An unidentified individual has listed the data of 760,000 Discord.io users for sale on a darknet forum. This discovery was brought to light by the “Information Leaks” Telegram channel, associated with the Russian service for tracking vulnerabilities, data leaks, and monitoring fraudulent online resources.

For clarity, Discord.io is a third-party interface tailored for the widely-used Discord messenger. The offered database comprises details like email addresses, hashed passwords, and other user-specific data.

  • ivenoidea@lemmy.world
    link
    fedilink
    English
    arrow-up
    109
    arrow-down
    1
    ·
    edit-2
    1 year ago

    Discord.imo, for anyone unsure like me, seems to be unaffiliated with Discord itself and simply a website to find Discord servers to join. It’s offline now.

    Edit: Ah I see the article mentions that as well, it didn‘t load for me earlier.

    Might still be good to have that info here. The amount of upvotes makes it seem like a lot of people might think this is about Discord itself.

    • skilledtothegills@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      31
      ·
      1 year ago

      I’m actually curious where did they got the passwords from? Discord.io looks to be using Discord itself for authenticating users, but I myself have never used the service so I have no idea.

      • originalfrozenbanana@lemm.ee
        link
        fedilink
        English
        arrow-up
        19
        ·
        1 year ago

        Depending on how that authentication handshake is implemented secrets can be leaked. It could be a security flaw on Discord’s side that Discord.io has access to via SSO, or it could be that Discord.io stores username and password for some reason.

        • ipkpjersi@lemmy.ml
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          1 year ago

          Yeah but there’s a big difference between tokens that can easily be revoked and what could be potentially plain-text passwords.

          edit: Okay, so it sounds like they had their own account system back in 2018 separate from Discord. That makes more sense.