429
submitted 1 year ago* (last edited 1 year ago) by sunaurus@lemm.ee to c/lemmy@lemmy.ml

I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.

Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!

This isn't to say that any current Lemmy app developers are for sure out to get you, but at this point, it's quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!

top 50 comments
sorted by: hot top controversial new old
[-] sunaurus@lemm.ee 145 points 1 year ago
load more comments (3 replies)
[-] slazer2au@lemmy.world 74 points 1 year ago

This is why password managers are so heavily pushed. Imagine if you used the same password for Lemmy that you used for your email? Both are now compromised. A unique password for all accounts is the bare minimum you must do.

[-] T156@lemmy.world 37 points 1 year ago

Although it is worth noting that the recent Lemmy hack didn't come from a password compromise, but from session token harvesting, which a password change would not really protect against.

load more comments (2 replies)
[-] flames5123@lemmy.world 13 points 1 year ago

Lol this is not how the hack worked. JWT cookies are encrypted. They don’t contain your password at all. There was no way to reverse engineer from your cookie to your password.

load more comments (4 replies)
[-] Speculater@lemmy.world 6 points 1 year ago

I literally just got one last week. It's so nice! I guess I was hesitant because centralized passwords always put me off, but it's not hard to setup 2FA on all your important stuff.

load more comments (1 replies)
[-] Vlyn@lemmy.ml 62 points 1 year ago

Sorry, but that's literally every online service. For example if you buy a new virtual server it takes like 5 minutes till a Chinese IP starts to try root passwords.

If someone actually wanted to harm Lemmy they'd just DDOS the biggest instances for a month (which would be easy, it's mostly single servers after all) or attack it with so much spam and large images that storage would break.

[-] OtakuAltair@lemm.ee 10 points 1 year ago* (last edited 1 year ago)

We need moderation tools

Here's hoping Sync and Boost lead the way

[-] grue@lemmy.ml 13 points 1 year ago

Here's hoping Sync and Boost lead the way

Or better yet, let's hope Free Software apps lead the way and ditch the proprietary ones.

load more comments (1 replies)
load more comments (1 replies)
load more comments (2 replies)
[-] starman@programming.dev 37 points 1 year ago* (last edited 1 year ago)

Using open source apps, especially with more than one contributor, is currently the best option to be safe from this kind of attack.

Edit: I'm not saying that FOSS is 100% secure because it's FOSS. I'm just saying it's the best option we currently have.

[-] sunaurus@lemm.ee 46 points 1 year ago

It helps, but it's still not a silver bullet. For example, a Lemmy app could contain no malicious code in its open source repository, but malicious code could still be added to a binary release in an app store.

[-] similideano@sopuli.xyz 8 points 1 year ago

Voyager (formerly wefwef) is a self-hostable web app, so it doesn't have this problem. Of course this only means you can inspect the code you're running. You still have to able to understand the code to be sure it's not doing anything malicious.

load more comments (2 replies)
[-] grue@lemmy.ml 6 points 1 year ago

That's why F-Droid is the safest Android app repository. If I'm not mistaken, every app they offer is rebuilt from the public source code by the repo package maintainer.

load more comments (4 replies)
[-] Dark_Arc@lemmy.world 30 points 1 year ago

The safest option would be for Lemmy to implement OAuth and apps that aren't in some "official front end for xyz website mode" to authorize via OAuth with the backend instead of via credentials.

[-] csolisr@communities.azkware.net 10 points 1 year ago

Most if not all Mastodon/Pleroma apps already use OAuth by default. I'm surprised that Lemmy hasn't implemented it yet. I wonder if KBin does already?

[-] Aurix@lemmy.world 22 points 1 year ago

No, because open source apps need to have enough eyes on them to spot malicious code. And highly complex ones need proper audits and even that might not be enough to catch every fancy vulnerability.

[-] Fisch@lemmy.ml 8 points 1 year ago

I doubt a malicious actor would open source their app tho

[-] TheSaneWriter@lemm.ee 8 points 1 year ago

That's fair, but sometimes a malicious actor will attempt to covertly contribute code that introduces a security vulnerability.

load more comments (2 replies)
[-] PeleSpirit@lemmy.world 6 points 1 year ago

How can an idiot like me tell though, everything is pretty new. I just assume every account I make is a throwaway for now.

load more comments (2 replies)
load more comments (3 replies)
[-] poVoq@slrpnk.net 26 points 1 year ago

Oauth2 login support for apps would certainly be very welcome.

load more comments (1 replies)
[-] Juzexo@lemmy.world 24 points 1 year ago

My lemmy account is made with a throwaway email and with a randomly generated password just in case it ever gets leaked

[-] dandroid@dandroid.app 7 points 1 year ago

I didn't even attach an email to mine.

load more comments (2 replies)
[-] eating3645@lemmy.world 17 points 1 year ago

Thanks for the heads up. My password is %f22N$CBTNgW, can you let me know if it was leaked?

[-] naught@sh.itjust.works 13 points 1 year ago
[-] rcmaehl@lemmy.world 13 points 1 year ago

What is it? I only see ******. I think Lemmy is hiding personal info now.

load more comments (1 replies)
[-] Toribor@corndog.uk 8 points 1 year ago

Pretty funny but if you enter you actual password it will hide it. My pass is ************, which should show up as asterisks for you.

Try it out. Pretty cool security feature honestly.

[-] trouser_mouse@lemmy.world 6 points 1 year ago

We need your full name, date of birth and zip code to check

load more comments (1 replies)

I am using the Liftoff app. It looks pretty safe but I don't really know.

[-] Fisch@lemmy.ml 10 points 1 year ago

It's open source and pretty popular (for a Lemmy app at least) so it should be pretty safe

[-] ChaosCharlie@lemmy.ca 8 points 1 year ago

Are there any known apps that should be avoided? I’m using Mlem and Memmy.

[-] Fisch@lemmy.ml 8 points 1 year ago

Not yet, this post is just a warning that it might happen

[-] Efwis@lemmy.zip 6 points 1 year ago

Not sure about the other apps, but Memmy keeps your password stored in the app. But generally speaking I don’t think Gavin is a malicious person. He spent 3 weeks with beta tests before he was even comfortable pushing it to Apple App Store and the code is reviewed by Apple before being included to watch for malicious scripting. I am not saying people don’t get malicious scripts passed through Apple, but from what I have seen of Gavin’s work, he doesn’t seem the type that would do that.

load more comments (5 replies)
[-] spacedancer@lemmy.world 8 points 1 year ago* (last edited 1 year ago)

Me reading this post on an alpha app on testflight: chuckles I’m in danger.

Kidding aside, I used a dedicated email (and password) for my account and don’t plan to post any personal info on here.

[-] TheSaneWriter@lemm.ee 8 points 1 year ago

Indeed, this is a real weak spot with Lemmy's security. I honestly think we need to place more emphasis on implementing OAuth2, when I have the time I'll have to take a look at that again to see if I'm able to.

[-] cooljacob204@kbin.social 8 points 1 year ago

1password is probably the most valuable subscription I pay for.

[-] pizzahoe@lemm.ee 20 points 1 year ago

If anyone's looking for a free and open source option, Bitwarden is also great.

load more comments (4 replies)
[-] lowleveldata@programming.dev 16 points 1 year ago

KeePassXC is free and completely offline

load more comments (2 replies)
[-] maegul@lemmy.ml 6 points 1 year ago

Thanks for this!!

I feel like it raises somewhat the general issue of how much we're willing to live with complete mysterious anonymity from all of the developers and admins in the fediverse. I'm not saying that every admin or developer should have their real identity revealed and linked here. But there's a tension or issue here in how much it's normal and accepted and how much the fediverse in general wants to grow and attract users that are accustomed to trusting large companies that provide a different kind of base level trustworthiness than makes sense "out here".

If not links to real life identities (however trustworthy that can be in the limit), at least some connection to a broader online presence such that it becomes more likely the actor has something to lose in acting in bad faith (the lemmy core devs being a good example).

I don't have a solution ... but it seems to be a growing pain as this whole thing kind of grows from "hacker project" to "mainstream social media".

[-] Vlyn@lemmy.ml 5 points 1 year ago

The solution has been the same for the last 20 years: Use a password manager, do not reuse passwords. That's it, you're done.

Even if the Lemmy instance admin steals your password (which would be easy!) they can't do anything with it.

[-] Coopa@lemmy.world 5 points 1 year ago

What about the app Memmy for iPhone ?

[-] dismalnow@kbin.social 6 points 1 year ago

Preface: I have no opinion. Have not installed, and will not install because I don't need it.

If you have to ask, it's probably worth investigating further.

The first thing I would do is search around for any mention of the app name and variants on the word "password".

Never install anything that you don't trust, and dissociate from your "real" email/identity for those that you aren't sure about. Whoever owns the software potentially owns your credentials.

load more comments (6 replies)
load more comments
view more: next ›
this post was submitted on 11 Jul 2023
429 points (96.5% liked)

Lemmy

11948 readers
21 users here now

Everything about Lemmy; bugs, gripes, praises, and advocacy.

For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.

founded 4 years ago
MODERATORS