442

With the recent hack, there is now irrefutable proof of malicious actors trying to break Lemmy and steal user accounts. Please be careful about entering your password into random Lemmy apps! (lemm.ee)

submitted 1 year ago* (last edited 1 year ago) by sunaurus@lemm.ee to c/lemmy@lemmy.ml

112 comments fedilink hide all child comments

I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.

Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!

This isn't to say that any current Lemmy app developers are for sure out to get you, but at this point, it's quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!

(page 2) 50 comments

sorted by: hot top controversial new old

[-] Coopa@lemmy.world 5 points 1 year ago

What about the app Memmy for iPhone ?

[-] dismalnow@kbin.social 5 points 1 year ago

Preface: I have no opinion. Have not installed, and will not install because I don't need it.

If you have to ask, it's probably worth investigating further.

The first thing I would do is search around for any mention of the app name and variants on the word "password".

Never install anything that you don't trust, and dissociate from your "real" email/identity for those that you aren't sure about. Whoever owns the software potentially owns your credentials.

[-] buycurious@lemmy.world 3 points 1 year ago

I don’t think this one is going to fall in the “malicious” category.

It’s on the iOS App Store, so I’m under the impression that a code review would’ve snuffed that out.

load more comments (1 replies)

[-] wakest@lemmy.ml 3 points 1 year ago

Memmy is good!

load more comments (3 replies)

[-] corytheboyd@kbin.social 4 points 1 year ago

Feels like this will be a very common occurrence with people rushing to build and use new apps, and host new servers. There are plenty of positives to fediverse vs centralized, but it doesn’t come without negatives.

[-] WhoRoger@lemmy.world 4 points 1 year ago

I've been wondering that myself. I've only entered my pw into Jerboa, which is made by the Lemmy devs (and Liftoff once, but changed the pw since).

Now I only ever use FOSS apps, which all seem to be under some amount of scrutiny, but idk how much is enough.

I've always been particularly wary of Voyager/wefwef. Not that I wouldn't trust the devs, but the whole concept of entering a password into a 3rd page that only passes it onto the right page, damn that's just dumb on principle.

It's particularly weird since this is home for so many techies and privacy/security advocates.

[-] similideano@sopuli.xyz 2 points 1 year ago

Its less dumb than entering it into a regular app compiled into an apk, which is more opaque (even if it's also FOSS). Voyager you can host it yourself.

load more comments (2 replies)

[-] TheSaneWriter@lemm.ee 1 points 1 year ago

All of the apps have you enter your credentials into their page because Lemmy doesn't support OAuth2. I don't think it's fair to criticize Voyager for a problem that is currently inherent to all Lemmy apps.

load more comments (1 replies)

[-] nix@merv.news 3 points 1 year ago

The greatest part of Bluesky/atProtocol vs ActivityPub is that they let you sign in to one account on any service on the protocol and it requires you to make separate app passwords.

Users getting invite codes every X weeks is nice for the server the require registration too

[-] nekat_emanresu@lemmy.ml 2 points 1 year ago

Is this a password manager ad?

[-] sma3in@lemmy.world 2 points 1 year ago

it's about time to change that password and i think lemmy team should have an option in the settings to revoke access we give to third party apps....not sure if that's possible

[-] puffy@lemmy.ml 1 points 1 year ago

Apps are bloated(they store a lot of cache on the disk) , just use the website.

load more comments

this post was submitted on 11 Jul 2023

442 points (100.0% liked)

Lemmy

12579 readers

37 users here now

Everything about Lemmy; bugs, gripes, praises, and advocacy.

For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.

founded 4 years ago

MODERATORS

nutomic@lemmy.ml