Found this when logging into the Lemmy.world Place canvas
this post was submitted on 04 Aug 2023
103 points (96.4% liked)
Lemmy
12572 readers
3 users here now
Everything about Lemmy; bugs, gripes, praises, and advocacy.
For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
While the login system works...
It's ripe for abuse though. DMs are federated traffic and are not cryptographically secured in any form. So in theory a bad actor instance admin could spawn unlimited accounts and login... Or just sniff incoming requests from whatever instance this traffic is spawned from and obtain the login code.
For something like this, probably fine... But I wouldn't use it for anything else, nor would I trust any app that does use this system.
Their original system required you to enter your creds + OTP, so this is a huge improvement ๐คฃ
That's how I just logged in.
Gave instance, username on instance, and received inbox message on my lemmy instance. (also sniffed the message cause I was curious since I'm my instance admin)
I think the original commenter meant "username+password+your Lemmy 2FA OTPโ by creds
I think they meant that too... But that's not what was provided to login.
I would not give up my instance password to another person. The list I provided was what I specifically provided.