429
submitted 1 year ago* (last edited 1 year ago) by sunaurus@lemm.ee to c/lemmy@lemmy.ml

I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.

Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!

This isn't to say that any current Lemmy app developers are for sure out to get you, but at this point, it's quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!

you are viewing a single comment's thread
view the rest of the comments
[-] Vlyn@lemmy.ml 62 points 1 year ago

Sorry, but that's literally every online service. For example if you buy a new virtual server it takes like 5 minutes till a Chinese IP starts to try root passwords.

If someone actually wanted to harm Lemmy they'd just DDOS the biggest instances for a month (which would be easy, it's mostly single servers after all) or attack it with so much spam and large images that storage would break.

[-] OtakuAltair@lemm.ee 10 points 1 year ago* (last edited 1 year ago)

We need moderation tools

Here's hoping Sync and Boost lead the way

[-] grue@lemmy.ml 13 points 1 year ago

Here's hoping Sync and Boost lead the way

Or better yet, let's hope Free Software apps lead the way and ditch the proprietary ones.

[-] OtakuAltair@lemm.ee 3 points 1 year ago

Well, Sync and Boost were well established already. It's probably gonna take some time for the new foss ones to catch up

[-] steltek@lemm.ee 2 points 1 year ago

I'm getting CS-nerd excited about how this is all going to play out. Federated moderation is hard and so many awful, clunky things have been tried before. Are we actually going to see a web-of-trust or reputation system that reaches widespread adoption? It's gotta be silent and noninteractive as there's no way to expect normal people to put up with the complexity.

[-] bfr0@lemmy.world 5 points 1 year ago

The difference is that when you buy a vps you aren't handing over all your access creds to random developers.

And "harming lemmy" may be an intent that sparks a DDoS but there are other intentions that should make users wary. Harvesting creds of people who reuse passwords across accounts is an easy example that could have more serious implications to the individual user.

[-] Vlyn@lemmy.ml 6 points 1 year ago

Dude, you can't trust any Lemmy instance at all. It doesn't even matter that the code is open source, the instance owner could just compile their own version that sends them every password in plaintext. There is zero guarantee that your password is safe.

Anyone who reuses passwords has been pwned a dozen times already. Just check your own logins here: https://haveibeenpwned.com/

If you reuse passwords online you have a problem, it's simple as that. Even big companies had breaches that leaked user data, no company is safe. For example one of my old passwords got stolen from Adobe. One from Unreal Engine. And my old logins are currently shared in 2,844 separate data breaches. Not using a password manager with a random password per service nowadays is madness.

this post was submitted on 11 Jul 2023
429 points (96.5% liked)

Lemmy

11948 readers
82 users here now

Everything about Lemmy; bugs, gripes, praises, and advocacy.

For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.

founded 4 years ago
MODERATORS