What's wrong with Discord

Discord is a messenger that was originally created for computer game lovers. But there is a problem: most often, users do not think about data security and, in the same application, send memes to each other, receive congratulations from relatives, discuss the trade secrets of their companies and share ways to survive under dictatorship.

Chatting about sensitive topics on Discord is not safe. Let's explain why.

1

What is this application?

Discord is a free messenger with voice and video chat capabilities. Most often it is used by gamers: the service works without problems in the background, does not consume many resources and allows you to “create” separate servers for communication. But it's not that simple.

The messengers you use must meet the following security criteria:

• availability of end-to-end encryption;
• being in a relatively safe jurisdiction;
• open source;
• collection and storage of a minimum amount of user data.

But does Discord live up to it?

2

End-to-end encryption

It's not on Discord. That is, your messages are transmitted in encrypted form not to the recipient, but only to the server. The connection to it is encrypted using the standard TLS transport layer protocol. And when the correspondence reaches the server, developers will most likely be able to read it. This is already enough to blacklist Discord.

3

Located in a relatively safe jurisdiction

Discord releases user data to US intelligence agencies by court order, as well as without a court order on an urgent basis. In addition, Discord can release data to intelligence services of other countries if the request is sent within the framework of an international treaty on mutual legal assistance and is approved by a US court.

In its transparency reports, Discord does not indicate exactly what data is actually released to which countries.

4

Open source

The source code of the messenger is closed. Both the server part and applications for PC and phone. This means that no one can conduct an independent audit of the service and make sure that it works exactly as the developers promise.

5

Collection and storage of a minimum amount of user data

It cannot be unequivocally confirmed that Discord does not collect any data other than necessary for operation, does not track you, and does not share personal information with anyone.

How secure and how long your data is stored is also unclear. The privacy policy states that public messages are retained for up to two years, and educational record information may be retained for up to 45 days after deletion. The service can also save all user data at the request of security forces for up to three months. But without knowing how the application works from the inside, it is impossible to say how exactly the data is stored and whether it is deleted at all and not merged into the archive.

6

Another interesting point

Discord may share data with related companies.

One of the co-owners of Discord is the Chinese corporation Tencent. It is obliged to transfer user data to the Chinese government and intelligence agencies. And the Chinese intelligence services, as you know, communicate well with ours. Tencent's data collection policy can be seen in the example of their own WeChat messenger, through which users (including foreign ones) are massively monitored at the request of the authorities.

It is certainly unknown whether Discord shares data specifically with Tencent, but this option cannot be ruled out.

7

What's wrong with "servers" in Discord

A chat room that any user can create is slyly called a “server”. It’s sly, because you can’t raise a real server.

All your chats and data live on the developer's servers. If desired, the room can be made public. But most of the communication takes place not in public, but in closed rooms, where guilds of gamers, groups of friends communicate, and sometimes even meetings of various companies gather. Closeness gives people a false sense of anonymity and security.

8

What, were there already precedents?

Yes. For example, in January 2023, a US Air Force National Guardsman leaked secret documents regarding the war in Ukraine into a chat with memes. And then the drain spread further. The author of the leak, like many other users, thought that since the chat was closed and users were using pseudonyms, then they could communicate without fear.

Cybercriminals have also chosen the popular messenger. For example, traders of stolen credit cards, accounts, hackers and even child kidnappers. Discord was originally created for gamers. This means that its security must be assessed in the same way as the security of any other service.

9

Let's sum it up

Yes, Discord is convenient. But it cannot transmit any information that cannot end up in third hands. There are plenty of opportunities to steal it.

Do not discuss sensitive topics in Discord chats unless you want to get jail time for “fakes” about the army, calls for terrorism, and the list goes on and on.

We talked in detail about how to choose a secure messenger in the video .