Hacker News Reader

Comment by 2iP1zbR | Hacker News Reader

> Teamspeak, which has other problems

like server admins viewing the IP addresses of other users in the server, if that counts

The employees and their contractors and related at Discord corporate can see your IP address too and much more. Luckily it won't be Microsoft owning it as they could correlate against their software empire too.

But Discord does have significant profit motive to collect information about you. In fact, their entire proprietary protocol, client, and restriction of clients is based around ensuring this.

He wasn't talking about mass data collection used to sell advertising, he was talking about a the admin of a server with maybe a dozen users having access to his IP, which potentially could be used for DDOS or geolocation. The kind of 'data collection' which could have visible impacts upon his life.

Or someone with knowledge could port scan you and actually attack you to gain a foothold in your network.

Of course, but it seems fairly unlikely that the average gamer is running public-facing internet services.

There are some games that run peer to peer connections, and for those to work, they require inbound connections to work. As far as the security of the average game codebase is concerned, I'd say it's pretty terrible as nobody really audits these codebases for buffer overflows/RCEs.

Source Engine (CS:GO, Team Fortress 2, etc) has a bunch of RCE that were disclosed to Valve years ago and which they did nothing about, and which have been released to public at this point. Join a server and they can RCE on your machine. Another one can be triggered just from a Steam invite.

Too bad Valve makes money now and not games, they can't even get a fix out after it's been disclosed for years.

https://twitter.com/the_secret_club/status/13812019496479047...

https://twitter.com/the_secret_club/status/13809601207257333...

https://twitter.com/the_secret_club/status/13808687591292969...

Titanfall (the original) is another one (also Source Engine underneath but rewritten by Respawn/EA), a salty hacker who was mad he was getting rekt has been taking down the multiplayer service off and on for years now.

https://www.reddit.com/r/titanfall/comments/d10ori/tales_fro...

Last I heard he was starting to hit Titanfall 2 xbox servers too (since nothing has been done after years attacking the first one, why wouldn't he escalate it further?) and Respawn just don't care, they're done with it, they make piles of money from Apex now and don't care about supporting their older stuff.

https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-...

Given the clientele of this website, hoping a little name-and-shame might bring some attention to the issues...

As frustrating as it is, not a whole lot of people in the video game industry really care about that, and for those that do, they can't really do that much about it.

Once a game is sold, there's not much of an incentive to keep it alive other than making sure it's moderately playable so that they manage to sell expansion packs or downloadable content. A hypothetical "someone might overflow a buffer and run arbitrary code" bug is going to be pretty low on the list compared to "all the graphics are broken on the latest nvidia driver because our code base is held together by duct tape and wishful thinking."

Even for the developers that do care about writing decent code (and a lot of them do care about making great games), after 60 hours or more a week of fixing random bugs on Barbie's Plastic Adventures, Call of Battlefield, or Mobile Lootbox Idle Clicker, there's not that much motivation left at the end of the day to work on these kinds of issues.

It’s pretty frustrating with games like TF2 that still generate significant amounts of revenue but can’t even get major security problems patched let alone basic bugs fixed. And I’m not talking about selling new copies, I’m talking about hundreds of millions of dollars a year in lootbox revenue.

Games like DotA 2 that still get attention from Valve have all kinds of broken things. Bots were endemic in certain MMR brackets for a while (might still be, no idea), and they were pretty straightforward to detect. Multiple kinds of griefing were pretty much ignored, reporting players didn't do anything for a while, and so on.

Even Rockstar had the issue about load times for GTA online, which had they even bothered to look into it, would've netted them dozens of millions of dollars.

Until there's something absolutely catastrophic like a worm that spreads through a popular online game and formats hard drives/mines bitcoin/transfers all the hats to third parties, the industry will keep on doing the same thing as usual with no care. I wish it was different, but it's not, unfortunately. I definitely understand your frustration though.

with the amount of automated systems out there port-scanning IP ranges for vulnerabilities, being on discord with one (a vulnerability), even if discord exposed IPs, is not much more dangerous than just sitting around twiddling your thumbs waiting for a bot to hit your IP.

The risk of personal identification due to IP I can buy into; the risk that your already public IP may be exposed to a do-bad-criminal who wants to exploit you via Discord.. feels no more dangerous than having a vulnerable computer connected, anyway.

Don't underestimate the skill and ingenuity of pissed off 15 year olds.

With near unlimited time on their hands, and an information rich internet, they can find how to start pentesting.

Blind devotion to a cause and a flexible mind can overcome many problems.

Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon.

Discord also refuses to delete any data you give them. Deleting a Discord account sets a lockout flag, changes the nickname to "Deleted User" and resets the avatar to default. That's it. They don't even bother setting the user ID on your messages to something common, to a bot (and anyone who turns on developer mode) all your messages still contain your Discord ID.

I also learned from personal experience that they ignore any requests for deleting data coming in via GDPR. These people need to get slapped in a lawsuit.

> Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon.

This is the first time I hear of this, can you please link a source?

The Discord subreddit has a few threads about this, but it has always been an open secret back when the Discord Developers guild still existed. I'm pretty sure it got axed because some staff members got too memey about abusing their database access.

So Discord has the same issue should be Discord had the same issue - I also can't find any mention of such abuse of power. The only thing is supposedly this Trust & Safety employee that revoked the vanity url /furry to give it to another server[0], and T&S needs full database access like that for obvious reasons (even if this employee did abuse it).

0: https://discord.news/trust-and-scam/

That's one incident. I'm talking about a pattern of behavior where staff members act unprofessionally. That includes telling your users "I can just change your ID lol" even if they don't end up doing it.

Discord didn't fire the person who was joking about database edits the most (or anyone to my knowledge). All they did was close the outlet for staff to show their badge off and brag about it. That doesn't fix anything, my assumption is that this is still going in.

> I'm talking about a pattern of behavior where staff members act unprofessionally.

Could you please provide some sources? As the other poster noted this is the first time we hear of this. Would be keen on knowing more

As long as you provide yours about Teamspeak servers.

I dont believe I spoke about nor said anything about Teamspeak. What are you referring to?

However, individually deleting messages using their API does delete them from their servers[0].

[0]: https://blog.discord.com/how-discord-stores-billions-of-mess...

It does, but that is not always an option. What if you shared personal information on a server you no longer have access to? Your only option is to wait a week for your data export and then wait another 2-3 weeks for a support ticket to get to the stage of threatening Discord into actually removing individual messages. What if you're being stalked? What if you said something incridebly dumb on a server you assumed was limited to very specific people? A month to removal is untenable. Discord needs searchable dashboard that allows one-click removal.

Discord considers all servers public, not because they actually are (many are for friend groups or even classes etc.), but because that'd mean your consent for keeping any message you send is in question whenever someone is invited to a guild you were not expecting there. Their argument against removal is always "following public conversations is in the public interest". Any European court would tell them to fuck off if someone finally sued them over ignoring GDPR requests, because in the end most Discord servers (absolute numbers, not by volume) can not be considered public.

Not only that, Discord communities are all invite-only, even the discoverable ones are technically invite-only (discoverability process of Discord requires a permanent invite).

I tried the data export, but did not get any of my messages from the guilds I am no more a member of.

> Discord needs searchable dashboard that allows one-click removal.

The thing is there is no user→message mappings stored in their database. The data structures are designed for message→user traversal. Nothing like Facebook's user activity log.

at least on large servers, the search indexes are reasonably up to date and include user IDs.

(on small servers they're unfortunately on-demand, but you could still store a set of all guilds a user ever joined and build an overview)

And I am saying that there are human people working at companies too. The only difference is that if they cause you indirect harm their legal liability is abstracted enough you can't do anything.

They're not talking about Discord and their employees having your IP, they're talking about teamspeak server admins being able to see it and using it for nefarious means. On Discord, just because someone joins a server you created doesn't mean you get their IP. With teamspeak being decentralized, your IP is sent to admins which are much closer and interested in the same topics you are, so if you make them mad, they have the ability to retaliate by performing a DDOS or geolocating you to expose your location. With Discord, there's trust that Discord isn't going to suddenly make your IP address public for some reason - even if you make an employee mad, them accessing your IP just to leak it would be jeopardizing their cushy VC-backed job all just to 'expose' someone on the internet.

this is true, but also goes for every internet-connected service that i choose to use, as far as my IP address goes

i've been invited to random, huge discord servers to play just one game, and after the games over i usually leave the server unless i know everybody. i never have to worry about the server admin or one of his buddies deciding they didn't like me for whatever reason and DDOSing the shit out of me for weeks, forcing me to change my IP address because i didn't use a VPN.

that's just personal; it could even turn a profit if a professional gamer joined a server, several users recorded the IP address, bet against them in an upcoming game, then DDOS'd the shit out of them.

The game server admin also sees your IP address though? So unless you are only hanging out on discord and not actually playing you are still exposing your IP address.

Also only the voice server admin sees the IP address and not every user on the server, so your scheme wouldn't really work either.

yes, i should have said "the voice server admin records the IP address" instead

i think game servers are a different subject, and they have their own buffet of problems

If you're in a situation where you do not feel safe by the administration team of a server, you probably shouldn't stick around. While I do understand the concern about something like this, if the admin team are people you know and trust, this data is not going to be used against you.

Trust is always important for these things, regardless of the platform. Discord didn't even have my email address for the four first four years I used it

I'm running my teamspeak instance within an LXC container on my physical host. So the only IP I do see is good old home (127.0.0.1). But admins better not use the IP-ban feature in this setup ...

I never understood what was wring people seeing my personal, private IP address... I can call my ISP and get a new one in seconds, or turn my router off for 5 minutes to get a new one.

When you're playing games, it can mean that people can DDOS you, or otherwise just like, send bad stuff your way.

Both of the solutions you have still disrupt the game, even if they do temporarily solve the issue.

If the people you're playing with DDOS you, you need to find new people to play with.

Sure, but that doesn't help you in the midst of it.

It's also like, sort of kind of not how social games work in many cases. In order to make friends in the first place, you gotta get out there.

Do you want to be friends with people in a community where having the admin look up your IP and ddos you is acceptable???

Imagine I want to go out tonight. None of my friends do. So I go to a new place and start talking to people at the bar. One of them stabs me.

No, I do not want to be friends with those people. But I don’t know that yet, because we have not met. The only way to meet them is to... meet them.

The consequences of being ddosed are not exactly the same as the consequences of being stabbed. I think you'll survive this terrible, unlikely ordeal.

Games with matchmaking will permanently ban your account if you leave games too often. It's a risk: "CS:GO - Competitive Cooldowns and Bans - Steam Support" https://support.steampowered.com/kb_article.php?ref=1203-WJC...

How many competitive games are you playing where the enemy team is an admin on your teamspeak server and feels it is appropriate to ddos you?

All sorts of things can leak your IP. Source engine is one, Teamspeak is another.

Not sure how using discord really solves the evil admin scenario though? Since the game server admin will still be able to see your IP Address.

I really have a hard time imagining a scenario where I can trust the game server admin, but not the admin hosting my voice server. Especially if it's some team-based game.

I am not saying Discord solves this problem, I am just saying it’s a real problem.

Also, not every game that uses Discord has the “server admin” model. Most of the games I play do not. Still use Discord though.

I can call your ISP and get your subscriber information (unless you're behind CGNAT).

Here's a convenient, albeit somewhat outdated pastebin explaining how https://pastebin.com/ViWmrsDJ

Not really sure they allowed to send you _any_ of that information in Denmark/EU.

Well, that is obvious and not changeable.

Like anyone together in a discord voice chat, since it is p2p webrtc, right?

It is not P2P. The place where they most clearly state that as far as I can find is actually the documentation for their game SDK[1], but you can check that this is the case with netstat. In general it’s hard to get good voice or video chat with P2P connections because of the low upload of most residential internet connections, so few serious chat apps do it.

[1]: https://discord.com/developers/docs/game-sdk/networking

There's also this: https://blog.discord.com/how-discord-handles-two-and-half-mi...

Reply on news.ycombinator.com