Want to add to the discussion?
Ready to try Discord? It's free!
Your place to talk. Discord is a voice, video and text communication service to talk and hang out with your friends and communities. How do I log in to the web client?
Welcome to Reddit,
In December, developers at Discord — a voice and text chat app widely used by the gaming community — announced the launch of a QR code feature that enables users to log into the desktop web client using their phone, by scanning the code that appears on-screen. While this feature is aimed at simplifying the Discord login process for desktop users, news has surfaced that fraudsters have been exploiting the system in an effort to gain unauthorized access to accounts. In scanning the code, however, users inadvertently provide the attacker with access to their account. Discussion of the QR code login exploit has taken place on various Discord servers. Opinion is split over the potential severity of this exploit. However, after releasing a proof of concept to demonstrate the apparent ease of exploitation, Twitch partner Pirate Software said that if the user was a Nitro subscriber, an attacker could gain access to their name, address, and unobfuscated PayPal email address. Discord did not immediately respond to our request for comment. As we wait to hear back, staff weighed in on a Reddit discussion thread , noting that the QR code login window had been reduced, in an effort to thwart any would-be scammers. Our original thought was that the verbiage on the screen would be enough to deter social engineering attacks, however, we agree that more clear verbiage and a warning could be in place.