I noticed that there were some accounts that were hijacked by the instance owners. All the posts from that user were then edited to say what happened.
This kind of surprised me, I figured instances could delete posts, but not edit them. So how much control do they have?
I assume they can’t see my password (hopefully). Can they post in my name? Do they have all the access to my posts to foreign instances that they do over local posts?
Edit: thanks for all the responses everyone! I’ve wanted my own instance for a while, but maybe I’ll get on it now
Just to correct the people who say they can’t see your password - this is only true if they’re running a stock copy of lemmy, which hashes passwords in the database.
They’re free to modify their instance however they want, including storing unencrypted passwords or emailing your password on registration to a bot farm.
Always use a unique password for every site you use.
Before people get worried about this, this is how literally any online service works. If you have an account anywhere, you trusted that service to not record your password.
Only exception is oauth, which actually might be a good idea for Lemmy.
An instance owner having access to the database can surely change the password to access the account and then change it back. If you’re the server owner, you can do anything you want directly on the database.
Yes but if I was a dick, I’d just harvest their passwords silently and then try them on other websites.
[This comment has been deleted by an automated system]
Oh boy, I have a bad feeling about this
Or even modifying the login page to send and store unencrypted passwords to get passwords from people who already registered long ago