My understanding is that the .deb install (and any 1st party install from a package manager) is the most invasive install from a privacy perspective. By default, package managers basically assume that since you installed the software, you are OK w/ anything it is doing behind the scenes w/ user files.
Things that it could (potentially) access include:
- Read your SSH keys (could be great for fingerprinting you)
- Monitor what files you’re working on
- Read your bash history
- Access browser cookies/sessions
- See what other apps you’re running
First Party Package Manager installs are (IMO) best for packages that you trust, and everything else should be containerized via Flatpak/Firejail/Snap/Docker etc.
Personally I use webcord since it has a focus on privacy/security and is popular. From their GitHub readme, here is their approach on privacy:
WebCord does a lot to improve the privacy of the users. It blocks known tracing and fingerprinting methods, but it does not end on it. It also manages the permissions to sensitive APIs like camera or microphone, sets its own user agent to the one present in Chromium browsers and spoof web API modifications in order to prevent distinguishing it from the real Chrome/Chromium browsers.
And here is their info on security:
WebCord cares a lot about your security. Being fully written in TypeScript, it brings the power of static types to help detecting common bugs without the need of testing the app at runtime. All of this is hardened by ESLint, which forbids some TypeScript practices like the use of any type and enforces some cosmetic aspects of the code to keep it more consistent.
Unlike the official Discord client, WebCord’s policy about Electron also makes it to use the latest major release currently supported and available at the package time. This makes WebCord use more up-to-date Electron releases with more recent Chromium engine.
Built on top Electron and Chromium, WebCord’s security is also highly dependent from Chrome’s vulnerability rewards program, which is probably one of the most known programs like this when comparing to different popular browser engines choices. Electron is also well-prepared for loading remote content, using their process model to the advantage and different Chromium sandboxing techniques to split Node.js from browser scripts. WebCord also tries its best to follow practices from the Electron#Security.
(A 3rd party app may not be ideal for certain threat models FYI)
I actually use a .deb install of webcord, but I also use firejail’s discord profile (and the --private /path/to/folder flag) to reduce some theoretical-but-possible security/privacy concerns of a 3rd party app. Firejail is a big rabbit hole though as a heads up.
My suggestion is to pivot away from the official .deb app and either troubleshoot the official app’s flatpak (or try webcord’s flatpak) and cross-reference flatseal to limit its theoretical scope as a safety precaution.
