Lemmy Security Advisory for Versions < `0.19.1`: Private message details leak. [X post from !Announcements@lemmy.ml] ( lemmy.ml )

For those using Private message on Lemmy, there is a major vulnerability. It seems that this instance still runs 18.5

I know that our beloved admins are volunteers and busy, so I don't blame them for not updating, but while waiting for the update be aware that your PM are as public as your comments

can ,

On the matrix chat TheDude mentioned he was made aware of the vulnerability a while ago and has already patched it.

https://sh.itjust.works/pictrs/image/a3439fbe-04af-4ed0-95c6-5a54d9499c50.jpeg

And in case you're not aware, the direct messages here were never that private to begin with. Any admin of a federated instance has access so a bad actor could accomplish this with some dedication anyway.

Ziggurat OP ,

Good to know thas it was patched. Indeed, an issue with federated app is that, instance admin could be dishonest and spy us (while proprietary app will do it). But to my understanding the bug was fully public so a message like call me , on 0123 456 789 could reveal your phone number

can , (edited )

Even with this patched I would not advise stating your phone number expecting full security.

InEnduringGrowStrong ,
@InEnduringGrowStrong@sh.itjust.works avatar

I can confirm that DMs are not encrypted and are stored in clear text and therefore could technically be read by admins with database access.
While we are not actively looking or browsing through DMs, I'd still recommend not sharing anything sensitive through lemmy DMs and instead use something like Matrix or Signal.

RightHandOfIkaros ,

Lemmy has pretty lousy security in general, so really nobody should be storing any data on their Lemmy account that is important. Password, username, and any personally identifying information should never be shared across multiple sites or with other users, but this is just cybersecurity 100.

sugar_in_your_tea ,

Exactly. I don't even have my email connected because I'd rather not get a ton of spam when Lemmy gets hacked.

I did the same for Reddit, and I avoid any SM that requires me to associate my identity with it in any way.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • main@sh.itjust.works
  • test
  • worldmews
  • mews
  • All magazines
    •