I must say, of all the communication platforms I am on I care the least about discord being e2e encrypted. Even less so when audio and video is concerned (it only applies there). In fact, with...
I must say, of all the communication platforms I am on I care the least about discord being e2e encrypted. Even less so when audio and video is concerned (it only applies there).
In fact, with text messages I want discord to also "listen" in as they have more insights in shady behaviour than I as a server owner have. Alerts about suspicious DM activity have greatly reduced some of the more insidious spam and such we have had to deal with.
This move almost feels like discord is effectively saying they don't want to put the same amount of effort in moderating voice and video content. Which I understand to a certain degree, it is content that does not persist. So monitoring it and taking action on it takes up more resources.
By using E2E encryption they can effectively take their hands off it as they are not able to monitor it in the first place.
Because people often confuse e2e encryption with a generally encrypted connection, I do want to clarify that I still expect the connections towards and from discord to be encrypted.
Hard disagree. I use discord to communicate with friends (generally not public “communities”) and have no interest in anyone listening in on our conversations. E2EE is a huge feature for privacy....
Hard disagree. I use discord to communicate with friends (generally not public “communities”) and have no interest in anyone listening in on our conversations. E2EE is a huge feature for privacy.
Abuse signals can still be processed with E2EE. “Suspicious DM activity” seems to just be related to large numbers of outbound DMs to server members (compared to typical activity), and that’s something you can still do without inspecting message contents.
Not the person you're replying to, but my general feeling towards discord is that of a person that has given up. I declared privacy bankruptcy as soon as I used discord to chat. I made peace with...
Not the person you're replying to, but my general feeling towards discord is that of a person that has given up. I declared privacy bankruptcy as soon as I used discord to chat. I made peace with that and I treat everything that I put there as public (much like I do with Tildes, for example).
I move my business elsewhere for business I care about. I know it's not the best mindset but to be fair there's nothing they could change to regain my trust. I just wish less people used it as a central point of contact.
Yup, that is pretty much my attitude as well. Considering discord has been around for almost a decade and only now part of it is E2E encrypted only underlines the point that until now you had no...
Yup, that is pretty much my attitude as well. Considering discord has been around for almost a decade and only now part of it is E2E encrypted only underlines the point that until now you had no reasonable expectation of Discord not listening in.
Why? They are saying this in the context of discord. If you start using a platform where you know there is no E2E encryption applied to messages, then you also know that this limits the amount of...
Why? They are saying this in the context of discord. If you start using a platform where you know there is no E2E encryption applied to messages, then you also know that this limits the amount of privacy you can expect. Certainly, when the company behind it explicitly states they are collecting content you create on their platform.
My point is more that for almost a decade it has had no e2e encryption. I don't mind having it now, but I don't care for it either, as given the history I didn't have any expectations about...
My point is more that for almost a decade it has had no e2e encryption. I don't mind having it now, but I don't care for it either, as given the history I didn't have any expectations about privacy.
I am actually slightly more surprised to hear that discord apparently does not listen in on conversations.
Yes and no. On public forums/chat where trust is low, E2E encryption is a tool that gives abusers disproportionate power. I've had stalker behavior crop up, and detecting that can't exactly be...
Yes and no. On public forums/chat where trust is low, E2E encryption is a tool that gives abusers disproportionate power. I've had stalker behavior crop up, and detecting that can't exactly be done heuristically. And having with permabans without evidence is ripe for abuse by bad faith trolls.
Additionally, on my kid's game server, I log all chats and it would be dangerous to not audit them.
All that said, it would be a nice option to have available... but if you want it for text, there are better options IMO.
E2E however doesn't prevent people from reporting malicious activity. It wouldn't be hard to have a report button send the message in question to a moderation team for further analysis. The same...
E2E however doesn't prevent people from reporting malicious activity. It wouldn't be hard to have a report button send the message in question to a moderation team for further analysis. The same thing applies to live audio/video. The last few minutes could be locally stored, and then send off on request.
'E2E encrypted except when we want it to be' kind of defeats the purpose. Unless you have the raw unencrypted message or a backdoor, it can be faked. Even beyond that, an awful lot of abuse...
'E2E encrypted except when we want it to be' kind of defeats the purpose.
Unless you have the raw unencrypted message or a backdoor, it can be faked.
Even beyond that, an awful lot of abuse happens without report buttons, especially of kids.
'Except when we want it to be' is a misrepresentation here. In the case of moderation, this would be sending a decrypted copy of a series of messages (or segment of a call) to the moderation staff...
'Except when we want it to be' is a misrepresentation here. In the case of moderation, this would be sending a decrypted copy of a series of messages (or segment of a call) to the moderation staff with the consent of the reporting user.
Much better for privacy than the current status quo of "messages are stored in a database that anyone with credentials can read."
there are better options IMO.
Very much agreed on this front. I would like to get my personal chats off of discord (and onto Matrix/Signal) but the challenge there is getting people I want to chat with off of discord as well. I appreciate when privacy improvements come to where people already are, rather than needing to start fresh on a new service.
I've had stalker behavior crop up
I think that might be where our difference of opinion is. My use of discord is primarily as a private chat client, and the vast majority of my time is spent in servers where there are no public invites. It's more similar to iMessage or WhatsApp for me than it is to Reddit or a forum.
Community servers have very different needs, and E2EE doesn't really make sense in that context–if anyone can get an invite link, what's the point of encrypting chats?
Well, you can’t prove in that case that the other person sent the message.
In the case of moderation, this would be sending a decrypted copy of a series of messages (or segment of a call) to the moderation staff with the consent of the reporting user.
Well, you can’t prove in that case that the other person sent the message.
Which is exactly my point. If you can't prove content, you're down to trust. If you can prove content, you've compromised the entire point of E2E. Are you gonna risk pissing off your entire...
Which is exactly my point. If you can't prove content, you're down to trust. If you can prove content, you've compromised the entire point of E2E.
Are you gonna risk pissing off your entire userbase by getting it wrong due to bad faith actors for a feature most people don't care about?
And to be clear: Discord's origins and most-central use case was handing out links in League of Legends for strangers to join a voice chat with randos and no software installs. While use has...
And to be clear: Discord's origins and most-central use case was handing out links in League of Legends for strangers to join a voice chat with randos and no software installs.
While use has evolved beyond that, there is still a very real need at the core of their product.
The client already has it decrypted. When reporting a message, the client sends the cleartext of the reported message along with the encrypted data for recent context and keys (to ensure data...
The client already has it decrypted. When reporting a message, the client sends the cleartext of the reported message along with the encrypted data for recent context and keys (to ensure data integrity), before rotating keys for new messages.
Perhaps automatically rotate keys every week so the key sent with the reported message does not unlock the entire prior chat history.
Messages are not E2E encrypted as a result of this update. Only audio and video are. Seems like a straight-up good move to me.
Messages are not E2E encrypted as a result of this update. Only audio and video are. Seems like a straight-up good move to me.
Safety is intertwined with our product and policies. While audio and video will be end-to-end encrypted, messages on Discord will continue to follow our content moderation approach and are not end-to-end encrypted.
I must say, of all the communication platforms I am on I care the least about discord being e2e encrypted. Even less so when audio and video is concerned (it only applies there).
In fact, with text messages I want discord to also "listen" in as they have more insights in shady behaviour than I as a server owner have. Alerts about suspicious DM activity have greatly reduced some of the more insidious spam and such we have had to deal with.
This move almost feels like discord is effectively saying they don't want to put the same amount of effort in moderating voice and video content. Which I understand to a certain degree, it is content that does not persist. So monitoring it and taking action on it takes up more resources.
By using E2E encryption they can effectively take their hands off it as they are not able to monitor it in the first place.
Because people often confuse e2e encryption with a generally encrypted connection, I do want to clarify that I still expect the connections towards and from discord to be encrypted.
Hard disagree. I use discord to communicate with friends (generally not public “communities”) and have no interest in anyone listening in on our conversations. E2EE is a huge feature for privacy.
Abuse signals can still be processed with E2EE. “Suspicious DM activity” seems to just be related to large numbers of outbound DMs to server members (compared to typical activity), and that’s something you can still do without inspecting message contents.
Not the person you're replying to, but my general feeling towards discord is that of a person that has given up. I declared privacy bankruptcy as soon as I used discord to chat. I made peace with that and I treat everything that I put there as public (much like I do with Tildes, for example).
I move my business elsewhere for business I care about. I know it's not the best mindset but to be fair there's nothing they could change to regain my trust. I just wish less people used it as a central point of contact.
Yup, that is pretty much my attitude as well. Considering discord has been around for almost a decade and only now part of it is E2E encrypted only underlines the point that until now you had no reasonable expectation of Discord not listening in.
This is insane.
Why? They are saying this in the context of discord. If you start using a platform where you know there is no E2E encryption applied to messages, then you also know that this limits the amount of privacy you can expect. Certainly, when the company behind it explicitly states they are collecting content you create on their platform.
My point is more that for almost a decade it has had no e2e encryption. I don't mind having it now, but I don't care for it either, as given the history I didn't have any expectations about privacy.
I am actually slightly more surprised to hear that discord apparently does not listen in on conversations.
Yes and no. On public forums/chat where trust is low, E2E encryption is a tool that gives abusers disproportionate power. I've had stalker behavior crop up, and detecting that can't exactly be done heuristically. And having with permabans without evidence is ripe for abuse by bad faith trolls.
Additionally, on my kid's game server, I log all chats and it would be dangerous to not audit them.
All that said, it would be a nice option to have available... but if you want it for text, there are better options IMO.
E2E however doesn't prevent people from reporting malicious activity. It wouldn't be hard to have a report button send the message in question to a moderation team for further analysis. The same thing applies to live audio/video. The last few minutes could be locally stored, and then send off on request.
'E2E encrypted except when we want it to be' kind of defeats the purpose.
Unless you have the raw unencrypted message or a backdoor, it can be faked.
Even beyond that, an awful lot of abuse happens without report buttons, especially of kids.
'Except when we want it to be' is a misrepresentation here. In the case of moderation, this would be sending a decrypted copy of a series of messages (or segment of a call) to the moderation staff with the consent of the reporting user.
Much better for privacy than the current status quo of "messages are stored in a database that anyone with credentials can read."
Very much agreed on this front. I would like to get my personal chats off of discord (and onto Matrix/Signal) but the challenge there is getting people I want to chat with off of discord as well. I appreciate when privacy improvements come to where people already are, rather than needing to start fresh on a new service.
I think that might be where our difference of opinion is. My use of discord is primarily as a private chat client, and the vast majority of my time is spent in servers where there are no public invites. It's more similar to iMessage or WhatsApp for me than it is to Reddit or a forum.
Community servers have very different needs, and E2EE doesn't really make sense in that context–if anyone can get an invite link, what's the point of encrypting chats?
Well, you can’t prove in that case that the other person sent the message.
Which is exactly my point. If you can't prove content, you're down to trust. If you can prove content, you've compromised the entire point of E2E.
Are you gonna risk pissing off your entire userbase by getting it wrong due to bad faith actors for a feature most people don't care about?
And to be clear: Discord's origins and most-central use case was handing out links in League of Legends for strangers to join a voice chat with randos and no software installs.
While use has evolved beyond that, there is still a very real need at the core of their product.
The client already has it decrypted. When reporting a message, the client sends the cleartext of the reported message along with the encrypted data for recent context and keys (to ensure data integrity), before rotating keys for new messages.
Perhaps automatically rotate keys every week so the key sent with the reported message does not unlock the entire prior chat history.
Messages are not E2E encrypted as a result of this update. Only audio and video are. Seems like a straight-up good move to me.
Yeah, that is what I said? I just personally don't care for it at all, discord to me isn't the sort of platform where I expect that level of privacy.
E2E Encryption really should be the default, not extra. I'm always happy any software adds it in.