Hacker News Reader

Ok so when I've never used a 3rd party discord service I'm safe. I got scared there for a moment, but then I thought what would I lose? Nothing at all. Nothing that can't be replaced. No contacts worth keeping.

View on HN

If someone has access to your account I assume they can read all your messages and possibly impersonate you.

Having OAuth creds is a totally different thing than having access to your account. I support "Log in with Discord" on my site that uses the OAuth flow and the only thing I get out is a set of creds that can hit /user/@me and let me say "the user that just authed is this Discord user." Now discord.io could have asked for everything but the risk of some random integration is on average a lot less. To my knowledge absolutely nothing has the rpc scopes.

The good news is that even with every scope you can't take over the account and the service can just be removed cutting off their access for sure.

Reply on news.ycombinator.com