this post was submitted on 11 Jul 2023
432 points (96.8% liked)

Lemmy

12572 readers
26 users here now

Everything about Lemmy; bugs, gripes, praises, and advocacy.

For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.

founded 4 years ago
MODERATORS
 

I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.

Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!

This isn't to say that any current Lemmy app developers are for sure out to get you, but at this point, it's quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!

you are viewing a single comment's thread
view the rest of the comments
[–] starman@programming.dev 38 points 1 year ago* (last edited 1 year ago) (5 children)

Using open source apps, especially with more than one contributor, is currently the best option to be safe from this kind of attack.

Edit: I'm not saying that FOSS is 100% secure because it's FOSS. I'm just saying it's the best option we currently have.

[–] sunaurus@lemm.ee 46 points 1 year ago (4 children)

It helps, but it's still not a silver bullet. For example, a Lemmy app could contain no malicious code in its open source repository, but malicious code could still be added to a binary release in an app store.

[–] similideano@sopuli.xyz 8 points 1 year ago (1 children)

Voyager (formerly wefwef) is a self-hostable web app, so it doesn't have this problem. Of course this only means you can inspect the code you're running. You still have to able to understand the code to be sure it's not doing anything malicious.

[–] Zeth0s@lemmy.world 3 points 1 year ago (1 children)

Vojager can be easily modified and deployed. It is actually quite riskier than others if you don't use trusted deployments

[–] similideano@sopuli.xyz 3 points 1 year ago

A random deployment is certainly risky, but no riskier than a random apk. I'd argue the random deployment is less risky because it's easier to inspect it in the browser and see what it's doing with your password. But of course both are to avoid. Self-hosting or compiling your own clients if you can, official deployments or releases otherwise.

[–] grue@lemmy.ml 7 points 1 year ago

That's why F-Droid is the safest Android app repository. If I'm not mistaken, every app they offer is rebuilt from the public source code by the repo package maintainer.

[–] didnt_readit@lemmy.world 2 points 1 year ago

Also if it’s a desktop app they could just put the malicious code in the binary download 99% of people will use, or if it’s a web app, they just put it in their hosted version, etc.

[–] XpeeN@sopuli.xyz 2 points 1 year ago (1 children)

Yeah, downloading from fdroid or izzyondroid kinda solves that.

[–] ShittyKopper@lemmy.blahaj.zone 5 points 1 year ago (1 children)

Izzy directly sends over the APKs from GitHub releases. F-Droid does their own builds which is partly why they're so slow to update.

[–] XpeeN@sopuli.xyz 1 points 1 year ago

I know?

both have my trust in not messing with the files.

[–] Dark_Arc@lemmy.world 31 points 1 year ago (1 children)

The safest option would be for Lemmy to implement OAuth and apps that aren't in some "official front end for xyz website mode" to authorize via OAuth with the backend instead of via credentials.

[–] csolisr@communities.azkware.net 11 points 1 year ago

Most if not all Mastodon/Pleroma apps already use OAuth by default. I'm surprised that Lemmy hasn't implemented it yet. I wonder if KBin does already?

[–] Aurix@lemmy.world 22 points 1 year ago (1 children)

No, because open source apps need to have enough eyes on them to spot malicious code. And highly complex ones need proper audits and even that might not be enough to catch every fancy vulnerability.

[–] Fisch@lemmy.ml 8 points 1 year ago (2 children)

I doubt a malicious actor would open source their app tho

[–] TheSaneWriter@lemm.ee 8 points 1 year ago

That's fair, but sometimes a malicious actor will attempt to covertly contribute code that introduces a security vulnerability.

[–] WhoRoger@lemmy.world 2 points 1 year ago (1 children)

It has happened before. Or somewhat more likely, a contributor provides code that the maintainer merges without looking too hard.

[–] PeleSpirit@lemmy.world 6 points 1 year ago (2 children)

How can an idiot like me tell though, everything is pretty new. I just assume every account I make is a throwaway for now.

[–] JoeKrogan@lemmy.world 2 points 1 year ago

Well I recommend to stay away from any closed source apps. Also make sure your password is unique to lemmy and use an email address that is not your primary email.

Be careful of clicking links and DMs. If using the browser use noscript and block scripts by default.

[–] JoeKrogan@lemmy.world 1 points 1 year ago

Well I recommend to stay away from any closed source apps. Also make sure your password is unique to lemmy and use an email address that is not your primary email.

Be careful of clicking links and DMs.

[–] iegod@lemm.ee 4 points 1 year ago (1 children)

OSS does not guarantee security, ever. Please let's not fall into false sense of security.I

[–] starman@programming.dev 3 points 1 year ago (1 children)

But in this case, if an app is open source, there is a higher chance of discovering that it sends your credentials somewhere else than in closed source app

[–] iegod@lemm.ee 1 points 1 year ago

That assumes people are looking at that and know what they're doing and aren't malicious actors. None of this is guaranteed. Famous examples of major OSS security vulnerabilities have already shown this.