[HN Gopher] Discord.io breached, 760k user accounts for sale on ...
___________________________________________________________________
Discord.io breached, 760k user accounts for sale on darknet
Author : skilled
Score : 307 points
Date : 2023-08-14 17:52 UTC (5 hours ago)
(HTM) web link (stackdiary.com)
(TXT) w3m dump (stackdiary.com)
| paulpauper wrote:
| as long as there is data, there will be data breaches
| Waterluvian wrote:
| This is why I store all my sensitive data on the cozy side of
| an event horizon.
| tmpz22 wrote:
| I have a vault set to open when GRRMs _Winds of Winter_ comes
| out. I feel pretty good about it.
| politelemon wrote:
| To those who used discord.io, what was the appeal of it over
| discord.gg? Unfortunately their site is down so I can't even see
| what its own marketing said.
| bavarianbob wrote:
| I believe discord.io is (was?) a discovery platform. You can
| view an archive of the site here:
| https://web.archive.org/web/20220329132537/https://discord.i...
| PUSH_AX wrote:
| Just FYI, discord.io !== discord.com the chat app, it's a related
| but separate service.
| hbn wrote:
| Normally I think it's lame when a product-for-a-product
| (there's probably a better term) has to abide by stringent
| branding guidelines to not look official. e.g. when third-party
| reddit clients (RIP) had to change from e.g. "Reddit Sync" to
| "Sync for Reddit" and they weren't allowed to use the Snoo
| character in their branding.
|
| But in this case... why was Discord fine with this branding? It
| looks unabashedly like an alternate official domain for their
| own service. Googling "what is discord.io" leads to a good
| handful of confused redditors asking if it's legit/safe.
| jumpCastle wrote:
| I still use infinity for reddit though.
| WheatMillington wrote:
| And discord.com !== discordapp.com or discord.gg.
| Technetium wrote:
| "As of May 4th, 2020, we have moved our domain from
| discordapp.com to discord.com!"
|
| https://support.discord.com/hc/en-
| us/articles/360042987951-D...
| jowea wrote:
| They all redirect to discord.com now.
| gautamsomani wrote:
| Noob question - What websites are these where such data is
| published? I never came across any?
| tamimio wrote:
| I have a directory of most of them, I would not post it under
| my real identity obviously, but if you happen to be into the
| cybersec space, definitely you came across some of these sites,
| there are even sites with latest APT discovered up to this
| month too.
| chefandy wrote:
| Various darknet fora. Certainly nowhere on clearnet. There are
| search engines that deal with such things though I'll bet
| there's a 99:1 ratio of scam to legit. I have no idea how
| someone world go about validating what they saw.
| technion wrote:
| Until recently, every time a story was run about a leak being
| "for sale on the dark web", you could visit raid forums or
| breach forums, both clearnet sites, and note that's where
| it's for sale.
| cowsup wrote:
| In this case, they validated it by:
|
| 1. confirming the emails were not already listed in other
| databases / leaks;
|
| 2. going to the actual Discord platform and performing a
| "Forgot Password" request, entering a stolen email, and
| seeing if it goes through or not, as Discord confirms if an
| email exists or not during this flow;
|
| 3. contacting Discord.io directly, who confirmed & put out a
| statement.
|
| Other data breaches are harder to verify. Troy Hunt (owner of
| haveibeenpwned.com) described this in far more interesting
| ways than I ever could[0], but for each breach, it varies.
|
| [0]: https://www.troyhunt.com/heres-how-i-verify-data-
| breaches/
| judge2020 wrote:
| Validation is likely tied to reputation - such as by showing
| a sample to an established moderator / community member and
| them vouching that the data seems real.
| lakomen wrote:
| Ok so when I've never used a 3rd party discord service I'm safe.
| I got scared there for a moment, but then I thought what would I
| lose? Nothing at all. Nothing that can't be replaced. No contacts
| worth keeping.
| poglet wrote:
| If someone has access to your account I assume they can read
| all your messages and possibly impersonate you.
| superkuh wrote:
| > third-party interface tailored for the widely-used Discord
| messenger.
|
| Isn't this explicitly against the Discord TOS? I'm surprised it
| wasn't shut down by Discord itself.
| judge2020 wrote:
| It was primarily a way for non-partner servers to have
| permanent, readable invite links before these became available
| officially (by paying users boosting a server). It wasn't
| actually a third party interface that recreated the discord
| client or anything (unless that's a recent development).
| [deleted]
| nijave wrote:
| I'm surprised using the domain `discord.io` alone wasn't enough
| to get them shut down.
| jrockway wrote:
| I'm guessing the British Indian Ocean Territory doesn't have
| a lot of administrators to handle trademark claims. According
| to Wikipedia, "the only inhabitants are British and United
| States military personnel, and associated contractors, who
| collectively number around 3,000 (2018 figures)."
|
| Darn that global Internet, allowing people to use
| unauthorized chat clients with impunity!
| bragr wrote:
| .io domain is officially administrated out of the UK and is
| own by Ethos Capital, a private equity firm out of the US.
| Surely both the American and/or UK courts would be valid
| avenues for enforcement.
| teddyh wrote:
| > _Darn that global Internet, allowing people to use
| unauthorized chat clients with impunity!_
|
| The use was not the problem; the _name_ was the problem.
| jrockway wrote:
| A sense of discord washes over me as I eat an apple in
| front of a computer running XWindows. A lesson about
| using a common English words as a trademark becomes
| apparent in my mind.
| superkuh wrote:
| >Darn that global Internet, allowing people to use
| unauthorized chat clients with impunity!
|
| The problem here is that people are chosing to use Disord
| despite the fact that it is so stupidly proprietary. If
| Discord actually enforced it's rules all the time there'd
| have been far fewer teamspeak/irc/mumble/etc people lured
| into it's walled garden. It is a literal bait and switch.
|
| So it's important to point out a large fraction of the ways
| people do use Discord are actually very much against the
| TOS and could be prosecuted under the CFAA as felonies if
| Discord corporate thought they were rocking the boat and
| decided to buy a district attorney. It's the worst of both
| worlds.
| NavinF wrote:
| > people are chosing to use Disord despite the fact that
| it is so stupidly proprietary
|
| This has zero relevance to normal users. Does
| teamspeak/irc/mumble/etc even support live streaming with
| screen+audio capture to a group chat? That's a pretty
| basic feature in 2023. I'm not aware of any serious open
| source competitors in this space
| zoky wrote:
| There are other ways to shut down a third-party service,
| from sending a cease and desist letter for trademark
| infringement to server-side blocking of access to their
| API.
| [deleted]
| scudsworth wrote:
| what was the actual killer app here
| boneitis wrote:
| [e: i apparently mistook discordio for a couple of the other
| discovery platforms we utilized, but it seems to be the same
| concept as the others, looking at the web archives]
|
| discordapp back then was really just a collection of servers
| pretty siloed/insulated from each other, with barebones voice
| and text chat functionality.
|
| discordio offered some basic form of discovery and cross-server
| exploration/networking when it was effectively nonexistent back
| then. it, along with other outreach efforts on our part,
| certainly helped boost our community size and amusingly also
| attracted a lot of teens approaching us to ask if we wanted to
| "partner up" with their server (i help administer a studygroup
| server on discord).
|
| my 2c, as a fairly active user since '16.
| ehsankia wrote:
| I assume being able to get a custom link is also nice, I
| believe discord only allows that for partnered servers?
| noxvilleza wrote:
| I run a Discord server which wasn't partnered, is quite
| small, and somehow had a custom link (we also certainly
| weren't boosted).
| boneitis wrote:
| ah, forgot about the free custom links.
|
| anyway, 'partnered', to my recollection, means a formal
| arrangement with discord where the particular server
| community is directly promoted by discord on front pages
| and such, in exchange for meeting a higher bar of conduct
| that represents a model community (SFW, PC, etc.).
|
| one of the perks that comes with this is being granted
| "Level 3" boost status, free of charge (normally costing
| anywhere from $49-70/mo, depending on circumstances), which
| is what directly grants the custom link feature.
| soloninja wrote:
| Happens way to often now with wall garden services
| thebigman433 wrote:
| How does the concept of a walled garden have anything to do
| with this?
| Exuma wrote:
| Discord.io is not the same thing as discord.com
| gochi wrote:
| Wonder how many people are going to think discord.io is
| officially related to discordapp.com/discord.com.
| kalev wrote:
| That should be clarified in the HN title, imo
| [deleted]
| axus wrote:
| It sounds more official than discord.gg
| mattl wrote:
| It shouldn't really.
|
| .gg and .io are being used for novelty value.
| bee_rider wrote:
| .io has been used as a sort of general-purpose tld to
| signal sort of... I dunno, hip, dev-focused sites, right?
| It is at least slightly less novel than gg.
| codetrotter wrote:
| Agree, but it's important to point out that .gg grew
| popular in the gaming crowd because "gg" in gaming means
| "good game". It's used in-game in the chat by many
| players of online multiplayer games as a way of thanking
| each other after a match. It can be used sincerely or it
| can also be used sarcastically but in the latter case
| you'd typically say "ggez" as a taunt implying that the
| win was easy ("ez") because you are more skilled than
| your opposing team.
|
| And for .io of course that one is/was popular among tech
| companies because it looks similar to "I/O"
| (input/output).
| mattl wrote:
| .gg means "good game" so I can see why Discord would use
| it.
| bee_rider wrote:
| Definitely, it is a sort of quirky and fun use of .gg.
|
| It is a little surprising given their field that they
| didn't also grab the .io.
| deprecative wrote:
| It's definitely not just me but I only have a data point of
| one to use: Anytime I see something that isn't .com, .org,
| or .gov I immediately assume it's less than reputable at
| best and actively trying to scam/phish me at worst.
| mattl wrote:
| Yeah, there's a difference between .com .net .org .gov
| and many of the country code TLDs when you're looking for
| non-local content.
| Symbiote wrote:
| With the obvious exception of sites correctly associated
| to the country of their domain.
|
| A tourist attraction in Guernsey can very reasonably use
| .gg and maintain full credibility.
| thih9 wrote:
| I got curious and decided to check which popular websites
| that I use are not on a .com / .org domain.
|
| I found: kubernetes.io , sentry.io , codepen.io , itch.io
| , not to mention lever.co , elastic.co and last but not
| the least, notion.so .
| bee_rider wrote:
| The .so TLD, very dynamic.
| bredren wrote:
| It had been that companies that "made" it would
| eventually pick up the .com. But it seems like it is more
| common to stick with whatever TLD they had before.
| onehair wrote:
| Me, I've changed my password, until I read the title again and
| then this comment xD
| tcgv wrote:
| Better safe than sorry ;)
| quickthrower2 wrote:
| Rotations don't hurt
| mkagenius wrote:
| But he forgot the new one
| quickthrower2 wrote:
| Best kind of security
| rpastuszak wrote:
| Thanks for pointing that out. I genuinely thought that was the
| case!
|
| (My dog uses the native Discord client because he's too cheap
| to pay for a baby cam.)
| solardev wrote:
| Your dog has more financial acumen than some humans...
| k8sToGo wrote:
| Have you tried to increase the allowance for your dog?
| rpastuszak wrote:
| Sort of. He just had a bath and my partner fed him. But we
| had to bribe him with a grissini to get into the tub.
|
| Can you pay for Discord in grissinis?
| bonestamp2 wrote:
| Hold on, I'm making a deck right now to get funding for
| such a marketplace.
| [deleted]
| ajmurmann wrote:
| Maybe the lazy dog should get a part-time job like rescuing
| people in the Alps while carrying a little barrel of liquor
| or barking at people with drugs, money or fruit at the
| airport.
| hluska wrote:
| Come on, your dog has a ruff life...:)
|
| Serious question though, do you use it as a dog monitor?
| That's a good idea.
| vram22 wrote:
| That's a tall tail now
| paxys wrote:
| And this is exactly why companies protect their trademarks. A
| site called discord.io which offered services on top of Discord
| but wasn't affiliated with it in any way (but tricked users
| into believing so by using its logo and screenshots) should
| have been nipped in the bud a long time ago.
| TheLoafOfBread wrote:
| [flagged]
| davidhyde wrote:
| You mean like "Apple"
| paxys wrote:
| Try to register a company called Apple that builds iPhone
| apps and you will find out pretty quick how well a sector-
| specific trademark can be enforced.
| TheLoafOfBread wrote:
| [flagged]
| kdmccormick wrote:
| My friend, you are quite confused about trademark law.
|
| If I try to sell computer gadgets under the name "Apple",
| leaving out the "Inc" isn't going to stop me from being
| sued.
| pc86 wrote:
| Do you honestly believe you're making useful, helpful
| comments here?
| TechBro8615 wrote:
| This is more like a company squatting an apple.io domain
| and redirecting to a Sign In With Apple page. I'm
| surprised Discord allowed it to exist.
| mrguyorama wrote:
| Discord probably thought they were being nice and
| fostering a positive attitude towards their community.
| Whoops.
| [deleted]
| nerdponx wrote:
| The word "apple" is not trademarked. The use of the name
| "Apple" in connection with computers is.
| quickthrower2 wrote:
| Google "Trademark"
| judge2020 wrote:
| In the context of "an online service for user communication
| and media hosting", it's valid. And thus they have one http
| s://tsdr.uspto.gov/#caseNumber=86635386&caseType=SERIAL_...
| TheLoafOfBread wrote:
| And completely unenforceable outside US
| suction wrote:
| [dead]
| [deleted]
| pessimizer wrote:
| You seem to think that only made up words can be
| trademarked. You are wrong in every jurisdiction.
| smoldesu wrote:
| _American_ jurisdiction, maybe. Under Chinese law, even
| made up trademarked words can be used with impunity.
| judge2020 wrote:
| Would Chinese trademark rules / laws apply here instead
| of US ones, at least for the purpose of UDRP domain
| disputes[0]?
|
| 0: https://www.icann.org/resources/pages/trademark-
| infringement...
| codetrotter wrote:
| > hard to trademark that
|
| No, because trademarks given by USPTO apply for a specific
| kind of product or service. It's never a blanket protection
| for all situations.
|
| So first on Discord's website we see info about their
| company https://discord.com/company-information
|
| Discord Inc.
|
| Discord Inc.
|
| 444 De Haro Street
|
| Suite 200
|
| San Francisco, CA 94107
|
| United States of America
|
| And then when we go and search in USPTO we can see the
| registrations they have for the name "Discord"
|
| For example they have
|
| > Word Mark DISCORD
|
| > Goods and Services IC 045. US 100 101. G & S: Social
| networking services in the field of gaming. FIRST USE:
| 20181000. FIRST USE IN COMMERCE: 20181000
|
| > Registration Number 6254199
|
| https://tmsearch.uspto.gov/bin/showfield?f=doc&state=4804:5
| l...
|
| And they also have
|
| > Word Mark DISCORD
|
| > Goods and Services IC 041. US 100 101 107. G & S: online
| game services, namely, providing on-line computer games;
| organizing community cultural events; organizing community
| sporting events, organizing educational seminars,
| workshops, and conferences in the field of communications,
| online gaming, online communities and social media;
| providing non-downloadable webinars in the field of
| communications, online gaming, online communities and
| social media
|
| > IC 042. US 100 101. G & S: rental of computer game
| programs and computer game software; online game services,
| namely, providing temporary use of online non-downloadable
| game software; providing computer game subscription-based
| temporary use of non-downloadable game software
|
| https://tmsearch.uspto.gov/bin/showfield?f=doc&state=4804:5
| l...
|
| And they have another few as well probably. Didn't read all
| of them.
|
| With this Discord can protect themselves and their
| reputation within their own verticals.
|
| Other people can still have a decent chance of being able
| to register a trademark for an unrelated product or service
| named "Discord", as long as it is noticeably unrelated to
| the existing marks.
|
| So for example maybe I could start a theatre and get a
| trademark named "Discord" accepted for my theatre.
| lab14 wrote:
| You'll be surprised when you learn about "Windows"...
| TheLoafOfBread wrote:
| You mean Microsoft Windows
| pessimizer wrote:
| You should try to sell your "Windows" operating system.
| I'm sure it will work out. Or maybe ask how it worked out
| for the wxWindows GUI library.
| chefandy wrote:
| A long time ago I registered windowsupdate.ms and put a
| small timeline there about the technological advancements
| we've made to windows over time-- from holes in the wall,
| to grease paper, to bullet proof glass.
| hackernewds wrote:
| Apple has Apple trademarked. You can do that.
| arp242 wrote:
| _And_ Apple famously got in to several trademark disputes
| with another Apple: https://en.wikipedia.org/wiki/Apple_C
| orps_v_Apple_Computer
| suction wrote:
| [dead]
| benatkin wrote:
| This is going to get harder unless the US government or US
| tech companies censor the Internet to block ones that don't
| follow US affiliated trademark law. Which I hope you wouldn't
| support.
| dymk wrote:
| That's not how it works. They just wouldn't be allowed to
| do business in the US, which seems reasonable.
| benatkin wrote:
| See the sister comment about Mr. Beast.
| stcredzero wrote:
| Apparently, this sort of thing happened to Mr. Beast with
| regards to Mr. Beast Burger. Even though his
| agreements/contracts forbade the company making the virtual
| restaurant supplies from doing so, that company trademarked
| his likeness and brand in half a dozen foreign countries.
| He's currently suing them for damages, and for not paying him
| the agreed amount for his participation. (Apparently, they
| had paid him $0!)
| Solvency wrote:
| Why are we acting like Mr Beast didn't also steal the
| moniker from Mr Beast (of Exit Through The Gift Shop
| notoriety)?
| burkaman wrote:
| Are you thinking of Mr. Brainwash?
| echelon wrote:
| Yeah, they have to be.
|
| https://en.wikipedia.org/wiki/Mr._Brainwash
|
| (Don't read if you don't want spoilers. _Exit Through the
| Gift Shop_ is phenomenal and should be watched without
| knowing about this guy. Watch it, then read the Wikipedia
| article for yet another surprise.)
| [deleted]
| dymk wrote:
| Who?
| tester457 wrote:
| His name was generated by xbox for a gamertag
| dom96 wrote:
| Did Mr Beast not realise that creating thousands of ghost
| restaurants would be a bad idea?
| colechristensen wrote:
| Is there anything particularly wrong with a delivery-only
| restaurant? That is the standard definition of "ghost
| restaurant" I know of.
| constantly wrote:
| Not really anything super wrong with it, other than
| perhaps it would be harder to air grievances with them
| because there's usually nowhere to go, and QC issues.
|
| "Ghost Kitchens" have a more nefarious connotation than
| "delivery only" though because often it will be a single
| kitchen yet be advertised as many distinct restaurants. I
| saw one in one major city that was something like fifteen
| "different restaurants" operating from the same small
| space, which is sketchy.
|
| But I think the person to whom you're responding was
| relying more on the word "thousands" here. So given the
| connotation I think opening thousands of these things is
| pretty sketchy for some random YouTube personality with
| presumably no experience with restaurants to be opening
| simultaneously.
| benatkin wrote:
| quality control
| NolF wrote:
| He created the idea at the beginning of the pandemic. His
| thought process was that the Mr Beast brand would allow
| smaller stores to carry his product and incentivise
| people to buy take out from those shops and help during
| lockdowns.
|
| I don't believe the contract between him and VDC is out
| outlining the contractual obligations, SLAs, trademark
| and marketing issues etc.
| [deleted]
| princevegeta89 wrote:
| Howdy, my first thought after seeing this headline was
| basically that the Discord messenger App got hacked and user
| info was stolen.
| madeofpalk wrote:
| What is Discord.io?
| 3rd3 wrote:
| discord.io is a service that provides redirect/invite
| links/URLs to Discord servers.
| pc86 wrote:
| "This service provides links for a chat app" is a crazy
| sentence.
| jadamson wrote:
| Getting a custom URL for a Discord server (e.g.
| discord.gg/hackernews) requires 14 "server boosts" which
| cost $35/year each, so nearly $500/year. There's a
| discount if you have their premium Nitro package, but
| even then it's something on the order of $300.
|
| Meanwhile discord.io is free and you won't lose your URL
| to a crypto scam server when someone forgets to renew
| their boost. Kind of inevitable that such a service would
| pop up.
| xboxnolifes wrote:
| I'm pretty sure it predates the ability to have a custom
| server url from boosting.
| benatkin wrote:
| FWIW they were discordapp.com until May 4, 2020
|
| https://support.discord.com/hc/en-us/articles/360042987951-D...
|
| I remembered vaguely that it was something different from
| discord.com, and was fooled by discord.io :D
| wslh wrote:
| I would add: "unofficial" to the title or something that
| clarify the brand issue.
| Klathmon wrote:
| Probably most, considering it's Discord's logo and screenshots
| of their app used in the article, and discord.io isn't loading
| with 522 errors right now so you can't exactly check.
| warent wrote:
| Thankfully I never used this website _exactly because I feared
| this_.
|
| There was a link to join a discord server via Discord.io that
| showed as a top Google result.
|
| I clicked it not even aware it was 3rd party. Thankfully OAuth
| gave me the friendly confirmation page saying "You are about to
| connect with this third party service and grant full access to
| your account."
|
| I said WTF? NO
|
| Shame on the Discord legal team and their executive team for
| completely lacking diligence on this.
| rvnx wrote:
| If Discord was allowing this website to run for so long using
| this brand, don't they risk losing the trademark because of the
| dilution due to non-enforcement ?
| eastbound wrote:
| Just to confirm, they have a trademark:
| https://trademarks.justia.com/866/35/discord-86635386.html
|
| They don't seem to mention it on their website. I don't see
| any guideline for how to respect their trademark:
| https://discord.com/branding
|
| Now the question, does it risk dilution if a company doesn't
| say what's allowed.
| NolF wrote:
| Yes. Trademark law says the use of a trademark as a
| trademark is an issue. Using the discord logo to link to a
| discord channel is fine. Allowing a site to be named
| Discord with a different TLD is using a trademark as a
| trademark and that can have consequences. The whole point
| of trademark is to distinguish goods/services and by
| failing to prevent the use of discord.io they kinda
| dropping the ball here in my opinion.
| hunter2_ wrote:
| * * *
| stevehawk wrote:
| Correct. if you don't defend your trademark then you risk
| losing it.
| [deleted]
| predictabl3 wrote:
| If Discord.io was using OAuth then this would largely be a non-
| issue as those tokens could be invalidated or revoked, by
| Discord, trivially. And they wouldn't have any password data,
| hashed or otherwise.
|
| Granted, I don't use discord.io , so maybe I'm missing
| something.
| AgentK20 wrote:
| To quote the article:
|
| > Salted and hashed passwords (mainly concerning users prior
| to 2018 when Discord.io began exclusively using Discord for
| logins)
|
| So it sounds like they used to have their own accounts before
| integrating via Discord OAuth, and some users may be affected
| by this. Unsure if they didn't delete users' hashed PWs once
| they migrated to the OAuth flow or something like that.
| explaininjs wrote:
| Based on the screenshot it would seem they do have hashed
| passwords, specifically it looks like bcrypt hashes with a
| cost factor of 8. Not sure why the cost would be so low, or
| indeed why the hashes are available at all.
| zapkyeskrill wrote:
| How would one know if they're affected? I use discord but have no
| recollection how I signed up .. probably via first search hit
| (which could be an add)
| qingcharles wrote:
| This isn't the main Discord app/site, so you're probably not
| affected.
|
| But you can always check at the link below. That guy gets a lot
| of donated packages of cracked data:
|
| https://haveibeenpwned.com/
|
| Google also has their own people seemingly trolling through
| onion sites buying up packages of cracked data so they can run
| it against their own properties and see if anyone is affected.
___________________________________________________________________
(page generated 2023-08-14 23:01 UTC)