AllBugsFeaturesChangelogSearchNew post
Sign in with Fluxer
Features

Dangerous OAuth scopes

(#1454) Feature Under consideration api security
by tempest:squll.fartcore.ai originally by @HellishBro on GitHub

Current problem

Discord has an OAuth scope called "join servers for you", and it allows apps to join servers for you. While this is a scam hazard, it is also an important scope and not all uses of it are malicious. Discord also doesn't really do a good job of communicating that this scope may be dangerous.

Proposed change

I propose that Fluxer add "dangerous scopes", AKA, scopes that require an elevated permission level "sudo mode" to authorize. This will be the same pop-up modal as changing password or deleting account. Then, alongside this, Fluxer could add a "join communities for you" scope that apps could use.

Additional information

Fluxer could also add a "send message as you" scope too. Risk of scammy / spammy, but there could be benevolent use cases, and furthermore, the sudo mode should discourage most scammers or malicious actors.

7 comments

Sign in with Fluxer to comment and vote.
Comment by @AvaLilac
RexSystem 1 vote originally by @AvaLilac on GitHub 1 reply
This has good uses yes but due to the sheer amount of people who use it for bad. I honestly dont think it should be given a chance., Im also like 99% sure fluxer doesn't even support apps, And the send message as you just feels wayy to dangerous and i feel it should never be added. but it could help for things like plural bots
Permalink
Comment by tempest:squll.fartcore.ai
tempest:squll.fartcore.ai 1 vote originally by @HellishBro on GitHub OP
fluxer does support apps, like bots or sso. as for the send message suggestion i mainly did it because of my proxy bot but it could have beneign uses. oauth is way safer than running a userscript too so theres that
Permalink
Comment by @sarthaksinha363
RexSystem 1 vote originally by @sarthaksinha363 on GitHub 2 replies
As long as even the users who like to just click buttons without giving anything a thought are made aware of that these perms are being activated on their account i guess...
Permalink
Comment by @PilkeySEK
RexSystem 1 vote originally by @PilkeySEK on GitHub
Maybe have a "swipe to continue" instead of just a button (maybe that doesn't actually work, idk)
Permalink
Comment by @PilkeySEK
RexSystem 1 vote originally by @PilkeySEK on GitHub 1 reply
I think "send messages as you" is problematic to add, even if there is a warning and the sudo mode requirement, because you don't know whether someone actually said something or if it was a bot doing that through the OAuth scope
Permalink