I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.

Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!

This isn’t to say that any current Lemmy app developers are for sure out to get you, but at this point, it’s quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!

  • similideano@sopuli.xyz
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    Voyager (formerly wefwef) is a self-hostable web app, so it doesn’t have this problem. Of course this only means you can inspect the code you’re running. You still have to able to understand the code to be sure it’s not doing anything malicious.

    • Zeth0s@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      Vojager can be easily modified and deployed. It is actually quite riskier than others if you don’t use trusted deployments

      • similideano@sopuli.xyz
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        A random deployment is certainly risky, but no riskier than a random apk. I’d argue the random deployment is less risky because it’s easier to inspect it in the browser and see what it’s doing with your password. But of course both are to avoid. Self-hosting or compiling your own clients if you can, official deployments or releases otherwise.