I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.
Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!
This isn’t to say that any current Lemmy app developers are for sure out to get you, but at this point, it’s quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!
Are there any known apps that should be avoided? I’m using Mlem and Memmy.
Not yet, this post is just a warning that it might happen
Not sure about the other apps, but Memmy keeps your password stored in the app. But generally speaking I don’t think Gavin is a malicious person. He spent 3 weeks with beta tests before he was even comfortable pushing it to Apple App Store and the code is reviewed by Apple before being included to watch for malicious scripting. I am not saying people don’t get malicious scripts passed through Apple, but from what I have seen of Gavin’s work, he doesn’t seem the type that would do that.
Closed source ones.
It’s not about any specific app.
They are just using many words to say ‘remember logging in on these apps means giving them your full username/password.’
We really need a better way to log in from 3rd parties. It’d be nice if we could crowd fund features, I’d def pay up for some sort of app-password system or other
I agree with this completely.
Obviously you should only input account credentials into an app you trust, but shouldn’t a properly designed Lemmy app not store the credentials in plain text at all? (And definitely never send them somewhere else) Authorize the user through the API and then it’s just an authenticated session, no need to store the username/password at all until you sign out.
I suppose if you have fast user switching it might need to store it. Hmmmm.