I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.

Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!

This isn’t to say that any current Lemmy app developers are for sure out to get you, but at this point, it’s quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!

    • nekat_emanresu@lemmy.ml
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      20
      ·
      edit-2
      1 year ago

      Do another one, replace the last panels “alpha Lemmy app” to “password manager” lol

      edit: for the record I’m not disagreeing with the first comment in this comment chain.

        • nekat_emanresu@lemmy.ml
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          1 year ago

          I know we probably aren’t trying every sketchy password manager that is advertised, but the way people are gushing over them and missing the point of the post scared me. Password managers are ultra high risk programs if you aren’t careful. It’s ok if you guys don’t mind losing your identity from an account because of a password manager giving unique passwords to each, but the point of this post is to not lose accounts from letting your guard down with a sketchy app.

          The password manager dudes are saying “My house insurance is the best! i can build a new house” and this poster is saying “Avoid putting flammable things in your house so it doesn’t burn down”. Also a high chance their insurance company wont pay out, if you guys mess up badly with a sketchy password manager.

  • slazer2au@lemmy.world
    link
    fedilink
    English
    arrow-up
    79
    arrow-down
    3
    ·
    1 year ago

    This is why password managers are so heavily pushed. Imagine if you used the same password for Lemmy that you used for your email? Both are now compromised. A unique password for all accounts is the bare minimum you must do.

    • T156@lemmy.world
      link
      fedilink
      English
      arrow-up
      39
      ·
      1 year ago

      Although it is worth noting that the recent Lemmy hack didn’t come from a password compromise, but from session token harvesting, which a password change would not really protect against.

    • flames5123@lemmy.world
      link
      fedilink
      English
      arrow-up
      13
      ·
      1 year ago

      Lol this is not how the hack worked. JWT cookies are encrypted. They don’t contain your password at all. There was no way to reverse engineer from your cookie to your password.

      • usernotfound@lemmy.ml
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        1
        ·
        1 year ago

        Correct me if I’m wrong, but Lemmys tokens have no expiration, right? So they are effectively username and password combined.

        • flames5123@lemmy.world
          link
          fedilink
          English
          arrow-up
          5
          ·
          1 year ago

          The decoding algorithm can change, which is exactly what happened, invalidating all previously generated tokens. They cannot be decoded to a password though since they are encrypted, meaning shared passwords wouldn’t be an issue (though you should use a password manager to not have this issue in the first place).

          • foxpeter17@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            That’s not how tokens work. Tokens are (usually short-lived) credentials that are passed to a client after it authenticated e.g. with username + password. But the password is never contained in a token. They are also not encrypted, but signed, meaning the Lemmy instance can verify that the plain-text token ist authentic. Also, not the decoding algorithm has changed, but the signing key was rotated, meaning all JWTs created before the signing key rotation would not look authentic anymore

            • flames5123@lemmy.world
              link
              fedilink
              English
              arrow-up
              2
              ·
              1 year ago

              Right. I was simplifying it by saying it was encrypted, but it’s just an auth token from the service after verifying that the user is authenticated.

              And correct. I’m just an idiot and didn’t do research to explain it, even though I’ve used JWT tokens in my applications before. Hahaha. Thanks for the detailed correction!

  • Vlyn@lemmy.ml
    link
    fedilink
    English
    arrow-up
    64
    arrow-down
    2
    ·
    1 year ago

    Sorry, but that’s literally every online service. For example if you buy a new virtual server it takes like 5 minutes till a Chinese IP starts to try root passwords.

    If someone actually wanted to harm Lemmy they’d just DDOS the biggest instances for a month (which would be easy, it’s mostly single servers after all) or attack it with so much spam and large images that storage would break.

      • grue@lemmy.ml
        link
        fedilink
        English
        arrow-up
        14
        arrow-down
        2
        ·
        1 year ago

        Here’s hoping Sync and Boost lead the way

        Or better yet, let’s hope Free Software apps lead the way and ditch the proprietary ones.

        • OtakuAltair@lemm.ee
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 year ago

          Well, Sync and Boost were well established already. It’s probably gonna take some time for the new foss ones to catch up

      • steltek@lemm.ee
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        I’m getting CS-nerd excited about how this is all going to play out. Federated moderation is hard and so many awful, clunky things have been tried before. Are we actually going to see a web-of-trust or reputation system that reaches widespread adoption? It’s gotta be silent and noninteractive as there’s no way to expect normal people to put up with the complexity.

    • bfr0@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      1 year ago

      The difference is that when you buy a vps you aren’t handing over all your access creds to random developers.

      And “harming lemmy” may be an intent that sparks a DDoS but there are other intentions that should make users wary. Harvesting creds of people who reuse passwords across accounts is an easy example that could have more serious implications to the individual user.

      • Vlyn@lemmy.ml
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 year ago

        Dude, you can’t trust any Lemmy instance at all. It doesn’t even matter that the code is open source, the instance owner could just compile their own version that sends them every password in plaintext. There is zero guarantee that your password is safe.

        Anyone who reuses passwords has been pwned a dozen times already. Just check your own logins here: https://haveibeenpwned.com/

        If you reuse passwords online you have a problem, it’s simple as that. Even big companies had breaches that leaked user data, no company is safe. For example one of my old passwords got stolen from Adobe. One from Unreal Engine. And my old logins are currently shared in 2,844 separate data breaches. Not using a password manager with a random password per service nowadays is madness.

  • starman@programming.dev
    link
    fedilink
    English
    arrow-up
    38
    arrow-down
    1
    ·
    edit-2
    1 year ago

    Using open source apps, especially with more than one contributor, is currently the best option to be safe from this kind of attack.

    Edit: I’m not saying that FOSS is 100% secure because it’s FOSS. I’m just saying it’s the best option we currently have.

    • sunaurus@lemm.eeOP
      link
      fedilink
      English
      arrow-up
      45
      ·
      1 year ago

      It helps, but it’s still not a silver bullet. For example, a Lemmy app could contain no malicious code in its open source repository, but malicious code could still be added to a binary release in an app store.

      • similideano
        link
        fedilink
        English
        arrow-up
        7
        ·
        1 year ago

        Voyager (formerly wefwef) is a self-hostable web app, so it doesn’t have this problem. Of course this only means you can inspect the code you’re running. You still have to able to understand the code to be sure it’s not doing anything malicious.

        • Zeth0s@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 year ago

          Vojager can be easily modified and deployed. It is actually quite riskier than others if you don’t use trusted deployments

          • similideano
            link
            fedilink
            English
            arrow-up
            3
            ·
            1 year ago

            A random deployment is certainly risky, but no riskier than a random apk. I’d argue the random deployment is less risky because it’s easier to inspect it in the browser and see what it’s doing with your password. But of course both are to avoid. Self-hosting or compiling your own clients if you can, official deployments or releases otherwise.

      • grue@lemmy.ml
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 year ago

        That’s why F-Droid is the safest Android app repository. If I’m not mistaken, every app they offer is rebuilt from the public source code by the repo package maintainer.

      • XpeeN
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        Yeah, downloading from fdroid or izzyondroid kinda solves that.

          • XpeeN
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            I know?

            both have my trust in not messing with the files.

      • didnt_readit@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        Also if it’s a desktop app they could just put the malicious code in the binary download 99% of people will use, or if it’s a web app, they just put it in their hosted version, etc.

    • Dark Arc@lemmy.world
      link
      fedilink
      English
      arrow-up
      30
      ·
      1 year ago

      The safest option would be for Lemmy to implement OAuth and apps that aren’t in some “official front end for xyz website mode” to authorize via OAuth with the backend instead of via credentials.

      • Carlos Solís@communities.azkware.net
        link
        fedilink
        English
        arrow-up
        11
        ·
        1 year ago

        Most if not all Mastodon/Pleroma apps already use OAuth by default. I’m surprised that Lemmy hasn’t implemented it yet. I wonder if KBin does already?

    • Aurix@lemmy.world
      link
      fedilink
      English
      arrow-up
      24
      arrow-down
      3
      ·
      1 year ago

      No, because open source apps need to have enough eyes on them to spot malicious code. And highly complex ones need proper audits and even that might not be enough to catch every fancy vulnerability.

    • PeleSpirit@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      How can an idiot like me tell though, everything is pretty new. I just assume every account I make is a throwaway for now.

      • JoeKrogan@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Well I recommend to stay away from any closed source apps. Also make sure your password is unique to lemmy and use an email address that is not your primary email.

        Be careful of clicking links and DMs.

      • JoeKrogan@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Well I recommend to stay away from any closed source apps. Also make sure your password is unique to lemmy and use an email address that is not your primary email.

        Be careful of clicking links and DMs. If using the browser use noscript and block scripts by default.

    • iegod@lemm.ee
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      OSS does not guarantee security, ever. Please let’s not fall into false sense of security.I

      • starman@programming.dev
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        But in this case, if an app is open source, there is a higher chance of discovering that it sends your credentials somewhere else than in closed source app

        • iegod@lemm.ee
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          That assumes people are looking at that and know what they’re doing and aren’t malicious actors. None of this is guaranteed. Famous examples of major OSS security vulnerabilities have already shown this.

    • sheodox@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      I really want this. I haven’t tried any of the apps (other than the one I made) yet because I don’t want to give anyone my password. Oauth support would be so nice.

  • Juzexo@lemmy.world
    link
    fedilink
    English
    arrow-up
    23
    ·
    1 year ago

    My lemmy account is made with a throwaway email and with a randomly generated password just in case it ever gets leaked

  • eating3645@lemmy.world
    link
    fedilink
    English
    arrow-up
    17
    arrow-down
    1
    ·
    1 year ago

    Thanks for the heads up. My password is %f22N$CBTNgW, can you let me know if it was leaked?

    • Fisch@lemmy.ml
      link
      fedilink
      English
      arrow-up
      10
      ·
      1 year ago

      It’s open source and pretty popular (for a Lemmy app at least) so it should be pretty safe

    • Efwis@lemmy.zip
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      Not sure about the other apps, but Memmy keeps your password stored in the app. But generally speaking I don’t think Gavin is a malicious person. He spent 3 weeks with beta tests before he was even comfortable pushing it to Apple App Store and the code is reviewed by Apple before being included to watch for malicious scripting. I am not saying people don’t get malicious scripts passed through Apple, but from what I have seen of Gavin’s work, he doesn’t seem the type that would do that.

    • NotAPenguin@kbin.social
      link
      fedilink
      arrow-up
      14
      arrow-down
      18
      ·
      1 year ago

      It’s not about any specific app.

      They are just using many words to say ‘remember logging in on these apps means giving them your full username/password.’

      • xXGanondorfXx@kbin.social
        link
        fedilink
        arrow-up
        6
        ·
        1 year ago

        We really need a better way to log in from 3rd parties. It’d be nice if we could crowd fund features, I’d def pay up for some sort of app-password system or other

      • Toribor@corndog.uk
        link
        fedilink
        arrow-up
        1
        ·
        edit-2
        1 year ago

        Obviously you should only input account credentials into an app you trust, but shouldn’t a properly designed Lemmy app not store the credentials in plain text at all? (And definitely never send them somewhere else) Authorize the user through the API and then it’s just an authenticated session, no need to store the username/password at all until you sign out.

        I suppose if you have fast user switching it might need to store it. Hmmmm.

  • TheSaneWriter@lemm.ee
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    Indeed, this is a real weak spot with Lemmy’s security. I honestly think we need to place more emphasis on implementing OAuth2, when I have the time I’ll have to take a look at that again to see if I’m able to.

  • scytale@lemmy.world
    link
    fedilink
    English
    arrow-up
    8
    ·
    edit-2
    1 year ago

    Me reading this post on an alpha app on testflight: chuckles I’m in danger.

    Kidding aside, I used a dedicated email (and password) for my account and don’t plan to post any personal info on here.

    • pizzahoe@lemm.ee
      link
      fedilink
      arrow-up
      19
      ·
      1 year ago

      If anyone’s looking for a free and open source option, Bitwarden is also great.

      • nekat_emanresu@lemmy.ml
        link
        fedilink
        arrow-up
        2
        arrow-down
        14
        ·
        edit-2
        1 year ago

        You two have no idea do you? lol

        When you pass your password into an app, it can just copy and store it. If at any point you put a password through, even once, its compromised and no password manager will help in the slightest.

        I make bobApp, you download bobApp, if you put a password into it, you are done.

        edit: answering both of you.

        Then i misunderstood. After i typed this I noticed others said what you meant. My bad.

        • jiji@lemmy.world
          link
          fedilink
          English
          arrow-up
          12
          ·
          1 year ago

          I think their point is password managers make it very easy to have completely unique passwords, and if your Lemmy password is compromised you can change it without worrying about any other accounts being compromised. Not that a manager would magically protect you from ever being compromised.

        • pizzahoe@lemm.ee
          link
          fedilink
          arrow-up
          9
          ·
          1 year ago

          I think you misunderstood us lol… we’re not saying your password will not get leaked by the app… we’re saying it’s gonna be unique and random bullshit generated so the hacker won’t be able to get to your other accounts since passwords are different.

        • TheSaneWriter@lemm.ee
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          You’re correct, but by maintaining distinct passwords with a password manager you make sure only the one account is compromised. 2FA also helps, you may have the username and password, but the 2FA code that you were given needs to be used immediately or else it will expire, and an expired 2FA code won’t allow you to successfully breach the account you’re trying to break into to.

      • grue@lemmy.ml
        link
        fedilink
        arrow-up
        4
        ·
        1 year ago

        And if you want it to be online, you can just share your .kdbx file between your computers using Syncthing or whatever.

      • steltek@lemm.ee
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        Also Password Store! Syncs over Git and on Android you can use a Yubikey so that the private key isn’t even on your phone.

        But yes, KeePassXC is way more user friendly. Anything touching PGP/GPG is an automatic red flag for family.

  • maegul (he/they)@lemmy.ml
    link
    fedilink
    English
    arrow-up
    6
    ·
    1 year ago

    Thanks for this!!

    I feel like it raises somewhat the general issue of how much we’re willing to live with complete mysterious anonymity from all of the developers and admins in the fediverse. I’m not saying that every admin or developer should have their real identity revealed and linked here. But there’s a tension or issue here in how much it’s normal and accepted and how much the fediverse in general wants to grow and attract users that are accustomed to trusting large companies that provide a different kind of base level trustworthiness than makes sense “out here”.

    If not links to real life identities (however trustworthy that can be in the limit), at least some connection to a broader online presence such that it becomes more likely the actor has something to lose in acting in bad faith (the lemmy core devs being a good example).

    I don’t have a solution … but it seems to be a growing pain as this whole thing kind of grows from “hacker project” to “mainstream social media”.

    • Vlyn@lemmy.ml
      link
      fedilink
      English
      arrow-up
      5
      ·
      1 year ago

      The solution has been the same for the last 20 years: Use a password manager, do not reuse passwords. That’s it, you’re done.

      Even if the Lemmy instance admin steals your password (which would be easy!) they can’t do anything with it.

    • dismalnow@kbin.social
      link
      fedilink
      arrow-up
      5
      ·
      1 year ago

      Preface: I have no opinion. Have not installed, and will not install because I don’t need it.

      If you have to ask, it’s probably worth investigating further.

      The first thing I would do is search around for any mention of the app name and variants on the word “password”.

      Never install anything that you don’t trust, and dissociate from your “real” email/identity for those that you aren’t sure about. Whoever owns the software potentially owns your credentials.

    • buycurious@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      I don’t think this one is going to fall in the “malicious” category.

      It’s on the iOS App Store, so I’m under the impression that a code review would’ve snuffed that out.

      • didnt_readit@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 year ago

        Apple doesn’t review it that thoroughly. They could easily send people’s credentials up to some server and Apple would likely not catch it.

        What I mean is don’t just trust it because it’s in the App Store.

        I personally use it because it has an active GitHub and is one of the more popular mobile clients. Also I don’t really care if my accounts get hacked in the first place lol so I’m also trying out Mlem beta and Wefwef. But even with that said I wouldn’t just try out any random new client that came along.

    • NotAPenguin@kbin.social
      link
      fedilink
      arrow-up
      8
      arrow-down
      21
      ·
      1 year ago

      It’s not about any specific app.

      They are just using many words to say ‘remember logging in on these apps means giving them your full username/password.’

  • WhoRoger@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    ·
    1 year ago

    I’ve been wondering that myself. I’ve only entered my pw into Jerboa, which is made by the Lemmy devs (and Liftoff once, but changed the pw since).

    Now I only ever use FOSS apps, which all seem to be under some amount of scrutiny, but idk how much is enough.

    I’ve always been particularly wary of Voyager/wefwef. Not that I wouldn’t trust the devs, but the whole concept of entering a password into a 3rd page that only passes it onto the right page, damn that’s just dumb on principle.

    It’s particularly weird since this is home for so many techies and privacy/security advocates.

    • similideano
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      Its less dumb than entering it into a regular app compiled into an apk, which is more opaque (even if it’s also FOSS). Voyager you can host it yourself.

        • similideano
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          Sure. Both compiling your own apk or self-hosting are ideal. If you’re not doing either though, the web app is more easily inspectable.

    • TheSaneWriter@lemm.ee
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      All of the apps have you enter your credentials into their page because Lemmy doesn’t support OAuth2. I don’t think it’s fair to criticize Voyager for a problem that is currently inherent to all Lemmy apps.

      • WhoRoger@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Yea but it’s a local form on the device and not a 3rd party server, which is another layer of insecurity. And I’m not sure how much of the rest of communication needs to get proxied too.

        I dunno, that’s just way beyond my comfort zone unless I really want to self-host that stuff.

        Anyway, okay, nothing seems to be all that well secure at this point.