With the recent hack, there is now irrefutable proof of malicious actors trying to break Lemmy and steal user accounts. Please be careful about entering your password into random Lemmy apps!

I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.

Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!

This isn’t to say that any current Lemmy app developers are for sure out to get you, but at this point, it’s quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!

puffy,

Apps are bloated(they store a lot of cache on the disk) , just use the website.

nix,
@nix@merv.news avatar

The greatest part of Bluesky/atProtocol vs ActivityPub is that they let you sign in to one account on any service on the protocol and it requires you to make separate app passwords.

Users getting invite codes every X weeks is nice for the server the require registration too

Vlyn,

Sorry, but that’s literally every online service. For example if you buy a new virtual server it takes like 5 minutes till a Chinese IP starts to try root passwords.

If someone actually wanted to harm Lemmy they’d just DDOS the biggest instances for a month (which would be easy, it’s mostly single servers after all) or attack it with so much spam and large images that storage would break.

OtakuAltair,

We need moderation tools

Here’s hoping Sync and Boost lead the way

grue,

Here’s hoping Sync and Boost lead the way

Or better yet, let’s hope Free Software apps lead the way and ditch the proprietary ones.

OtakuAltair,

Well, Sync and Boost were well established already. It’s probably gonna take some time for the new foss ones to catch up

steltek,

I’m getting CS-nerd excited about how this is all going to play out. Federated moderation is hard and so many awful, clunky things have been tried before. Are we actually going to see a web-of-trust or reputation system that reaches widespread adoption? It’s gotta be silent and noninteractive as there’s no way to expect normal people to put up with the complexity.

bfr0,

The difference is that when you buy a vps you aren’t handing over all your access creds to random developers.

And “harming lemmy” may be an intent that sparks a DDoS but there are other intentions that should make users wary. Harvesting creds of people who reuse passwords across accounts is an easy example that could have more serious implications to the individual user.

Vlyn,

Dude, you can’t trust any Lemmy instance at all. It doesn’t even matter that the code is open source, the instance owner could just compile their own version that sends them every password in plaintext. There is zero guarantee that your password is safe.

Anyone who reuses passwords has been pwned a dozen times already. Just check your own logins here: haveibeenpwned.com

If you reuse passwords online you have a problem, it’s simple as that. Even big companies had breaches that leaked user data, no company is safe. For example one of my old passwords got stolen from Adobe. One from Unreal Engine. And my old logins are currently shared in 2,844 separate data breaches. Not using a password manager with a random password per service nowadays is madness.

spacedancer, (edited )

Me reading this post on an alpha app on testflight: chuckles I’m in danger.

Kidding aside, I used a dedicated email (and password) for my account and don’t plan to post any personal info on here.

nekat_emanresu,

Is this a password manager ad?

Melatonin,

Trying to break Lemmy, yeah, let’s prosecuted those bastards, but… WHAT. COULD. BE. MORE. WORTHLESS. than my account?

You are welcome to the scintillating points I have made. Bask in their brilliance.

WhoRoger,
@WhoRoger@lemmy.world avatar

I’ve been wondering that myself. I’ve only entered my pw into Jerboa, which is made by the Lemmy devs (and Liftoff once, but changed the pw since).

Now I only ever use FOSS apps, which all seem to be under some amount of scrutiny, but idk how much is enough.

I’ve always been particularly wary of Voyager/wefwef. Not that I wouldn’t trust the devs, but the whole concept of entering a password into a 3rd page that only passes it onto the right page, damn that’s just dumb on principle.

It’s particularly weird since this is home for so many techies and privacy/security advocates.

TheSaneWriter,

All of the apps have you enter your credentials into their page because Lemmy doesn’t support OAuth2. I don’t think it’s fair to criticize Voyager for a problem that is currently inherent to all Lemmy apps.

WhoRoger,
@WhoRoger@lemmy.world avatar

Yea but it’s a local form on the device and not a 3rd party server, which is another layer of insecurity. And I’m not sure how much of the rest of communication needs to get proxied too.

I dunno, that’s just way beyond my comfort zone unless I really want to self-host that stuff.

Anyway, okay, nothing seems to be all that well secure at this point.

similideano,

Its less dumb than entering it into a regular app compiled into an apk, which is more opaque (even if it’s also FOSS). Voyager you can host it yourself.

WhoRoger,
@WhoRoger@lemmy.world avatar

You can compile the app code yourself too.

similideano,

Sure. Both compiling your own apk or self-hosting are ideal. If you’re not doing either though, the web app is more easily inspectable.

SpaceMonk,

Is Memmy for Lemmy safe?

TheSaneWriter,

As much as any other app I’ve seen, but I would still recommend using unique credentials for Lemmy.

bootyberrypancakes,

If you use push notifications you have to give the developer your access token, that could be stolen if the push server is hacked

Vlyn,

Nothing is safe.

Use a password manager and a unique random password for each service you sign up with. It’s the only way to protect your accounts.

TheSaneWriter,

Indeed, this is a real weak spot with Lemmy’s security. I honestly think we need to place more emphasis on implementing OAuth2, when I have the time I’ll have to take a look at that again to see if I’m able to.

eating3645,

Thanks for the heads up. My password is %f22N$CBTNgW, can you let me know if it was leaked?

naught,

pls also check hunter2

eating3645,

I’ll keep an eye out 👀

rcmaehl,
@rcmaehl@lemmy.world avatar

What is it? I only see ******. I think Lemmy is hiding personal info now.

TheSaneWriter,

I’ll make sure to let you know if I see it anywhere.

trouser_mouse,
@trouser_mouse@lemmy.world avatar

We need your full name, date of birth and zip code to check

Toribor,

Pretty funny but if you enter you actual password it will hide it. My pass is ************, which should show up as asterisks for you.

Try it out. Pretty cool security feature honestly.

TurtleTourParty,

hunter2

poVoq,
@poVoq@slrpnk.net avatar

Oauth2 login support for apps would certainly be very welcome.

sheodox,
@sheodox@lemmy.world avatar

I really want this. I haven’t tried any of the apps (other than the one I made) yet because I don’t want to give anyone my password. Oauth support would be so nice.

maegul,
@maegul@lemmy.ml avatar

Thanks for this!!

I feel like it raises somewhat the general issue of how much we’re willing to live with complete mysterious anonymity from all of the developers and admins in the fediverse. I’m not saying that every admin or developer should have their real identity revealed and linked here. But there’s a tension or issue here in how much it’s normal and accepted and how much the fediverse in general wants to grow and attract users that are accustomed to trusting large companies that provide a different kind of base level trustworthiness than makes sense “out here”.

If not links to real life identities (however trustworthy that can be in the limit), at least some connection to a broader online presence such that it becomes more likely the actor has something to lose in acting in bad faith (the lemmy core devs being a good example).

I don’t have a solution … but it seems to be a growing pain as this whole thing kind of grows from “hacker project” to “mainstream social media”.

Vlyn,

The solution has been the same for the last 20 years: Use a password manager, do not reuse passwords. That’s it, you’re done.

Even if the Lemmy instance admin steals your password (which would be easy!) they can’t do anything with it.

sma3in,
@sma3in@lemmy.world avatar

it’s about time to change that password and i think lemmy team should have an option in the settings to revoke access we give to third party apps…not sure if that’s possible

corytheboyd,
corytheboyd avatar

Feels like this will be a very common occurrence with people rushing to build and use new apps, and host new servers. There are plenty of positives to fediverse vs centralized, but it doesn’t come without negatives.

cooljacob204,

1password is probably the most valuable subscription I pay for.

pizzahoe,

If anyone’s looking for a free and open source option, Bitwarden is also great.

nekat_emanresu, (edited )

You two have no idea do you? lol

When you pass your password into an app, it can just copy and store it. If at any point you put a password through, even once, its compromised and no password manager will help in the slightest.

I make bobApp, you download bobApp, if you put a password into it, you are done.

edit: answering both of you.

Then i misunderstood. After i typed this I noticed others said what you meant. My bad.

TheSaneWriter,

You’re correct, but by maintaining distinct passwords with a password manager you make sure only the one account is compromised. 2FA also helps, you may have the username and password, but the 2FA code that you were given needs to be used immediately or else it will expire, and an expired 2FA code won’t allow you to successfully breach the account you’re trying to break into to.

jiji,

I think their point is password managers make it very easy to have completely unique passwords, and if your Lemmy password is compromised you can change it without worrying about any other accounts being compromised. Not that a manager would magically protect you from ever being compromised.

pizzahoe,

I think you misunderstood us lol… we’re not saying your password will not get leaked by the app… we’re saying it’s gonna be unique and random bullshit generated so the hacker won’t be able to get to your other accounts since passwords are different.

lowleveldata,

KeePassXC is free and completely offline

steltek,

Also Password Store! Syncs over Git and on Android you can use a Yubikey so that the private key isn’t even on your phone.

But yes, KeePassXC is way more user friendly. Anything touching PGP/GPG is an automatic red flag for family.

grue,

And if you want it to be online, you can just share your .kdbx file between your computers using Syncthing or whatever.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • lemmy@lemmy.ml
  • GTA5RPClips
  • DreamBathrooms
  • thenastyranch
  • magazineikmin
  • ethstaker
  • osvaldo12
  • Youngstown
  • mdbf
  • slotface
  • rosin
  • ngwrru68w68
  • kavyap
  • normalnudes
  • cisconetworking
  • JUstTest
  • InstantRegret
  • khanakhh
  • cubers
  • everett
  • Durango
  • tacticalgear
  • anitta
  • modclub
  • Leos
  • tester
  • megavids
  • provamag3
  • lostlight
  • All magazines
    •