HackerTrans
トップ新着トレンドコメント過去質問紹介求人

_wkvo

no profile record

投稿

Discord won't fix the invisibility bypass CVE, so I made a PoC

greasyfork.org
9 ポイント·投稿者 _wkvo·6 か月前·2 コメント

Invisible modes on Steam and Discord are useless

2 ポイント·投稿者 _wkvo·6 か月前·0 コメント

Discord Invisible Mode Is UI Illusion

cve.org
5 ポイント·投稿者 _wkvo·6 か月前·3 コメント

Discord WebSocket leaks 'Invisible' users by explicitly sending 'offline' status

xmrcat.org
4 ポイント·投稿者 _wkvo·6 か月前·0 コメント

Steam "Offline" status leaks exact login timestamps (Valve: Won't Fix)

xmrcat.org
79 ポイント·投稿者 _wkvo·6 か月前·96 コメント

コメント

_wkvo
·6 か月前·議論
Usually discord ignores all issues related to invisibility leaks but responds very fast to other types of issues which is why i decided not to wait for weeks for a fix, instead publish it and watch it get fixed.
_wkvo
·6 か月前·議論
https://xmrcat.org/discord-invisibility-bypass seems like steam is not alone :D
_wkvo
·6 か月前·議論
here you go https://i.ibb.co/39GRMySs/png.png
_wkvo
·6 か月前·議論
Incorrect. "Invisible" is a privacy control, not just a UI filter. While the official client freezes the text, the backend still broadcasts live last_logon and last_logoff Unix timestamps in the ClientPersonaState packet. This leaks exact real-time sleep/wake cycles via the socket, completely bypassing the privacy toggle.
_wkvo
·6 か月前·議論
In this context, 'Logoff' triggers whenever the socket disconnects. So every time you shut down your PC or put it to sleep, that timestamp is updated and broadcast, even if you never explicitly clicked 'Sign Out'.
_wkvo
·6 か月前·議論
Exactly. The 'Offline' feature exists specifically to set that boundary, and the backend completely ignores it.
_wkvo
·6 か月前·議論
Privacy shouldn't require leaving your PC running 24/7.
_wkvo
·6 か月前·議論
True, but a tracking pixel is an active attack that leaves a visible trail. This leak is passive surveillance; I can silently graph the sleep cycles of 200 friends without ever interacting with them. Trust shouldn't imply consent for invisible, automated logging.