Mastodawn

With the recent hack, there is now irrefutable proof of malicious actors who trying to break Lemmy and steal user accounts. Please be careful about entering your password into random Lemmy apps!

https://lemm.ee/post/1000696

With the recent hack, there is now irrefutable proof of malicious actors who trying to break Lemmy and steal user accounts. Please be careful about entering your password into random Lemmy apps! - lemm.ee

I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends and tools that have been popping up lately. Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account! Of course this isn’t to say that all Lemmy app developers are out to get you, but at this point, it’s quite clear that there are malicious folks out there, and creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!

sunaurus Jul 11, 2023

nekat_emanresu Jul 11, 2023

Do another one, replace the last panels “alpha Lemmy app” to “password manager” lol

usernotfound Jul 11, 2023

How many password managers have you been trying out this week?

nekat_emanresu Jul 11, 2023

I know we probably aren’t trying every sketchy password manager that is advertised, but the way people are gushing over them and missing the point of the post scared me. Password managers are ultra high risk programs if you aren’t careful. It’s ok if you guys don’t mind losing your identity from an account because of a password manager giving unique passwords to each, but the point of this post is to not lose an account from letting your guard down with a sketchy app.

The password manager dudes are saying “My house insurance is the best! i can build a new house” and this poster is saying “Avoid putting flammable things in your house so it doesn’t burn down”. Also a high chance their insurance company wont pay out, if you guys mess up badly with a sketchy password manager.

starman Jul 11, 2023

Using open source apps, especially with more than one contributor, is the safest option to be safe from this kind of attack.

Aurix Jul 11, 2023

No, because open source apps need to have enough eyes on them to spot malicious code. And highly complex ones need proper audits and even that might not be enough to catch every fancy vulnerability.

Fisch Jul 11, 2023

I doubt a malicious actor would open source their app tho

TheSaneWriter Jul 11, 2023

That’s fair, but sometimes a malicious actor will attempt to covertly contribute code that introduces a security vulnerability.

sunaurus Jul 11, 2023

It helps, but it’s still not a silver bullet. For example, a Lemmy app could contain no malicious code in its open source repository, but malicious code could still be added to a binary release in an app store.

didnt_readit Jul 11, 2023

Also if it’s a desktop app they could just put the malicious code in the binary download 99% of people will use, or if it’s a web app, they just put it in their hosted version, etc.

similideano Jul 11, 2023

Voyager (formerly wefwef) is a self-hostable web app, so it doesn’t have this problem. Of course this only means you can inspect the code you’re running. You still have to able to understand the code to be sure it’s not doing anything malicious.

Zeth0s Jul 11, 2023

Vojager can be easily modified and deployed. It is actually quite riskier than others if you don’t use trusted deployments

similideano Jul 11, 2023

A random deployment is certainly risky, but no riskier than a random apk. I’d argue the random deployment is less risky because it’s easier to inspect it in the browser and see what it’s doing with your password. But of course both are to avoid. Self-hosting or compiling your own clients if you can, official deployments or releases otherwise.

XpeeN Jul 11, 2023

Yeah, downloading from fdroid or izzyondroid kinda solves that.

kopper [they/them]Jul 11, 2023

Izzy directly sends over the APKs from GitHub releases. F-Droid does their own builds which is partly why they’re so slow to update.

XpeeN Jul 11, 2023

I know?

both have my trust in not messing with the files.

grue Jul 11, 2023

That’s why F-Droid is the safest Android app repository. If I’m not mistaken, every app they offer is rebuilt from the public source code by the repo package maintainer.

PeleSpirit Jul 11, 2023

I’m new to fdroid, yesterday was the first I’ve heard of it. They have a playstore app, is that the same thing?

PeleSpirit Jul 11, 2023

How can an idiot like me tell though, everything is pretty new. I just assume every account I make is a throwaway for now.

JoeKrogan Jul 11, 2023

Well I recommend to stay away from any closed source apps. Also make sure your password is unique to lemmy and use an email address that is not your primary email.

Be careful of clicking links and DMs.

JoeKrogan Jul 11, 2023

Well I recommend to stay away from any closed source apps. Also make sure your password is unique to lemmy and use an email address that is not your primary email.

Be careful of clicking links and DMs. If using the browser use noscript and block scripts by default.

Dark Arc Jul 11, 2023

The safest option would be for Lemmy to implement OAuth and apps that aren’t in some “official front end for xyz website mode” to authorize via OAuth with the backend instead of via credentials.

Carlos Solís Jul 11, 2023

Most if not all Mastodon/Pleroma apps already use OAuth by default. I’m surprised that Lemmy hasn’t implemented it yet. I wonder if KBin does already?

iegod Jul 11, 2023

OSS does not guarantee security, ever. Please let’s not fall into false sense of security.I

starman Jul 11, 2023

But in this case, if an app is open source, there is a higher chance of discovering that it sends your credentials somewhere else than in closed source app

iegod Jul 12, 2023

That assumes people are looking at that and know what they’re doing and aren’t malicious actors. None of this is guaranteed. Famous examples of major OSS security vulnerabilities have already shown this.

Coopa Jul 11, 2023

What about the app Memmy for iPhone ?

dismalnow Jul 11, 2023

Preface: I have no opinion. Have not installed, and will not install because I don't need it.

If you have to ask, it's probably worth investigating further.

The first thing I would do is search around for any mention of the app name and variants on the word "password".

Never install anything that you don't trust, and dissociate from your "real" email/identity for those that you aren't sure about. Whoever owns the software potentially owns your credentials.

NotAPenguin Jul 11, 2023

It's not about any specific app.

They are just using many words to say 'remember logging in on these apps means giving them your full username/password.'

nekat_emanresu Jul 11, 2023

This includes password managers

NotAPenguin Jul 11, 2023

It does indeed, Bitwarden is open source and selfhostable tho :)

wakest Jul 11, 2023

Memmy is good!

buycurious Jul 11, 2023

I don’t think this one is going to fall in the “malicious” category.

It’s on the iOS App Store, so I’m under the impression that a code review would’ve snuffed that out.

didnt_readit Jul 11, 2023

Apple doesn’t review it that thoroughly. They could easily send people’s credentials up to some server and Apple would likely not catch it.

What I mean is don’t just trust it because it’s in the App Store.

I personally use it because it has an active GitHub and is one of the more popular mobile clients. Also I don’t really care if my accounts get hacked in the first place lol so I’m also trying out Mlem beta and Wefwef. But even with that said I wouldn’t just try out any random new client that came along.

Juzexo Jul 11, 2023

My lemmy account is made with a throwaway email and with a randomly generated password just in case it ever gets leaked

Dark Arc Jul 11, 2023

Same, I was on world when it got hacked, rotated the simple login email, and rotated the password post hack (and deactivated the old email) just to be on the safe side.

electrogamerman Jul 11, 2023

Mine is just my porn email, so good luck hackers

Meow.tar.gz Jul 11, 2023

I am using the Liftoff app. It looks pretty safe but I don’t really know.

Fisch Jul 11, 2023

It’s open source and pretty popular (for a Lemmy app at least) so it should be pretty safe

ChaosCharlie Jul 11, 2023

Are there any known apps that should be avoided? I’m using Mlem and Memmy.

Fisch Jul 11, 2023

Not yet, this post is just a warning that it might happen

NotAPenguin Jul 11, 2023

It's not about any specific app.

They are just using many words to say 'remember logging in on these apps means giving them your full username/password.'

xXGanondorfXx Jul 11, 2023

We really need a better way to log in from 3rd parties. It'd be nice if we could crowd fund features, I'd def pay up for some sort of app-password system or other

Established_Trial Jul 11, 2023

I agree with this completely.

Toribor Jul 11, 2023

Obviously you should only input account credentials into an app you trust, but shouldn’t a properly designed Lemmy app not store the credentials in plain text at all? Authorize the user through the API and then it’s just an authenticated session, no need to store the username/password at all until you sign out.

I suppose if you have fast user switching it might need to store it. Hmmmm.

Efwis Jul 11, 2023

Not sure about the other apps, but Memmy keeps your password stored in the app. But generally speaking I don’t think Gavin is a malicious person. He spent 3 weeks with beta tests before he was even comfortable pushing it to Apple App Store and the code is reviewed by Apple before being included to watch for malicious scripting. I am not saying people don’t get malicious scripts passed through Apple, but from what I have seen of Gavin’s work, he doesn’t seem the type that would do that.

similideano Jul 11, 2023

Closed source ones.

slazer2au Jul 11, 2023

This is why password managers are so heavily pushed. Imagine if you used the same password for Lemmy that you used for your email? Both are now compromised. A unique password for all accounts is the bare minimum you must do.

nekat_emanresu Jul 11, 2023

Now again, the key point of this post, but applied to random password managers lol

🇸‌🇵‌🇪‌🇨‌🇺‌🇱‌🇦‌🇹‌🇪‌🇷‌Jul 11, 2023

I literally just got one last week. It’s so nice! I guess I was hesitant because centralized passwords always put me off, but it’s not hard to setup 2FA on all your important stuff.

T156 Jul 11, 2023

Although it is worth noting that the recent Lemmy hack didn’t come from a password compromise, but from session token harvesting, which a password change would not really protect against.

killbot_gamma Jul 11, 2023

Forgive me if I’m mistaken, but wouldn’t logging out of the compromised session be all it would take to end the attack in this case?

sudo Jul 11, 2023

Only if logging out actively invalidates session tokens, which appears to have not been the case. github.com/LemmyNet/lemmy/issues/3364

[Bug]: No token/session invalidation after logout/reset password · Issue #3364 · LemmyNet/lemmy

Requirements Is this a bug report? For questions or discussions use https://lemmy.ml/c/lemmy_support Did you check to see if this issue already exists? Is this only a single bug? Do not put multipl...

GitHub

flames5123 Jul 11, 2023

Lol this is not how the hack worked. JWT cookies are encrypted. They don’t contain your password at all. There was no way to reverse engineer from your cookie to your password.

usernotfound Jul 11, 2023

Correct me if I’m wrong, but Lemmys tokens have no expiration, right? So they are effectively username and password combined.

flames5123 Jul 11, 2023

The decoding algorithm can change, which is exactly what happened, invalidating all previously generated tokens. They cannot be decoded to a password though since they are encrypted, meaning shared passwords wouldn’t be an issue (though you should use a password manager to not have this issue in the first place).

foxpeter17 Jul 12, 2023

That’s not how tokens work. Tokens are (usually short-lived) credentials that are passed to a client after it authenticated e.g. with username + password. But the password is never contained in a token. They are also not encrypted, but signed, meaning the Lemmy instance can verify that the plain-text token ist authentic. Also, not the decoding algorithm has changed, but the signing key was rotated, meaning all JWTs created before the signing key rotation would not look authentic anymore

flames5123 Jul 12, 2023

Right. I was simplifying it by saying it was encrypted, but it’s just an auth token from the service after verifying that the user is authenticated.

And correct. I’m just an idiot and didn’t do research to explain it, even though I’ve used JWT tokens in my applications before. Hahaha. Thanks for the detailed correction!

cooljacob204 Jul 11, 2023

1password is probably the most valuable subscription I pay for.

pizzahoe Jul 11, 2023

If anyone’s looking for a free and open source option, Bitwarden is also great.