Opinions on Discord's recent E2EE announcement?

stupidcreature

This is the announcement
I really doubt their implementation, as they relied on a partnership with the Trail of Bits for this one which is quite disturbing. They have also used ellyptic curve encryption which is NSA compromised (and Discord is an American company as is) instead of the usual RSA or else.
Discord also has an insanely poor track record, having been verified to have essentially collected any and all information they could have. Do you reckon this will affect GrapheneOS's Discord server? And what is everybody's opinion on this?

DeletedUser26

stupidcreature you’re making some unsubstantiated claims there.

Considering GOS server is already not E2EE I don’t see how this would make anything any worse.

gravity-reprint

stupidcreature

Lol. That's a massive claim that ECC is compromised by the NSA, that is extremely unlikely. The mathematics behind it make very resistant to attacks if you use the right variables.

You don't have any proof of that, I'm guessing?

stupidcreature

DeletedUser26 If I may ask, what are the unsubstantiated claims?

DeletedUser26

stupidcreature their encryption is compromised by the NSA mainly. Also I’m not sure why partnering with Trail of Bits is bad. Also what does “verified to have collected any and all information they could have” mean? They don’t exactly collect your SSN or require photo ID or anything.

stupidcreature

DeletedUser26 Hello, what I meant is that Discord stores all conversations (be they audio or text) and actively uses them for advertising and etc. By collecting all possible data, I meant all possible data provided by the user.

matchboxbananasynergy

gravity-reprint I'm hoping that we can steer this thread into an actual discussion of the news, and not a meta-argument about the weird statements made by OP.

If we go down that path, we'll eventually have to lock the thread and lose the opportunity for a productive discussion around the topic to occur.

stupidcreature

gravity-reprint Upon further analysis it seems to me like I misread a couple of articles sent by my friends. Still, I have heard that there are some disadvantages of ECC as opposed to RSA, but that is purely based off of a couple of discussions I had.

matchboxbananasynergy

This update has to do with audio and video calls.

The GrapheneOS Discord community is completely public. There's no encryption or expectation of privacy, it's a public platform and people should expect it can be logged.

Therefore, even if Discord added E2EE to any text-based communication, it would not change that fact about the GrapheneOS Discord server.

Additionally, the various FUD statements about NSA backdoors etc. are very weird, and I hope that this thread can be about discussing these news, and not dispelling unsubstantiated claims.

Regarding Discord moving towards E2EE to some capacity, I'll say that's positive, though Discord DMs should be E2EE too, at the very least. For public rooms, it doesn't really make sense, though.

Rizzler

Dont worry about the NSA. Instead worry about Trail of Bits and the fact that Discord is hardly an american company when Tencent owns a big portion of its stocks. They are not a user focused platform and everything they do is for increasing shareholder value instead of serving their users.

Rizzler

If you care about privacy at all, do not use Discord under any circumstances. They are also actively violating the GDPR by denying the right of data erasure. Even if they add E2EE for message content, their metadata collection will be just as bad or worse than WhatsApp

AtavisticPuma

Trail of Bits' work here as a security auditor shouldn't be a cause for concern, the reports seem to show all of their analysis so they at least open themselves to criticism from other reviewers.
Of course Discord's code won't be available once it's part of their closed-source client, but plausibly Discord might just not want to be legally liable for content in their A/V calls, so they have an incentive to actually provide effective E2EE.
Overall this is a tiny change in Discord's access to so much user data, and IMHO there is barely a story here.

stupidcreature

AtavisticPuma You have a great point, maybe in light of the recent Telegram fiasco Descord realised that they have a responsibility to moderate the calls and chats they have access to, and so they just decided to implement E2EE to deflect any claims.