Lemmy

Although it is worth noting that the recent Lemmy hack didn't come from a password compromise, but from session token harvesting, which a password change would not really protect against.

Lol this is not how the hack worked. JWT cookies are encrypted. They don’t contain your password at all. There was no way to reverse engineer from your cookie to your password.

I literally just got one last week. It's so nice! I guess I was hesitant because centralized passwords always put me off, but it's not hard to setup 2FA on all your important stuff.

We need moderation tools

Here's hoping Sync and Boost lead the way

The difference is that when you buy a vps you aren't handing over all your access creds to random developers.

And "harming lemmy" may be an intent that sparks a DDoS but there are other intentions that should make users wary. Harvesting creds of people who reuse passwords across accounts is an easy example that could have more serious implications to the individual user.

It helps, but it's still not a silver bullet. For example, a Lemmy app could contain no malicious code in its open source repository, but malicious code could still be added to a binary release in an app store.

The safest option would be for Lemmy to implement OAuth and apps that aren't in some "official front end for xyz website mode" to authorize via OAuth with the backend instead of via credentials.

No, because open source apps need to have enough eyes on them to spot malicious code. And highly complex ones need proper audits and even that might not be enough to catch every fancy vulnerability.

I didn't even attach an email to mine.

pls also check hunter2

Pretty funny but if you enter you actual password it will hide it. My pass is ************, which should show up as asterisks for you.

Try it out. Pretty cool security feature honestly.

We need your full name, date of birth and zip code to check

It's open source and pretty popular (for a Lemmy app at least) so it should be pretty safe

Not yet, this post is just a warning that it might happen

Not sure about the other apps, but Memmy keeps your password stored in the app. But generally speaking I don’t think Gavin is a malicious person. He spent 3 weeks with beta tests before he was even comfortable pushing it to Apple App Store and the code is reviewed by Apple before being included to watch for malicious scripting. I am not saying people don’t get malicious scripts passed through Apple, but from what I have seen of Gavin’s work, he doesn’t seem the type that would do that.

If anyone's looking for a free and open source option, Bitwarden is also great.

KeePassXC is free and completely offline

The solution has been the same for the last 20 years: Use a password manager, do not reuse passwords. That's it, you're done.

Even if the Lemmy instance admin steals your password (which would be easy!) they can't do anything with it.

Preface: I have no opinion. Have not installed, and will not install because I don't need it.

If you have to ask, it's probably worth investigating further.

The first thing I would do is search around for any mention of the app name and variants on the word "password".

Never install anything that you don't trust, and dissociate from your "real" email/identity for those that you aren't sure about. Whoever owns the software potentially owns your credentials.