I would be cautious about viewing any Lemmy.world communities right now, and the Beehaw admins should make sure their credentials are locked down in case they get targeted next.
I would be cautious about viewing any Lemmy.world communities right now, and the Beehaw admins should make sure their credentials are locked down in case they get targeted next.
Just because Beehaw is defederated from this instance, that does not mean that visiting a recently compromised server will not cause your credentials to be compromised.
Read the post again. It was specifically mentioning viewing lemmy.world communities, which is not possible through beehaw.org due to defederation. All you would see is the content before defederation.
Not possible with a beehaw account. But we know many of us may have accounts elsewhere.
I don’t have to read the post again, nobody should be accessing hacked servers and expecting their credentials to be safe.
No user data like credentials gets transfered. Everything between instances is done with bot like helpers that do the data transfers.
That’s the problem, they don’t. If you have them stored anywhere on the device you view the communities with, your credentials are not safe.
Edit: this was for someone else.
Anything can be transferred without your knowledge. Do not access hacked servers while expecting privacy.
It’s also possible that Beehaw’s instance is vulnerable to the same XSS attack.
Why would a “foreign” instance need to know my credentials from my local instance just to allow me to browse that foreign instance?
That’s the problem, they don’t. If you have them stored anywhere on the device you view the communities with, your credentials are not safe.