It has been brought to our attention that private Discord channels are not as private as once seemed. We strongly encourage anyone who uses Discord chats for mafia games to create separate servers for every single private chat, instead of grouping everything into one server to make it easier to manage.
This flaw allows anyone on the same server to see all channels and who has access to those channels regardless of how much access the channel settings say they can have. This flaw should be considered serious and game breaking for any games that have multiple private chats on a single server.
There's a free online discord client-side modification called "Better Discord". This provides a number of community-made improvements to the discord client, and allows for plug-ins. Unfortunately, when an FM game uses a single discord server to help run it, one of these plug-ins ("Show Hidden Channels") can create exploitable vulnerabilities.
As the name implies, it allows a discord user to do the following in any server that they are in:
- See existence of hidden channels that they would not normally see
- See channel descriptions of said hidden channels
- See what discord accounts have access to said hidden channels
The only thing that they cannot see is the messages in hidden channels.
What does this mean?
It means that, by utilizing discord with this plugin, a player can:
- Determine alignment based on access to hidden channels
- Determine some roles based on access to hidden channels
- Potentially identify hidden mechanics or information that have their own channel in a closed-setup game
- Identify an alt player's actual account if there's a channel dedicated to them with their real name OR if they have a recognizable discord name.
What can be done about it?
There are a few practical ways to close this kind of vulnerability. Obviously one would be not to use discord at all, but if you want to use discord then its still safe to do so IF:
- The discord server is dedicated to the secret chat and only those players associated with it. The same must be done for every secret chat on discord (1 server per secret chat).
Testing it in the wild
MartinGG99 tested this with Guillotina. They tested this on the old Anime World 2 server, and with the images below managed to find out information on channels that he configured to hide:
Hat tip to MartinGG99 for finding the problem.