Lemmings Forum Discord

[GigaLem]

I have some pleasing news to tell everyone, I finally had the Discord ticket resolved, I have ownership of the server again finally. I apologize for how slow it is, not only does Discord have millions of servers to deal with, but I having to overcome my fears to get the ownership transferred. I'm very sorry for the wait. 2021 has taken a toll on me mentally and I've been needing to grasp some positive energy as of late.

[kaywhyn]

Hi everyone,

I apologize for all the spam messages on Discord. As you all know, they're asking to "test a game I made," which is clearly bogus and weren't sent by me. I managed to delete some of them before I got word from namida (with good intentions and for the protection of the LF Discord as he explained in his PM on the Lemmings Forums to me, so no offense taken there on my end, namida! ) that I got kicked from the server because I realized that the green LF logo on the left-hand side of Discord was no longer there for me and no messages would load up when I went to a different tribe. It didn't stop there, though. I also saw DMs of the same message going to the people who have a DM history with me on Discord. The most recent one I saw was around 3:30PM my time, about 40 minutes ago. Well, I just changed my Discord PW and enabled 2FA about 20 minutes ago. I'm wondering if this will be enough, or if I need to disable my Discord account as well. I would rejoin the LF server, but I will wait a few hours or so before doing so. Please let me know if the spam messages are continuing to appear and if they are, I will go ahead and disable my Discord account too.

I would had taken care of this sooner, but I was still at work at the time, and hence I wasn't at my PC. I could had simply handled it on my phone, but it's easier to do it all on a computer. In any case, I changed my Discord PW and enabled 2FA. I thought it was enabled before, but apparently not!

In the meantime, just to be safe I went ahead and changed my PW here on LF too

[namida]

Hi everyone,

I apologize for all the spam messages on Discord. As you all know, they're asking to "test a game I made," which is clearly bogus and weren't sent by me. I managed to delete some of them before I got word from namida (with good intentions and for the protection of the LF Discord as he explained in his PM on the Lemmings Forums to me, so no offense taken there on my end, namida! ) that I got kicked from the server because I realized that the green LF logo on the left-hand side of Discord was no longer there for me and no messages would load up when I went to a different tribe. It didn't stop there, though. I also saw DMs of the same message going to the people who have a DM history with me on Discord. The most recent one I saw was around 3:30PM my time, about 40 minutes ago. Well, I just changed my Discord PW and enabled 2FA about 20 minutes ago. I'm wondering if this will be enough, or if I need to disable my Discord account as well. I would rejoin the LF server, but I will wait a few hours or so before doing so. Please let me know if the spam messages are continuing to appear and if they are, I will go ahead and disable my Discord account too.

I would had taken care of this sooner, but I was still at work at the time, and hence I wasn't at my PC. I could had simply handled it on my phone, but it's easier to do it all on a computer. In any case, I changed my Discord PW and enabled 2FA. I thought it was enabled before, but apparently not!

In the meantime, just to be safe I went ahead and changed my PW here on LF too

For extra safety, you should hit the "log out on all devices" option (somewhere in Settings, I assume) too. This will invalidate any existing login tokens; as on Discord changing your password does not invalidate these.

Essentially, the login token can be thought of as an ID card that's given out to you once you prove your identity with the username / password (and if applicable 2FA). The exploit in question is, by extension, comparable to making a copy of an ID someone already has, rather than obtaining a new one under their identity. To keep the metaphor going, "sign out all devices" is like declaring "all existing IDs belonging to this person are now invalid, they must get new ones by signing in with their username / password / 2FA again".

[kaywhyn]

For extra safety, you should hit the "log out on all devices" option (somewhere in Settings, I assume) too. This will invalidate any existing login tokens; as on Discord changing your password does not invalidate these.

There's no "log out on all devices" button for Discord anywhere. Instead, all online articles I read simply say there are two methods to do so, change your password or enable 2FA, both of which I have done. However, I went ahead and logged out of both the Discord desktop app and the mobile app and logged back in. I can confirm that I need to input a code on both due to having 2FA enabled. Yes, it is a bit annoying to do so each time, as it slows down the login process, but it is ultimately a really good extra security measure

[namida]

Okay. I've lifted the ban now.

[Silken Healer]

kaywhyn! I am glad you got your account back!!!

[GigaLem]

Pasting from the Announcements Tribe

As of today, I have stepped down as the Server's Owner, As per his suggestion I'll be staying as a mod for now. Starting today IchoTolot is the new server owner. I decided to hand the Crown to him for my own mental health, thank you for your support during my tenure here as owner but it's time for me to move on.