that usernames can be reused, since they weren't required to make a unique one to start - so they can be more cautious of impersonation attempts, and more importantly (2) the Discord devs know names can be reused/abused, and can build better mitigations if they so choose to (like e.g. putting a disclaimer at the top of any message from a user you've never contacted before, etc.)
Furthermore, this is just the MXID, the Matrix ID. This is usually de-emphasized in the UI and only used to disambiguate and add users (as you say).
What is usually displayed to users are display names and these are allowed to have collisions, in which case they get disambiguated via MXIDs.
Other Discord features like servers aren’t there yet, but “usernames” doesn’t seem like a real deficiency.