A loosely moderated place to ask open-ended questions
Search asklemmy ๐
If your post meets the following criteria, it's welcome here!
Looking for support?
Looking for a community?
~Icon~ ~by~ ~@Double_[email protected]~
Just to correct the people who say they can't see your password - this is only true if they're running a stock copy of lemmy, which hashes passwords in the database.
They're free to modify their instance however they want, including storing unencrypted passwords or emailing your password on registration to a bot farm.
Always use a unique password for every site you use.
An instance owner having access to the database can surely change the password to access the account and then change it back. If you're the server owner, you can do anything you want directly on the database.
[This comment has been deleted by an automated system]
A lot of people here mentioned that passwords are hashed, but unless I missed it no one pointed out the following:
The admin of your instance controls your login form and they can pull your password when you log in. So, as others mentioned: always use unique passwords, never ever reuse them.
In general a server admin can do anything they want on their own instance.
Federation wise I'd say if your home instance is the bad actor you are screwed, if it's another instance then their capabilities for mischief hare probably (hopefully?) more limited. And any such action would likely cause a swift defederation of the malicious instance
[This comment has been deleted by an automated system]
Lemmy needs GPG signatures!
Admins would still be able to change your key, wouldn't they?
Sure but you can also post your public key somewhere else for people to verify.
Or instances could store public keys of users from other instances, sorta like blockchain validation.
[This comment has been deleted by an automated system]