Note
This information is based off of early reports I have seen. I don't claim to know the extent to which any damage was done and as such recommend a password reset (two-factor authentication would not be of use if authentication tokens were compromised), but we do know that this was a Javascript injection.
Update
As of right now, it seems that the vulnerability should have only exposed JWTs, which have been invalidated by those instance administrators. I'd still recommend a password rotation just because, but you should be alright.
==========
With the recent Lemmy.world incident, I'd like to update you all. This vulnerability could not have affected you had you been using only Memmy while browsing. It was a Javascript injection, and as Memmy does not execute any Javascript, there is no attack surface here.
The only case where this could have affected you would be if you had been signed in to your account inside of the in-app browser or the default browser and opened one of these posts. That however would not be something with Memmy itself, but rather the accessing of the PWA.
Regardless, as we don't actually know what happened, I'd recommend changing passwords. If any JWTs were compromised during this, regardless of 2FA status these tokens could be used to authenticate with your account.
From what I have seen, this was an issue that was limited to Lemmy.world, as supposedly they were running a custom frontend build. Other than that, I don't know anything else.
Also, for the record, there is only one instance in this application where a webview is used, which is when viewing the terms of service which simply loads a local file from the app assets.
Any questions, I'll try to answer them but you'd be better off asking people more knowledgeable about the incident.
As always, this is a good time to go over your online security practices.
It is strongly recommended that you use a password manager such as Bitwarden or 1Password if you do not use one already. This can help prevent credential surfing if you have used the same password over many sites, preventing you from having several of your accounts breached from a single breach.
If you have used a password on Lemmy.world that you have used on other sites, you should change those other sites passwords immediately.
Email addresses may have been breached during the attack and this may result in increased spam and phishing emails. It is strongly advised that you throughly verify any emails that you receive after this, particularly ones relating to login requests, messages from banks or payment providers, such as PayPal or government institutions.
Thank you for using Memmy and stay safe!
As an aside to this, I noticed that I could no longer interact with posts including upvoting etc until logging out and logging back in. As the current version I am using doesn’t seem to have a “log out” button anywhere obvious, I tried changing the password to some nonsense in the “account setting” tab and pressing “save”. Naturally this resulted in an error. Re-entering the correct password again and pressing “save” seems to have fixed it for now.
edit: I just noticed I have to repeat this process every time the memmy app is closed out and re-opened, which is unfortunate.
edit 2: as pointed out by ktgd, afoutopatisa and others, there’s no need to enter nonsense and then your original password again, you can simply hit “save” in your original settings and refresh to achieve the same result
You should be able to click edit on the account and then hit save again. That will regenerate your login token. I didn’t need to touch the password field.
Thanks for the tip, this worked
I could not figure out how to reset everything inside of Memmy for the longest time
This needs to be pinned to the top of Memmy community! My Traverse tab was broken and I couldn’t upvote or comment. That’s all I had to do to fix it. Thanks
Thanks for the tip! Tapping “save” did the trick.
This worked for me, but it is very unintuitive. Would be better to have an explicit logout option.
Agreed!