Asklemmy

43892 readers

971 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

Open-ended question
Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
Not ad nauseam inducing: please make sure it is a question that would be new to most members
An actual topic of discussion

Looking for support?

Looking for a community?

Lemmyverse: community search
sub.rehab: maps old subreddits to fediverse options, marks official as such
!lemmy411@lemmy.ca: a community for finding communities

~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~

founded 5 years ago

MODERATORS

148

What are the cybersecurity weaknesses of the Fediverse? (waveform.social)

submitted 1 year ago by Scientician@waveform.social to c/asklemmy@lemmy.ml

68 comments fedilink hide all child comments

Most of us are Reddit refugees, and probably clicking more random links than we ever did before on websites we've never seen before. This whole experience feels like the old internet, but also throws up insane red flags with a modern internet perspective. What are the cybersecurity weaknesses we should all be looking for, and what are the best practices?

Here's my reason for posting this. As I search for new communities across instances to follow, I sometimes end up clicking a link and I'm no longer logged in. In the corner, that could be a Sign In link or it could be phishing. It's likely due to me not understanding how to properly navigate this system, but there's nothing stopping someone from setting up a sight like this as far as I know.

Thoughts?

you are viewing a single comment's thread
view the rest of the comments

[–] gvasco@discuss.tchncs.de 15 points 1 year ago* (last edited 1 year ago) (1 children)

Use a mail forwarding service to generate disposable e-mails used to sign up, if you accidentally give it to someone else it doesn't expose any other accounts and can be easily replaced by a new one.
Use a password manager to ensure a strong and unique password.
Use a JavaScript blocker so you only allow the required JavaScript to make the website work and prevent automatic downloads.

I've been doing these in general recently and it's good privacy a security practice. Also slowly replacing my main e-mail address in different service accounts with disposable forwarding e-mail addresses.

Edit: Other than that read a bit more about Lemmy and fediverse workings, verify what instance you're viewing and navigate to the desired community via your instance as others have mentioned.

[–] henfredemars@infosec.pub 11 points 1 year ago* (last edited 1 year ago)

I would like to underline and insist on using unique passwords. Many users like myself are joining small instances to get better performance and reduce the strain on the main servers, but anyone can spin up an instance and then poof, your password is gone if they can get you to sign up!

This was always the case for normal websites on the internet however. I strongly recommend everyone use a good password manager to prevent one breach from cascading into a breach of all your accounts. It's good OPSEC.

Also, check which instance you're signing into before you give them your password. Accidentally trying to log into the wrong instance with an account for a different instance is the same as handing them your password. A community could easily be hosted on some tiny server somewhere by a guy named Joe and do you trust him with your password?