[TERA PC & Console] En Masse is closing, but TERA lives on! We will continue to support TERA PC (NA) and TERA Console until service is transferred. Stay tuned for more information.
[TERA Console] The Grotto of Lost Souls update (v85) is now live! Read the patch notes here: https://bit.ly/TERACon_v85
[TERA PC] The 64-bit update (v97) is now live. Check out all the changes delivered on August 11 here: https://bit.ly/tera64_patchnotes
[TERA PC & CONSOLE] Summerfest Part 2: The Beach Bash is on from August 11 until September 1! Participate in event activities to earn tokens redeemable for costumes, consumables, mounts, and more! Details: https://bit.ly/tera_sf20
_______________
This discussion has been closed.
Comments
This is like Internet Posting 101, not just Discord...
Discord itself is not the problem when it comes to viruses. it's what people are bolting onto it. But that applies to every other Internet connected service...
I don't use Discord and have no need to do so. I would be more concerned about potential threats from other Discord users than I would from the program itself.
Why would I care about my website visits being tracked? What are they going to steal from me? I don't use any kind of online banking, and any transactions I make that are monetary and/or require personal information are done so via encryption. I use reliable and up-to-date antivirus software, a firewall, and software that protects the system from configuration drift & unwanted MBR changes. I use a simple, but effective email system from my ISP that provides additional layers of security in regards to email threats. This is BASIC protection! The level of sophistication required to get through that just to steal my information, money, etc., isn't something you're going to encounter unless you're a complete idiot, or as I said before, doing something illegal and/or morally questionable.
I've read through everything in the privacy statement. You don't have to link your social media to Discord. When you do link them, that is when Discord gathers the data, so the simple solution is to not link them. Seriously, the only individuals that would have a problem with it are schizoids or criminals. For now, you can start by taking off your tin-foil hat and asking yourself the question, "Why would anyone bother singling me out and going through the hassle of sifting through my tracking history and/or social media exchanges and somehow use it against me? Why?"
I'm a IT Security Analyst by trade, and I dropped my VPN connection just so that I could sign into this forum because I also wanted to chip in my 2 pence. I'm not questioning anyone's opinion, but I am providing more information for both sides to consider.
Regarding venture capitalists, etc, I'd like to point out that I used to pay the subscription to use Whatsapp until they were bought out. Now it's free.
I find static IPs to be better than dynamic for a number of work/personal reasons, first and foremost is convenience over obfuscation. Depending on the risk appetite of online services, they can enforce a number of different controls, some of which would annoy me, e.g. CAPTCHA every time I want to sign into a service because I have a new unauthenticated address. en masse Account Armour, Steam Guard, are both good examples of this.
Re: VPNs, this encrypts your data end to end but if you need to authenticate to a service, your activity logs and privacy are at the same level.
Some web services offer SSO functionality by using your social media accounts to authenticate you, e.g. The Book of Faces, Google+ (RIP). Basic information is passed in order to build your account, there are no in-depth concerns about granting access. There are more wider spread concerns around the use of OAuth2.0, not privacy.
"As a bonus, all of the javascript from the discordapp website is run as Nodejs in electron. This essentially elevates any small xss vuln into a full blown remote access problem. I'm still looking into this. Since someone mention it somewhere, but did not really explain further into it."
Yes, you should look further into this. This does not essentially elevate any small XSS vuln into a full remote access, remote code execute, memory buffer overflow, etc.... Bad coding does. just like any other run-time environment, it is forever vulnerable to exploits, but where discovered, they seek to plug any holes just as any other engine. Probably the worst offenders are Flash and Oracle Java, yet these are still very popular.
As with any service you wish to use, it is important to consider the benefit of the service, convenience, and your risk appetite. Personally I feel that I have sufficient control and security over my gaming PC that I am not concerned about the security or privacy statement for Discord, since I know others are weaker, I can argue that's a low appetite for risk, but also an acceptable risk. This is my personal position on security/risk/privacy.
Food for thought: There is a changing perception within cyber security/intelligence circles, that if you are using a VPN, ToR, SSL/SSH tunneling, what are you trying to hide?