this post was submitted on 10 Jul 2023
3271 points (99.3% liked)
Lemmy.World Announcements
28383 readers
3 users here now
This Community is intended for posts about the Lemmy.world server by the admins.
Follow us for server news ๐
Outages ๐ฅ
https://status.lemmy.world
For support with issues at Lemmy.world, go to the Lemmy.world Support community.
Support e-mail
Any support requests are best sent to [email protected] e-mail.
Report contact
- DM https://lemmy.world/u/lwreport
- Email [email protected] (PGP Supported)
Donations ๐
If you would like to make a donation to support the cost of running this platform, please do so at the following donation URLs.
If you can, please use / switch to Ko-Fi, it has the lowest fees for us
Join the team
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
How does this impact those using mobile apps like Jerboa or Liftoff, instead of the website directly?
Check the pinned post on liftoff community page.
https://lemmy.world/post/1292303
As a safety precaution logged-on sessions on many servers have been cancelled and you are required to logon again.
Thanks, I'll do that. Curiously, the lemmy.ml account keeps working, wonder what it depends on.
Probably cause they haven't cancelled the session
as someone who uses the app, extremely little effect from my experience, I didn't notice something was wrong at all until people pointed it out due to how liftoff does the whole sidebar thing for the instance.
It's still better to change your account password and clear your cache.
Was wondering this myself. Is there a way for users who where exposed to know about it?
(Edit) Eg if the exploit was through a post get notified if they saw the post?
apparently they posted it as a weird image or emoji that looked like this:
HOLY SHIT I LUCKED OUT LMAO, I ALMOST CLICKED ON THAT EARLIER
no need for clicking. if you saw it, it did execute code that stole your cookie (atleast on desktop..dunno about how it is in apps). they tried to steal admin accounts wirh that.
There is no need to get notified, they didn't steal passwords, just session cookies. Most (all?) servers have invalidated all the user login cookies, but if you are in doubt, just logging out and back in should be enough to get a new cookie.