Sinisterly
Discord introduced logging in via QR code, possible to exploit - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: World News (https://sinister.ly/Forum-World-News)
+--- Thread: Discord introduced logging in via QR code, possible to exploit (/Thread-Discord-introduced-logging-in-via-QR-code-possible-to-exploit)

Pages: 1 2

Discord introduced logging in via QR code, possible to exploit - Pikami - 01-12-2020

Discord recently introduced logging in via QR code, witch is pretty handy when desktop version randomly decides to log you out.
However as you may have noticed, a small exploit exists: a person can create a QR code and trick some one else to scan it, this way that person would get full access to the victim's account.

[Pikami's fun tips]
For people using discord: NEVER and I mean NEVER scan a QR code for Discord-related gifts or prizes including Nitro giveaways, trough the Discord mobile app, EVER.
You are NOT redeeming the "prize", you're giving someone FULL access to your account, regardless of 2FA. Until Discord adds a notice to their app, you'll have to be extremely cautious about this.
For server owners: Please inform your members and staff about this feature to avoid spam/server takeover.
For the black-hats out there: (the mentioned timing values are taken at the time of writing and might change)
  • The QR code is present on the login page of discord.
  • You have to keep the page open for the QR code to be valid since a heart-beat packet is sent roughly every 41 seconds.
  • The QR code is only valid for 2 minutes, so you need to keep updating it until someone scans it.


Discord introduced logging in via QR code, possible to exploit - Oni - 01-13-2020

Gimmicky thing to implement, made worse by the security implications. Thankfully I don't know anyone that would scan a QR code.

RE: Discord introduced logging in via QR code, possible to exploit - mothered - 01-13-2020

Quote:You are NOT redeeming the "prize", you're giving someone FULL access to your account
This comes as no surprise.

I've never scanned a QR code, and never will In any capacity.
Thanks for the heads-up.

DlSCORD introduced logging in via QR code, possible to exploit - Darwin - 01-13-2020

It's kind of weird why you would even try to redeem a nitro code in the first place if you scan a QR code to redeem nitro. Nitro doesn't even come in a QR code.

RE: Discord introduced logging in via QR code, possible to exploit - Oni - 01-14-2020

(01-13-2020, 02:37 PM)XXXTENTAClON Wrote: It's kind of weird why you would even try to redeem a nitro code in the first place if you scan a QR code to redeem nitro. Nitro doesn't even come in a QR code.

I can't see any of our members falling for this personally, but there's always exceptions. Mainly because Nitro is given via inline messaging already.

RE: Discord introduced logging in via QR code, possible to exploit - Jiggly - 01-14-2020

I've never used QR codes for anything, but I do feel that this a fine example of making something easier to use with a gimmick that compromises security.

RE: Disсord introduced logging in via QR code, possible to exploit - DrAlvarez - 05-03-2020

DIsсord is so shity app, frankly speaking,

RE: Disсord introduced logging in via QR code, possible to exploit - mothered - 05-03-2020

(05-03-2020, 06:55 AM)DrAlvarez Wrote: DIsсord is so shity app, frankly speaking,

Personally, I think Discord Is a good gateway of communication but after what happened with this board a little while back, I don't agree with their policies, nor how they handle disputes.

RE: Discord introduced logging in via QR code, possible to exploit - Oni - 05-03-2020

(05-03-2020, 08:01 AM)mothered Wrote:
(05-03-2020, 06:55 AM)DrAlvarez Wrote: DIsсord is so shity app, frankly speaking,

Personally, I think Discord Is a good gateway of communication but after what happened with this board a little while back, I don't agree with their policies, nor how they handle disputes.

They've grown as a company, but their policies have changed for the worse. We only have a server, because most of our members use the platform. I look forward to a substitute, as Discord's trajectory is unfavorable.

RE: Discord introduced logging in via QR code, possible to exploit - Jiggly - 05-03-2020

(05-03-2020, 12:51 PM)Oni Wrote:
(05-03-2020, 08:01 AM)mothered Wrote:
(05-03-2020, 06:55 AM)DrAlvarez Wrote: DIsсord is so shity app, frankly speaking,

Personally, I think Discord Is a good gateway of communication but after what happened with this board a little while back, I don't agree with their policies, nor how they handle disputes.

They've grown as a company, but their policies have changed for the worse. We only have a server, because most of our members use the platform. I look forward to a substitute, as Discord's trajectory is unfavorable.

Agreed. I've seen a lot of negative talk in regards to their dispute handling and their new policies. I get that as a company grows, they have to protect their backs, but do it in a way that works with your primary users, not against them.