Upgrade your Discord Account Security!

[@breadmachine_official]

*HEADS UP!* Passkeys with QR codes are safer than the Discord login QR codes because the device connects to the PC via Bluetooth. This means if you don't have Bluetooth built-in to your PC or you don't have a USB Bluetooth adapter, the QR code will not appear to log-in.

[@Paul_11232]

​@@nanopiyou not existing helps too

[@suryasrivastava8174]

Yes

[@suryasrivastava8174]

Jk 1:52

[@BobOrKlaus]

Thank you, if noone told me it doesnt work without bluetooth I would have sat here wondering why it doesnt work for me

[@candianatan]

xd. Its fun but it happend to me too a time ago@@BobOrKlaus

[@rhettorical]

As always, security comes down to users being stupid far more than anything a hacker could come up with.

[@clipbitlocker]

.... or old. Wait till you 5 years older. Then you learn how hard it is to keep up.

[@BigJemu]

@@clipbitlocker skill issue

[@bloosixjr7505]

No lol. Data leaks on other websites are very common, and if you reuse a single password, that could get your account compromised.

[@clipbitlocker]

@@bloosixjr7505 Correct and data leaks and data breaches happen for 2 main reasons. There's an insider (social engineering) or people are so old that they are not aware of safe cybersecurity practices. How many people out there have a grandma/grandpa that has been tricked by scam?

[@davemiller638]

@@bloosixjr7505 What if I reuse a married password?

[@Kodufan]

A little thing about the analogy. The two numbers will be prime numbers, meaning that the result has one and only one set of two numbers to make it. It is really, REALLY hard to crack. You basically need to just guess and check

[@maxomega3]

very well put. His explanation was spot on except for this

[@supramaxis]

once i saw this comment i thought of the modular multiplicative inverse operation

[@alizardguy]

omg kodu haiiii

[@Pengal25]

That gaming computer just to watch KZbin was the biggest callout

[@nostalgicumbry3279]

I feel so seen. Bought a new computer a few years ago just to play runescape and watch youtube.

[@SonOfSparda03]

I bought a top of the line PC and I only play league so pretty much yea

[@OriginBullet]

I feel personally attacked 😅

[@Maxime-fo8iv]

Fun fact: You don't have to "wait until the code refreshes because you can't type the numbers fast enough because you only had 2 seconds left to put them in" (2:49): just enter the code that you see and it will just work, even after the code disappeared!

[@MasicoreLord]

from my experience not long after it disappears that code would have expired, assuming the device you were using's clock is synced closely

[@chlorobyte_projects]

Indeed. That authentication system actually checks 3 separate codes - the one for the current time, and the one before and after, so assuming your system time is synced up, that code will work for a whole 30 more seconds. ...and now you know that it's technically a 3 in 1000000 chance to guess the code rather than 1 in 1000000.

[@MasicoreLord]

@@chlorobyte_projects didn't realize Discord did that, guess it makes sense, since it increases the reliability

[@FlipPlayzYT]

so a 1/333333 chance@@chlorobyte_projects

[@crowruin2]

For anyone wondering you can use just Security Keys as 2FA You do not need to have TOTP as a backup Also remember to save those backup codes in-case you lose your Yubikeys

[@D0Samp]

The same way you should have saved your recovery codes for 2FA before, by the way. Otherwise, passkeys only swap out your password (which has relatively little entropy compared to the usual public-key system) for a challenge-response authentification.

[@Schwanz250]

I never thought Discord would think about our security

[@aeswere]

@@VaultCord I think checking the device hardware/whatever would also help, or whenever a page is reloaded it checks if the device is still the device prior to loading, having you reauthenticate if whatever marker they use is changed. I'm sure there's probably a simpler way but this sounds secure, no?

[@nico1337]

I'm using a NitroKey 3A NFC (plus a NitroKey FIDO2 as a backup) because they are fully open source (hardware and software) instead of YubiKey. They do have some drawbacks tho

[@darwinpolio]

whats the drawbacks? might get one

[@nico1337]

​@@darwinpolio YubiKeys are just more well-known and might be better supported. But I can only tell one instance where only YubiKeys were allowed, and that was on Kraken (kinda niche, trading platform). As far as I understand, FIDO2 is a standard, so it's not really a restriction because they can't support others - just because they want to. Then NitroKeys are a bit more expensive and the setup for YubiKeys might be a bit easier as they have a bit better fledged out software. Just do your own research, but these are no actual drawbacks for my personal taste.

[@freshcutbackup380]

security shouldnt be open-source

[@nico1337]

@@freshcutbackup380 Security by obscurity is not actual security.

[@electricz3045]

​@@freshcutbackup380it should. You never ever want to use something poopiotary.

[@chazthecheeseguy]

Cool! I love securing my account! Good job Discord.

[@TheRealMatthewYT]

Same

[@raiban0]

Npc

[@wedner_12]

@@raiban0 💀

[@Acgpro1Aymir]

@@raiban0you just said the same message twice did you ai glitch? (Joking btw)

[@chazthecheeseguy]

@@raiban0 huh?

[@kmcat]

4:18 that's not quite right, It generate a semi prime number, the program is looking for two prime number multiplied together that equal the semi prime number from before . I'm sure this using U2F which is using Challenge response authentication 6:31 SIM swapping is a bit pointless as under laying protocol SS7 has a simple SMS redirection vulnerability; that's never getting fixed due to governments using the flaw

[@rokenato.]

dang

[@ThatOneKitsune]

gotta love the govt causing security issues

[@Dragon359]

While it was (in relative terms) a more mild hacking I suffered with a discord keylogger, morning grogginess and luck on the end of a hacker who sold me the 'my friend is making a game' while speaking through a friends account he hacked...that was making a game, got my account hacked.

[@GurkenbauerTim]

Had a similar situation. Bought something overseas (smth from kickstarters) and I was waiting until it finally shipped to me. Then I get an email "Delivery failed, verify address". Luckily I thought about messaging the sender and he told me they didn’t start the delivery and that they still had to prepare my package.

[@semihguner1]

5:38 you SHOULD hide those codes, people can log in using those

[@george1717]

Was just going to comment the same thing

[@GurkenbauerTim]

He probably changed them after recording the video. It even says that generating new backup codes makes the old ones invalid

[@n3er0o]

4:44 there is a little annoyance here with Windows 10 (if you're still using that). Sometimes a window will pop up asking you for your Windows PIN when instead you want to register a physical security key. You need to click cancel on that popup and *only then* the window you show in the video here pops up asking you to confirm your security key. Make sure the setup makes you touch your security key's button or otherwise you just set up Windows Hello with your (probably) very weak Windows password.

[@KARMA.XD.]

"On that gaming pc you use to watch youtube" Never felt so called out before lmao

[@robindenkik]

5:38 maybe blur these codes lol (unless you generated new ones)

[@pizzabossxd]

was about to say that lol

[@TheDragonmasterk]

Yeah, seriously please generate new ones

[@ishid_anfarded_king]

it looks like a burner account anyway he wouldnt have lost anything valuable lol

[@CaptOfWolves]

Throw away account

[@wojtekpolska1013]

5:38 uh oh you just showed your backup keys publicly on youtube, this makes it so that anyone can login into your account now by using the backup keys to reset the passkey

[@BurgerChurger]

obviously he regenerated them lol

[@Blakegamer7000]

To be honest I stopped using Discord a few months ago because I just didn't feel safe on there I use better apps instead. But it is nice to see that they're finally adding precautions for this kind of stuff because my old old account got hacked years ago

[@TechnoMasterBoy]

Didn't feel safe? What are you sharing, military secrets or some shit? Get a good password, it's not hard to make one that's easy to remember AND secure. And don't be a brainlet clicking on every link and downloading every file someone sends you. If you get hacked, it's your own stupidity that's at fault.

[@hi-kt3qr]

Most of the time being hacked is your fault, you used a password that can easily be guessed

[@SolarizedPhoenix]

For those who just want ELI5 in security keys; The public key is used to encode a message to send to the private key owner. Discord sends your computer a specific question (Challenge) and your PC, with the private key, can read and answer this challenge.

[@killingtimeitself]

presumably through reverse pub key it would encrypt it and send it back, unless of course the challenge is non critical. not familiar with the specifics there.

[@erikkonstas]

@@killingtimeitself Not sure what you're saying, but I'm pretty sure that your "reverse pub key" is, in fact, the private key, which is *EXTREMELY* difficult to get from the public key (this is how all of cryptography works, make it DIFFICULT for the attacker to gain the key).

[@killingtimeitself]

i meant reverse pubkey as in reversing the direction of the transaction with another key set@@erikkonstas

[@schwingedeshaehers]

if you are interessed in it, and know "basic" (probably at least prime, modulo and Fields, and how they are (mathematically) connected) math/Crypto things, it is not that hard

[@thenextworstone9050]

3:54 Nice analogy!

[@elliejohnson2786]

I literally just completed a course on cyber security and it talks about these in great detail :D

[@bemsbilou]

I didn't know that scammers can now trigger and ask for 2FA through a fake login page. That's kinda scary. Nice analogy btw 👌

[@Khipher]

As someone who uses the flipper zero’s U2F feature as a security key for literally everything that I can possibly use it for, I see this as an absolute win (I just like using my silly little cybersecurity pentesting device)

[@kubaolszewski890]

It just dropped so have fun watching everyone

[@atake176]

It's such a discord moment. Implementing a log in method that prevents phishing, and leave a thing that is abused by scammers and bypasses your new secure method. God I love discord

[@markzuckerbread1865]

I feel like public-private key cryptography needs to be taught in every school these days, its something you use everyday and can benefit from understanding.

[@hi-kt3qr]

useless, not everybody is a geek

[@walkacrossit]

​@@hi-kt3qrinstead they're dumbasses that fall for scams like these

[@lzxty6024]

dad when are you coming home with the milk

[@petertrex]

Actually you can just use your PC's pin, which is pretty convivnient too.

[@watch_dog_genesis]

Although getting a security key would seem like a good idea, but let's look at it with different eyes: -it's another new way of putting smth private under a same lock and key with a master key held up by a creator of said lock and key; -you can add your phone/any gadget to that key, but if you lose it/ it gets stolen, you out of luck; -all it does is giving a minor setback to hackers, and once it gets passed, we have to think of new ways to secure data; All in all, all those security keys and such are for people who uses their account for business(or popular people, eg youtubers), there's no need for such things for normal people, all it does is gives you more paranoia with each new update for security measures. At the end of the day, a lock is there to keep an honest folk away, if you have a goal to bypass that lock, you will get it eventually.

[@schwingedeshaehers]

> At the end of the day, a lock is there to keep an honest folk away, if you have a goal to bypass that lock, you will get it eventually. thats corrent in the "real" world, but not to that degree in the "virtual" world. there is crypto, that is mathematically secure at least for now, (takes trillion of years to crack)

[@souptaels]

Discord just needs to change their internal login system. They can add as many security options they want, but if someone is able to grab your login token (which is really easy to do btw), then it's over either way cause just having that token bypasses everything. Edit: apparently this is how most websites work, whoops. still sucks how easy it is to get tho

[@xE92vD]

this is how it is on every website. How do you think the website knows it is you.

[@souptaels]

​@@xE92vDit is? ahh didn't know that

[@Theinatoriinator]

Unfortunately, if they did that then you would have to constantly resign into discord. The reason the tokens exist is that you don't have to resign, and that is how every website works.

[@killingtimeitself]

@@Theinatoriinator we live in 2023 you can simply store that token in an encrypted form that is nearly impossible to crack. There is no good excuse for storing passwords and especially tokens in plain text.

[@souptaels]

​​@@killingtimeitselfexactly. I'm sure there's a way to encrypt it or something. If a slight technical person like me can just find it using the developer console and the token is just there in plain text, I don't think that's a good thing.

[@アイドル愛]

imo they should add password to mobile app like signal, face id touch id or just password for it to unlock

[@Milenakos]

have you considered just adding a password to your phone

[@Milenakos]

i mean i do understand more things make you feel more secure, this is the reason people pay thousands dollars a year for antivirus

[@ishid_anfarded_king]

who the fuck is paying thousands a year for a fucking antivirus thats a fucking scam@@Milenakos

[@アイドル愛]

@@Milenakosi have password and ID on phone it would be just more secure if you could use ID or password on app directly. When someone borrows your phone and there’s private messages, you know what i mean

[@Lucaplayz200]

Nice analogy now hopefully your self esteem is better

[@patrikcath1025]

Aw yeah, now instead of 2FA (bad) I can use 2FA (good)!

[@Vlame]

I reported like 6 websites and a Discord server who has this phishing method. the discord server got deleted but 2 hours later a new one was created with the same name and invite link. This method was also done using a fake captcha bot. Unfortunately Discord doesn't do anything about it

[@Heufneutje]

This is kinda cool but also kinda useless unless Discord starts requiring 2FA more. I found out the hard way that if your login token gets hijacked from your PC Discord will just let someone use that token to change the email address on your account without requiring you to reauthenticate.

[@Heufneutje]

@@VaultCord To be fair, I'd argue that changing your email address on your account should be inconvenient seeing how commonly it's abused by scammers to lock someone out of their account.

[@BasicsCodingg]

"on that gaming computer you use to watch youtube" i dont like how accurate this is

[@SyncronedStuff]

I hope they are doing something like Roblox's announced "ROBLOSECURITY", which makes logging in via a cookie useless.

[@aceofaces]

Quick tip: Windows 11 has the option for a device as a passkey on Windows Hello. You can pick that option and enroll the phone's passkey. It will even remember your phone to quickly pick it as an option.

[@user-ed4ql5ky8m]

For the people that don't have devices with biometric lock features, you can use your Windows PIN as well if your logged into your Microsoft account

[@Strudlll]

Bros catchphrase is we'll talk about that later

[@MoonLightOfficialOwO]

I love your vids! Keep it up, please, and I hope you're taking care of yourself :D nice analogy 💗

[@sawrams]

with windows hello you also can use pin code to make security key, did that myself on my youtube- i mean gaming laptop

[@cam4991]

They should’ve added this years ago. People have been asking for security key support for a really long time

[@faddybasilisk09]

Nice analogy mg 💪💪

[@abbatrombonelol]

The best security system is and always will be yourself

[@Lampe2020]

5:38 I hope you changed those after the video, because I think you shouldn't share your backup keys with the internet…

[@NorthWARail]

I just had my account hacked two days ago i got it back yesterday because discord surprisingly responded in a matter of 1 hour and ik trying to reactivate 2FA but it wont let me. Should i just do the security key thing?

[@ecdragonlady8006]

0:30 BRO JUST CALLED ME OUT LMAO 😭😭😭💀💀💀

[@OneAndOnlyZekePolaris]

At 7:30 but that is with every business and phone app devs. Look at what phone apps ask permission for without telling you what permissions are needed.

[@bk_bro11]

Actually not that bad of an analogy. I assume you were explaining hashing and if if you were you explained it almost perfectly.

[@nclsDesign]

Hint about the 2FA code on your phone: You don't have to wait for the new code. You can type in the old one and it will still accept the previous one, even if your authenticator already refreshed the code.

[@beanbeanjuice]

I'm gonna need to do this for my rotisserie chicken later...

[@EnBunk]

A naked man fears no pickpocket.

[@lucas13w]

me when security key

[@ThatOneNo-Name]

Made security key. Thanks NTTS. Nice analogy btw.

[@Raaaton]

Bro, at 5:39 you showed your backup codes !

[@clipbitlocker]

3:22 General Security Keys are not easier because of Fingerprints and Face make life hard. Especially when some security expert enforces them ... then realizes he has 100 computers in the workplace that cannot use camera by law or don't have a finger print reader because those are expensive.

[@clipbitlocker]

@@VaultCord agreed about USB and YUBI keys (japanese versions). I wish they were more popular in the united states. Final Fantasy actually requires them in Japan. Its just commented because I am worried that someone won't watch the entire video where he covers the better methods.

[@Toiletman34]

4:28 pov it’s a prime number ☠️ (for those of you who don’t know what a prime number is it’s a number only eqaly divisible by 1 and it’s self)

[@Libur_kun]

4:30 makes me feel like im storing all the nuclear codes on my discord account

[@GeneTv]

nice anology. Another way of explaining this is that a public key is like a picture of your signature (you know how it looks like but not how to create it). Your private key is the path which the pen will go when writing your signature. Now, when you log in to a website that you created the key-pair for, the website will send you a unique challenge (basically a text) every time you log in. When using your biometrics, you allow the browser to use your private key to create a signature. The browser sends back the challenge text with the signature and the website verifies that it's the correct challenge with your correct signature. Even if someone would be able to capture the signed challenge text, they would not be able to use it a second time, since the challenge is different each time. Also, scanning that passkey qr code (not the Discord one) with your phone, doesn't sent the actual private key to the computer. Your phone connects via bluetooth, get's the challenge from your computer, uses the private key which is stored on your phone, signs the challenge and sends back the signed challenge to the computer so that the computer can send it back to Discord.

[@Original_Pedi_Boy]

in South Africa, i have my Sim Swap set up with my provider that i have to go to my provider store and pysically be present to perform a sim swap, cant be done on the phone and you have to have my physical ID

[@Shakkael]

I understood that great analogy very well! Good job!

[@RealCreepaTime]

LOL "Your stupid (Question mark?)"

[@vodkacsaa]

u did not forget to regenerate ur 8 character security codes right?

[@harryhack91]

I would like to point out that the stronger a security mechanism is against remote attacks, the weaker it is against physical ones. So, imagine you follow the Microsoft trend of going passwordless and use a hardware key instead. Now that key gets stolen... Opsie! Please, don't go passwordless, and use a password manager.

[@guy-]

I love how the only people that will use this are server staff and KZbinrs

[@Yuusharo]

I am neither, and I have passkeys setup on every website that offers them.

[@Y.O4]

True lmao

[@thrumbo]

security conscious and tech savy people will probably use this or the other 2fa option.

[@Ruxian]

jokes on you i have an industrial grade fingerprint reader configured to my pc

[@Kyoya26]

Yubikeys are so expensive in my country so, i'll have to pass this 😔

[@OneAndOnlyZekePolaris]

Yeah,,,, that SIM card thingy is old news. That is why my first phone has a slot for them but it does not have a SIM card in it. They are not even required the phone companies are just dumbing down security and installing malware anyways via remote.

[@ccgm_harpy]

I've had a yubico key for a while, happy Discord finally added support. Now my bank needs to get on board!

[@TheAnimeLurk]

At first I was mad at being called out with the gamer pc to watch youtube, but then I was able to put him in his place as I logged in using my webcam with Windows Hello. Thanks for the tip!

[@LoveMeKnot]

when you found out you still not safe 😅

[@mihai.ro09]

Hey man I discovered you and I really like your content I’m going to subscribe to you man I really enjoy your content

[@CZghost]

I find it funny you plugged in the "pi" in the number slot :D That's not gonna produce an integer, nope. :D

[@sams_enfp]

The floor function: Am I a joke to you?

[@ggorg0]

Just wanna say, that if you use the discord desktop app it will not pop up the QR code for your phone

[@frogybot]

MAN I *LOVE* sticking till the end! I get my hugs and kissies :3

[@klaas_music]

I hope he regenerated the backup codes.

[@Vantlic]

it wouldnt matter they would still need his email

[@irisbaggins]

Oh, this made me realise I had sms on, which I THOUGHT I'd turned off. Thanks for reminding me :)

[@Stoned_Penguin]

your outro is hella weird but the content is too good to have a sweet kiss scare me away... 😘

[@CZghost]

I'm actually thinking of getting myself the Yubi physical USB security key. Honestly it's just a stick I can wear on my keys, and whenever I need to use it, I can just pull the keys out of my pocket, or simply just grab them off a shelf and insert it into the PC. I wear my keys almost all the time on myself. So it makes sense to put it on my keys. I have never lost my keys, there's of course the risk of that, but it's very low. Unless I get really drunk, the chance of losing my keys is next to zero.

[@kaedenmurphy9937]

Yeah, that's fair. It's still good to have peace of mind though, because the one day in your life that you *do* lose or damage your keys could be a very bad day if you lost access to all of your accounts.

[@b1oodzy]

Imagine we had a generation that was actually smart and never fell for scams. I honestly can't.

[@markopolo13245]

its called people that were born in the 90s

[@Yuusharo]

Falling for scams has little to do with your intelligence. Often times, its folks who think they're smart about scammers and confident they could never be scammed that they're ironically more susceptible to be scammed. No one is born with inherent knowledge, and everyone has a bad day.

[@dogenjoyer]

keep dreaming li'l boy

[@影-銀]

already using it

[@DerpBurgerPlayz]

nice analogy

[@nikowolfbilger]

nice analogy mate!

[@MawdyDev]

I was considering cracking into NTTS's account as a meme (I didn't intend on keeping it obviously) because he forgot to censor his 2FA backup codes, just to say to one of his friends "hey NTTS forgot to censor his backup codes in his latest video so I reset them for him, logging out now" but I don't want to get on Discord's bad side just because I wanted to do a little chaotic good memery. Hey NTTS, reset your backup codes!

[@BenieTheDragon]

4:57.. What if you use Firefox? I get no popup.

[@fweeVODs]

5:40 I'd highly recommend generating new backup codes if this isn't an alt account...

[@DrSoftPawbs]

Gonna use my old Amazon staff yubi key for this

[@IsodzKing]

3:49 is where I laugh the most, must be what he’s saying.

[@XdekHckr]

1:47 Yeah but if you stole someone password and then run it on scam server and paste into real discord website or embed real discord website into scam website then it might be possible to stole token!? 2:05 Google authentication codes are stored in google account cloud as well 3:20 just use windows pin

[@anna.8._.8]

nice analogy

[@lowwastehighmelanin]

EFFING FINALLY. I admin several servers I needed this ages ago.

[@joshuan.]

NTTS: Yubikeys My last braincell: Heh heh, yubi yubi!

[@meibear4921]

my brother has a passkey and he usually uses this with discord and that feature was there for him for like 2 months

[@erinalasacarina]

what a wonderful analogy

[@123SweetJP]

3:20 you said gaming laptop like a slur... feelsbadman...

[@rkw9z]

except for the fact tokens allow anybody to login no matter how much protection..

[@Frostulv]

Be aware that Windows does not sync your passkeys to your Microsoft account! Also the scam sites know they get flagged by browser so they keep geting new domains all the time. So don't expect your browser to save you, the example is just poorly explaining this that is was an old scam link. New scams are probably not flagged yet.

[@ttaylor-st]

Damn. Literally just migrated away from Discord and they rolled out this cool update... hopefully the Matrix team is working on this, haven't seen any issues/prs though.

[@Dvance]

I haven't fact-checked this but... I think that if someone's worried about scams or getting scammed... they won't, or are less likely to get scammed.

[@depressedraccoon]

nice analogy mate