Feels like this will be a very common occurrence with people rushing to build and use new apps, and host new servers. There are plenty of positives to fediverse vs centralized, but it doesn’t come without negatives.
this post was submitted on 11 Jul 2023
409 points (97.2% liked)
Lemmy
12317 readers
7 users here now
Everything about Lemmy; bugs, gripes, praises, and advocacy.
For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.
founded 4 years ago
MODERATORS
I've been wondering that myself. I've only entered my pw into Jerboa, which is made by the Lemmy devs (and Liftoff once, but changed the pw since).
Now I only ever use FOSS apps, which all seem to be under some amount of scrutiny, but idk how much is enough.
I've always been particularly wary of Voyager/wefwef. Not that I wouldn't trust the devs, but the whole concept of entering a password into a 3rd page that only passes it onto the right page, damn that's just dumb on principle.
It's particularly weird since this is home for so many techies and privacy/security advocates.
Its less dumb than entering it into a regular app compiled into an apk, which is more opaque (even if it's also FOSS). Voyager you can host it yourself.
load more comments
(2 replies)
All of the apps have you enter your credentials into their page because Lemmy doesn't support OAuth2. I don't think it's fair to criticize Voyager for a problem that is currently inherent to all Lemmy apps.
Yea but it's a local form on the device and not a 3rd party server, which is another layer of insecurity. And I'm not sure how much of the rest of communication needs to get proxied too.
I dunno, that's just way beyond my comfort zone unless I really want to self-host that stuff.
Anyway, okay, nothing seems to be all that well secure at this point.
Trying to break Lemmy, yeah, let's prosecuted those bastards, but... WHAT. COULD. BE. MORE. WORTHLESS. than my account?
You are welcome to the scintillating points I have made. Bask in their brilliance.
it's about time to change that password and i think lemmy team should have an option in the settings to revoke access we give to third party apps....not sure if that's possible
Is this a password manager ad?
Is Memmy for Lemmy safe?
Nothing is safe.
Use a password manager and a unique random password for each service you sign up with. It's the only way to protect your accounts.
If you use push notifications you have to give the developer your access token, that could be stolen if the push server is hacked
As much as any other app I've seen, but I would still recommend using unique credentials for Lemmy.
Apps are bloated(they store a lot of cache on the disk) , just use the website.