Hacker News Reader

Comment by toolz | Hacker News Reader

hmm, so on public discord servers if someone copies my nickname and pretends to be me, someone might not easily notice?

Seems like a pretty readily used vulnerability. I remember back in high school on AIM someone made a username very similar to mine and said some nasty things to a girl I was talking to - she told me to stop talking to her and I didn't figure out why until years later. I imagine the same exploit could be done more easily if you can use the same username and discord actively tries to hide the hash.

Maybe I'm just overly sensitive since impersonation has hurt me, though.

View on HN

I'd argue the opposite - it's harder to get away with impersonation.

In the AIM situation, users go in "knowing" that usernames are unique, so if you see a message from user abc123, you "know" it's that person. Which means user abcl23 ("el" instead of "one") can impersonate the real user.

In Discord situations, (1) the user is more likely to know that usernames can be reused, since they weren't required to make a unique one to start - so they can be more cautious of impersonation attempts, and more importantly (2) the Discord devs know names can be reused/abused, and can build better mitigations if they so choose to (like e.g. putting a disclaimer at the top of any message from a user you've never contacted before, etc.)

Depends on the setup of the Discord server.

Many servers have different "roles" created, though often they're just nothing more than a title and a different color for your name when chatting on the server. If you don't have the default role on your server, then anybody would probably notice the fake person is a fake because they'd have the default role color.

Second, servers can require that your account have a verified phone number for you to join or chat on it, which raises the barrier a bit for creating fake accounts.

Finally, even if they join a mutual server and send you a private message, when you view the message, you won't see the private message history of the conversation with the real account, giving away that it's at the very least a new account.

Overall, it's harder to impersonate on Discord than it is on AIM, but still certainly not impossible.

Reply on news.ycombinator.com