NoConfidence_2192Jul 10, 2023

My very basic account security advice for Lemmy Admins

https://rblind.com/post/2254673

My very basic account security advice for Lemmy Admins - RBlind

A little off topic for most of us here on RBlind but still worth posting for our instances Admins/Mods if no one else. # My very basic account security advice for Lemmy Admins # Have separate accounts for the things you do on an instance: 1. Only use Admin accounts for things requiring no less than an Admin to do. 2. Only use Mod accounts for things requiring no less than a Mod to to. 3. Use standard user accounts for everything else. Be sure to log off of an account and close all apps and browser tabs and windows open when you used that account before trying to log in with a different account. While there are a lot more things that can and should be done, using separate accounts is a good minimal place to start. It should help mitigate against UI exploits targeting admins account for compromise like we have seen with a few other instances recently. Things can and probably will still go wrong but diligently using accounts of least privilege can helping reduce the risk of Admins getting caught up in some of the more simple traps.

Show threadClassyHatter

Also be wary when using apps and especially when enabling push notifications. Lemmy API currently lacks any kind of support for partial access to an account (unless this has changed recently). So, apps cannot, for example, get read only access to your account’s inbox. Apps can get either no access or full access. When you sign up for push notifications, an authentication token is stored to the push notification server which gives full access to your account to who ever happens to get their hand on that token. If there, for example, happens to be a security vulnerability on the push notification server, it might leak those tokens.

If you have enabled push notifications on some Lemmy app, and want to invalidate the token, you can just change your password.

Here’s a post by Memmy for Lemmy’s developer about push notifications: lemmy.ml/post/1534493

Memmy 0.0.1.72 - Push Notifications - Lemmy

# Don’t PUSH me, cause I’m close to the edge! [https://lemmy.ml/pictrs/image/9a40905f-d366-4b41-9b81-dc0831798b77.jpeg] Hey all! First, for those concerned, I have a multi-day vacation coming up here this week, so I’ll be taking a nice break and cooking up a new batch of meth for the next spree (I kid I kid). Here’s the updates for the day for you: - You can delete accounts now. - Themes have been tweaked - Push notifications - Available in Edit Account Settings - Swipe co…wait did you say push notifications? Yea, we’ll talk about that down below. - Swipe colors are theme-based now. Will continue tweaking these as needed. - Other tweaks - Oh and compact view users can now press the image to open it up. Issues I know about and will address tomorrow: - Voting on comments doesn’t update the vote - Going to a user profile is not yet complete. Don’t worry, most of this should be done tomorrow. I’ve got pretty much all the designs laid out and components now made for them. Just a matter of swapping out the old with the new :) ## Push Notifications I’ve set up a server that will perform checks for push notifications. Here are the ground rules you should know about: 1. I cannot guarantee the availability of this. As we scale, I will scale as well, so it won’t be a problem with that. What I mean is that I cannot guarantee what Lemmy instances are going to do as far as rate limiting (I’m not 100% sure how it works yet). Although I am not spamming any requests at all (you’re going to be making more requests for notifications just by having the website open), there will obviously be multiple users making requests from the same IP address now. Depending on what instances owners have in place, some requests might fail to go through. I’ll monitor and see what happens. 2. Before you enable notifications, a message will appear letting you know that you are sending your authentication token to the Memmy server. This is NOT your password, HOWEVER, it does allow Memmy (and anyone who has access to it) access to your account. So, long story short, you are trusting me (and only me, nobody else has access to this server) with access to your Lemmy account. This is not optimal. I would much rather have scopes where all I can do is READ your mentions/replies/etc, and this might be something that gets integrated later on in the API. We will see what happens with that in the future. For now though, there is only one scope of authentication. If you do wish to revoke this token in the future for whatever reason, all you need to do is change your password and the token will be invalidated. Again…you are infact sending your authentication token to the server and I technically do have access to it. Just as a heads up. 3. Here is how it works: - You enable push notifications in the app - Your username, instance, auth token, and push notifications token are sent to https://memmy.app [https://memmy.app] - The server attempts to access the Lemmy API endpoint /site. When authenticated, this endpoint returns user information. - The server checks that the username in the API response matches the one sent to the server. If it does not, then either the authentication token was invalid or the username was not correct. - If everything is correct, the server stores the username, instance, authentication token, and push token in the database. - The server will check for replies (currently this is all I am checking for as to not create too much traffic) periodically. This should happen once per minute, but as users increase, there may be delays as I scale. - The server will get the latest reply ID and see if it is greater than the last one received. If so, this is a new reply and it will be sent to the user. That reply ID will then be stored in the database. - Subsequent devices are also supported. Notifications will be sent to each device. 4. Full source code is available to view at https://github.com/gkasdorf/memmy-push [https://github.com/gkasdorf/memmy-push] 5. To instance admins: All requests made to instances include the user-agent “Memmy Push/0.1 on behalf of username”. The username is included to inform you that these are not requests made for one specific individual, but for multiple users. If this ever becomes a problem on your instance, please let me know as I would really like to make this work great for everyone, not just the users. This is a team effort. On that note, please also let me know if you see any trouble with traffic coming from the app. Similarly, requests are made with the user-agent “Memmy ios version”. ## Feedback Let me know what issues you have with this feature. Obviously it is new and I’m not sure how great it works yet. From my testing it works fine. I will slowly expand on the notifications delivered from this, however, I first want to make sure we approach this slowly so that we do not create an absurd amount of traffic that cannot be handled. I will closely monitor traffic and adjust timeframes if necessary. The next update will include mostly visual and UI changes as we move toward normalizing the entire design of the app and bring about a great UX for all of you. I’m also aware of a number of issues, and don’t think they are unnoticed. Now that we have all the features in place, we can go through and fix every last one of these issues 👍 And lastly on that note, thanks for your guy’s debug logs. We are now reaching a point where we are seeing on average 1 crash per 1000 sessions and debug logs are coming in quite less frequently than before. All good news :) See you in the next update. Till then, happy pushing!

Jul 11, 2023 at 10:47amWeb