With the recent hack, there is now irrefutable proof of malicious actors trying to break Lemmy and steal user accounts. Please be careful about entering your password into random Lemmy apps!

sunaurus@lemm.ee to Lemmy@lemmy.ml – 431 points –

I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.

Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!

This isn't to say that any current Lemmy app developers are for sure out to get you, but at this point, it's quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!

112

You are viewing a single comment
View all comments

What about the app Memmy for iPhone ?

Preface: I have no opinion. Have not installed, and will not install because I don't need it.

If you have to ask, it's probably worth investigating further.

The first thing I would do is search around for any mention of the app name and variants on the word "password".

Never install anything that you don't trust, and dissociate from your "real" email/identity for those that you aren't sure about. Whoever owns the software potentially owns your credentials.

I don’t think this one is going to fall in the “malicious” category.

It’s on the iOS App Store, so I’m under the impression that a code review would’ve snuffed that out.

Apple doesn’t review it that thoroughly. They could easily send people’s credentials up to some server and Apple would likely not catch it.

What I mean is don’t just trust it because it’s in the App Store.

I personally use it because it has an active GitHub and is one of the more popular mobile clients. Also I don’t really care if my accounts get hacked in the first place lol so I’m also trying out Mlem beta and Wefwef. But even with that said I wouldn’t just try out any random new client that came along.

It's not about any specific app.

They are just using many words to say 'remember logging in on these apps means giving them your full username/password.'