Asklemmy

43956 readers

966 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

Open-ended question
Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
Not ad nauseam inducing: please make sure it is a question that would be new to most members
An actual topic of discussion

Looking for support?

Looking for a community?

Lemmyverse: community search
sub.rehab: maps old subreddits to fediverse options, marks official as such
[email protected]: a community for finding communities

~Icon~ ~by~ ~@Double_[email protected]~

founded 5 years ago

MODERATORS

[email protected]

How much control/access does my instance owner haver over my account? (lemy.lol)

submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

48 comments fedilink hide all child comments

I noticed that there were some accounts that were hijacked by the instance owners. All the posts from that user were then edited to say what happened.

This kind of surprised me, I figured instances could delete posts, but not edit them. So how much control do they have?

I assume they can't see my password (hopefully). Can they post in my name? Do they have all the access to my posts to foreign instances that they do over local posts?

Edit: thanks for all the responses everyone! I've wanted my own instance for a while, but maybe I'll get on it now

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 69 points 1 year ago (4 children)

Just to correct the people who say they can't see your password - this is only true if they're running a stock copy of lemmy, which hashes passwords in the database.

They're free to modify their instance however they want, including storing unencrypted passwords or emailing your password on registration to a bot farm.

Always use a unique password for every site you use.

[–] [email protected] 18 points 1 year ago* (last edited 1 year ago)

Before people get worried about this, this is how literally any online service works. If you have an account anywhere, you trusted that service to not record your password.

Only exception is oauth, which actually might be a good idea for Lemmy.

[–] [email protected] 4 points 1 year ago (2 children)

An instance owner having access to the database can surely change the password to access the account and then change it back. If you're the server owner, you can do anything you want directly on the database.

[–] [email protected] 5 points 1 year ago

Yes but if I was a dick, I'd just harvest their passwords silently and then try them on other websites.

[–] [email protected] 3 points 1 year ago* (last edited 1 year ago)

[This comment has been deleted by an automated system]

[–] [email protected] 3 points 1 year ago

Oh boy, I have a bad feeling about this

[–] [email protected] 2 points 1 year ago

Or even modifying the login page to send and store unencrypted passwords to get passwords from people who already registered long ago