Found this when logging into the Lemmy.world Place canvas
- Saik0 ( @Saik0Shinigami@lemmy.saik0.com ) English26•11 months ago
While the login system works…
It’s ripe for abuse though. DMs are federated traffic and are not cryptographically secured in any form. So in theory a bad actor instance admin could spawn unlimited accounts and login… Or just sniff incoming requests from whatever instance this traffic is spawned from and obtain the login code.
For something like this, probably fine… But I wouldn’t use it for anything else, nor would I trust any app that does use this system.
- Shadow ( @Shadow@lemmy.ca ) English9•11 months ago
Their original system required you to enter your creds + OTP, so this is a huge improvement 🤣
- Saik0 ( @Saik0Shinigami@lemmy.saik0.com ) English1•11 months ago
That’s how I just logged in.
Gave instance, username on instance, and received inbox message on my lemmy instance. (also sniffed the message cause I was curious since I’m my instance admin)
- 𝒍𝒆𝒎𝒂𝒏𝒏 ( @lemann@lemmy.one ) English1•11 months ago
I think the original commenter meant "username+password+your Lemmy 2FA OTP” by creds
- Saik0 ( @Saik0Shinigami@lemmy.saik0.com ) English2•11 months ago
I think they meant that too… But that’s not what was provided to login.
I would not give up my instance password to another person. The list I provided was what I specifically provided.
- shootwhatsmyname ( @shootwhatsmyname@lemm.ee ) English8•11 months ago
This is just a OTP, not technically OAuth, right?
- 👁️👄👁️ ( @mojo@lemm.ee ) English6•11 months ago
I’ve seen you on the reddit alternatives sub, voat, ruqqus, and now here lmao. One day you’ll get a non member osrs account.
What was your name on Ruqqus? That place was great, minus the rampant racism.
The Ruqqus shutdown last year is what made me come to Lemmy full-time, taught me a good lesson on why you need federation
- 👁️👄👁️ ( @mojo@lemm.ee ) English4•11 months ago
My username was randomly generated and was 47RX6h. I mostly went on there to argue with right wingers but really I was just wasting my time lol. I got banned from most of the communities on there.
Oh wait, were you the one who started +OpenLeft?? I took over that community when you quit
- 👁️👄👁️ ( @mojo@lemm.ee ) English2•11 months ago
Nah starting communities is way too much effort, but I was arguing left wing talking points on the site
- AnarchoYeasty ( @AnarchoYeasty@beehaw.org ) English2•11 months ago
Voat is Nazi trash. Why were you and OP on there enough for you to recognize him?
- 👁️👄👁️ ( @mojo@lemm.ee ) English4•11 months ago
This was like within the first few months of Voat during one of the Reddit exoduses. I was on it for like a week in some meditation communities. Then yeah it pretty quickly turned into Nazi shit. Ruqqus was also Nazi shit.
- jerome ( @jerome@kbin.social ) 4•11 months ago
I did that too. It took me 5 mins.
- AnarchoYeasty ( @AnarchoYeasty@beehaw.org ) English2•11 months ago
Ruqqus? Is that named after Uncle Ruckus? Or just similar names.
- Psythik ( @Psythik@lemm.ee ) English3•11 months ago
What’s an “OAuth”?
- 🦊 OneRedFox 🦊 ( @OneRedFox@beehaw.org ) English1•11 months ago
It’s an open standard for granting clients access to APIs without needing to hand over things like your password each time.
- A10@kerala.party ( @A10@kerala.party ) English1•11 months ago
So far no bot infestations, was able to place some tiles and not run over by country flags …yet