Lemmy

This is why password managers are so heavily pushed. Imagine if you used the same password for Lemmy that you used for your email? Both are now compromised. A unique password for all accounts is the bare minimum you must do.

Sorry, but that's literally every online service. For example if you buy a new virtual server it takes like 5 minutes till a Chinese IP starts to try root passwords.

If someone actually wanted to harm Lemmy they'd just DDOS the biggest instances for a month (which would be easy, it's mostly single servers after all) or attack it with so much spam and large images that storage would break.

Using open source apps, especially with more than one contributor, is currently the best option to be safe from this kind of attack.

Edit: I'm not saying that FOSS is 100% secure because it's FOSS. I'm just saying it's the best option we currently have.

Oauth2 login support for apps would certainly be very welcome.

Thanks for the heads up. My password is %f22N$CBTNgW, can you let me know if it was leaked?

I am using the Liftoff app. It looks pretty safe but I don't really know.

Me reading this post on an alpha app on testflight: chuckles I’m in danger.

Kidding aside, I used a dedicated email (and password) for my account and don’t plan to post any personal info on here.

Indeed, this is a real weak spot with Lemmy's security. I honestly think we need to place more emphasis on implementing OAuth2, when I have the time I'll have to take a look at that again to see if I'm able to.

Thanks for this!!

I feel like it raises somewhat the general issue of how much we're willing to live with complete mysterious anonymity from all of the developers and admins in the fediverse. I'm not saying that every admin or developer should have their real identity revealed and linked here. But there's a tension or issue here in how much it's normal and accepted and how much the fediverse in general wants to grow and attract users that are accustomed to trusting large companies that provide a different kind of base level trustworthiness than makes sense "out here".

If not links to real life identities (however trustworthy that can be in the limit), at least some connection to a broader online presence such that it becomes more likely the actor has something to lose in acting in bad faith (the lemmy core devs being a good example).

I don't have a solution ... but it seems to be a growing pain as this whole thing kind of grows from "hacker project" to "mainstream social media".

Are there any known apps that should be avoided? I’m using Mlem and Memmy.

1password is probably the most valuable subscription I pay for.

What about the app Memmy for iPhone ?

Feels like this will be a very common occurrence with people rushing to build and use new apps, and host new servers. There are plenty of positives to fediverse vs centralized, but it doesn’t come without negatives.

I've been wondering that myself. I've only entered my pw into Jerboa, which is made by the Lemmy devs (and Liftoff once, but changed the pw since).

Now I only ever use FOSS apps, which all seem to be under some amount of scrutiny, but idk how much is enough.

I've always been particularly wary of Voyager/wefwef. Not that I wouldn't trust the devs, but the whole concept of entering a password into a 3rd page that only passes it onto the right page, damn that's just dumb on principle.

It's particularly weird since this is home for so many techies and privacy/security advocates.

Trying to break Lemmy, yeah, let's prosecuted those bastards, but... WHAT. COULD. BE. MORE. WORTHLESS. than my account?

You are welcome to the scintillating points I have made. Bask in their brilliance.