Most of us are Reddit refugees, and probably clicking more random links than we ever did before on websites we’ve never seen before. This whole experience feels like the old internet, but also throws up insane red flags with a modern internet perspective. What are the cybersecurity weaknesses we should all be looking for, and what are the best practices?

Here’s my reason for posting this. As I search for new communities across instances to follow, I sometimes end up clicking a link and I’m no longer logged in. In the corner, that could be a Sign In link or it could be phishing. It’s likely due to me not understanding how to properly navigate this system, but there’s nothing stopping someone from setting up a sight like this as far as I know.

Thoughts?

  • GVasco@discuss.tchncs.deEnglish
    10·
    1 year ago
    • Use a mail forwarding service to generate disposable e-mails used to sign up, if you accidentally give it to someone else it doesn’t expose any other accounts and can be easily replaced by a new one.
    • Use a password manager to ensure a strong and unique password.
    • Use a JavaScript blocker so you only allow the required JavaScript to make the website work and prevent automatic downloads.

    I’ve been doing these in general recently and it’s good privacy a security practice. Also slowly replacing my main e-mail address in different service accounts with disposable forwarding e-mail addresses.

    Edit: Other than that read a bit more about Lemmy and fediverse workings, verify what instance you’re viewing and navigate to the desired community via your instance as others have mentioned.

    • henfredemars@infosec.pubEnglish
      7·
      1 year ago

      I would like to underline and insist on using unique passwords. Many users like myself are joining small instances to get better performance and reduce the strain on the main servers, but anyone can spin up an instance and then poof, your password is gone if they can get you to sign up!

      This was always the case for normal websites on the internet however. I strongly recommend everyone use a good password manager to prevent one breach from cascading into a breach of all your accounts. It’s good OPSEC.

      Also, check which instance you’re signing into before you give them your password. Accidentally trying to log into the wrong instance with an account for a different instance is the same as handing them your password. A community could easily be hosted on some tiny server somewhere by a guy named Joe and do you trust him with your password?