I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.
Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!
This isn’t to say that any current Lemmy app developers are for sure out to get you, but at this point, it’s quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!
Do another one, replace the last panels “alpha Lemmy app” to “password manager” lol
edit: for the record I’m not disagreeing with the first comment in this comment chain.
How many password managers have you been trying out this week?
Sorry, but that’s literally every online service. For example if you buy a new virtual server it takes like 5 minutes till a Chinese IP starts to try root passwords.
If someone actually wanted to harm Lemmy they’d just DDOS the biggest instances for a month (which would be easy, it’s mostly single servers after all) or attack it with so much spam and large images that storage would break.
The difference is that when you buy a vps you aren’t handing over all your access creds to random developers.
And “harming lemmy” may be an intent that sparks a DDoS but there are other intentions that should make users wary. Harvesting creds of people who reuse passwords across accounts is an easy example that could have more serious implications to the individual user.
Dude, you can’t trust any Lemmy instance at all. It doesn’t even matter that the code is open source, the instance owner could just compile their own version that sends them every password in plaintext. There is zero guarantee that your password is safe.
Anyone who reuses passwords has been pwned a dozen times already. Just check your own logins here: https://haveibeenpwned.com/
If you reuse passwords online you have a problem, it’s simple as that. Even big companies had breaches that leaked user data, no company is safe. For example one of my old passwords got stolen from Adobe. One from Unreal Engine. And my old logins are currently shared in 2,844 separate data breaches. Not using a password manager with a random password per service nowadays is madness.
We need moderation tools
Here’s hoping Sync and Boost lead the way
Here’s hoping Sync and Boost lead the way
Or better yet, let’s hope Free Software apps lead the way and ditch the proprietary ones.
I’m getting CS-nerd excited about how this is all going to play out. Federated moderation is hard and so many awful, clunky things have been tried before. Are we actually going to see a web-of-trust or reputation system that reaches widespread adoption? It’s gotta be silent and noninteractive as there’s no way to expect normal people to put up with the complexity.
This is why password managers are so heavily pushed. Imagine if you used the same password for Lemmy that you used for your email? Both are now compromised. A unique password for all accounts is the bare minimum you must do.
Although it is worth noting that the recent Lemmy hack didn’t come from a password compromise, but from session token harvesting, which a password change would not really protect against.
Forgive me if I’m mistaken, but wouldn’t logging out of the compromised session be all it would take to end the attack in this case?
Only if logging out actively invalidates session tokens, which appears to have not been the case. https://github.com/LemmyNet/lemmy/issues/3364
Lol this is not how the hack worked. JWT cookies are encrypted. They don’t contain your password at all. There was no way to reverse engineer from your cookie to your password.
Correct me if I’m wrong, but Lemmys tokens have no expiration, right? So they are effectively username and password combined.
The decoding algorithm can change, which is exactly what happened, invalidating all previously generated tokens. They cannot be decoded to a password though since they are encrypted, meaning shared passwords wouldn’t be an issue (though you should use a password manager to not have this issue in the first place).
That’s not how tokens work. Tokens are (usually short-lived) credentials that are passed to a client after it authenticated e.g. with username + password. But the password is never contained in a token. They are also not encrypted, but signed, meaning the Lemmy instance can verify that the plain-text token ist authentic. Also, not the decoding algorithm has changed, but the signing key was rotated, meaning all JWTs created before the signing key rotation would not look authentic anymore
Right. I was simplifying it by saying it was encrypted, but it’s just an auth token from the service after verifying that the user is authenticated.
And correct. I’m just an idiot and didn’t do research to explain it, even though I’ve used JWT tokens in my applications before. Hahaha. Thanks for the detailed correction!
Using open source apps, especially with more than one contributor, is currently the best option to be safe from this kind of attack.
Edit: I’m not saying that FOSS is 100% secure because it’s FOSS. I’m just saying it’s the best option we currently have.
It helps, but it’s still not a silver bullet. For example, a Lemmy app could contain no malicious code in its open source repository, but malicious code could still be added to a binary release in an app store.
That’s why F-Droid is the safest Android app repository. If I’m not mistaken, every app they offer is rebuilt from the public source code by the repo package maintainer.
Yeah, downloading from fdroid or izzyondroid kinda solves that.
Izzy directly sends over the APKs from GitHub releases. F-Droid does their own builds which is partly why they’re so slow to update.
OSS does not guarantee security, ever. Please let’s not fall into false sense of security.I
But in this case, if an app is open source, there is a higher chance of discovering that it sends your credentials somewhere else than in closed source app
That assumes people are looking at that and know what they’re doing and aren’t malicious actors. None of this is guaranteed. Famous examples of major OSS security vulnerabilities have already shown this.
Oauth2 login support for apps would certainly be very welcome.
Me reading this post on an alpha app on testflight: chuckles I’m in danger.
Kidding aside, I used a dedicated email (and password) for my account and don’t plan to post any personal info on here.
Indeed, this is a real weak spot with Lemmy’s security. I honestly think we need to place more emphasis on implementing OAuth2, when I have the time I’ll have to take a look at that again to see if I’m able to.
The greatest part of Bluesky/atProtocol vs ActivityPub is that they let you sign in to one account on any service on the protocol and it requires you to make separate app passwords.
Users getting invite codes every X weeks is nice for the server the require registration too
Apps are bloated(they store a lot of cache on the disk) , just use the website.
Thanks for the heads up. My password is %f22N$CBTNgW, can you let me know if it was leaked?
Pretty funny but if you enter you actual password it will hide it. My pass is ************, which should show up as asterisks for you.
Try it out. Pretty cool security feature honestly.
hunter2
Are there any known apps that should be avoided? I’m using Mlem and Memmy.
It’s not about any specific app.
They are just using many words to say ‘remember logging in on these apps means giving them your full username/password.’
What about the app Memmy for iPhone ?
It’s not about any specific app.
They are just using many words to say ‘remember logging in on these apps means giving them your full username/password.’
This includes password managers
It does indeed, Bitwarden is open source and selfhostable tho :)
1password is probably the most valuable subscription I pay for.
KeePassXC is free and completely offline
If anyone’s looking for a free and open source option, Bitwarden is also great.
You two have no idea do you? lol
When you pass your password into an app, it can just copy and store it. If at any point you put a password through, even once, its compromised and no password manager will help in the slightest.
I make bobApp, you download bobApp, if you put a password into it, you are done.
edit: answering both of you.
Then i misunderstood. After i typed this I noticed others said what you meant. My bad.
You’re correct, but by maintaining distinct passwords with a password manager you make sure only the one account is compromised. 2FA also helps, you may have the username and password, but the 2FA code that you were given needs to be used immediately or else it will expire, and an expired 2FA code won’t allow you to successfully breach the account you’re trying to break into to.
