Looks like you’re right, admins will just need to update the JWT secret.
Looks like you’re right, admins will just need to update the JWT secret.
Really curious to see how they kill the existing tokens, and whether admins have tools to easily clear all sessions. On one of the Matrix chats someone suggested that the tokens have a one year expiry date!
Smart move. I’m surprised more instances aren’t doing this.
FWIW, right now it seems unlikely that your password was accessible to anyone. Your login cookie may have been taken if you accessed Lemmy on a web browser (apps are likely fine), so you would want to clear your Lemmy cookies and cache once this is over.
But I’m speculating, and changing your password will definitely help!
This seems to be a front-end JavaScript exploit, so theres’s a good chance that this is a Lemmy problem, not a Lemmy[dot]world problem. Don’t be surprised if the issue starts spreading to other instances.
If I were running a server, I would take it offline until a patch is released (Beehaw did this, to be proactive).
This was a great overview. I hadn’t heard about the DAN method, and it’s fascinating!
I’m shocked this isn’t replacing the original Series S at $300.
Glad you posted, I’ve been looking for this info as well. Hopefully as Lemmy matures they can add things like this to the onboarding process. Especially for servers like this one that require an email address.
I keep seeing Vlemmy mentioned but I guess I missed the drama. Did the server admin unexpectedly shut the server down?