429
submitted 1 year ago* (last edited 1 year ago) by sunaurus@lemm.ee to c/lemmy@lemmy.ml

I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.

Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!

This isn't to say that any current Lemmy app developers are for sure out to get you, but at this point, it's quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!

you are viewing a single comment's thread
view the rest of the comments
[-] T156@lemmy.world 37 points 1 year ago

Although it is worth noting that the recent Lemmy hack didn't come from a password compromise, but from session token harvesting, which a password change would not really protect against.

[-] killbot_gamma@midwest.social 4 points 1 year ago

Forgive me if I'm mistaken, but wouldn't logging out of the compromised session be all it would take to end the attack in this case?

[-] sudo@lemmy.fmhy.ml 13 points 1 year ago

Only if logging out actively invalidates session tokens, which appears to have not been the case. https://github.com/LemmyNet/lemmy/issues/3364

this post was submitted on 11 Jul 2023
429 points (96.5% liked)

Lemmy

11948 readers
39 users here now

Everything about Lemmy; bugs, gripes, praises, and advocacy.

For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.

founded 4 years ago
MODERATORS