I would be cautious about viewing any Lemmy.world communities right now, and the Beehaw admins should make sure their credentials are locked down in case they get targeted next.

you are viewing a single comment's thread
view the rest of the comments

[–] loobkoob@kbin.social 26 points 1 year ago* (last edited 1 year ago) (1 children)

Surely it's not really any different to any other website's admin having their account hacked/their password socially engineered? It's not an inherent flaw in the fediverse as a whole, just a human issue.

EDIT: see @Zephyrix's comment below. It was a security flaw.

[–] Zephyrix@kbin.social 9 points 1 year ago* (last edited 1 year ago) (1 children)

This was not a social engineering. It was a JavaScript injection that stole browser cookies, bypassing password changes and 2FA.

However, it seems lemmy.world was running a custom version of the UI. So it's possible that it only affected their instance. Hard to say at this point.

[–] loobkoob@kbin.social 2 points 1 year ago

Oh, well in that case it's a little more concerning. But I don't expect it to be a long-term issue. It certainly isn't a serious blow to my confidence in the security of the fediverse, that's for sure! It being a somewhat minor breach may be a blessing, also; it means there'll almost certainly be more of a focus on security going forward before something more serious happens.