I signed up kbin.social but have since decided to go all in on Lemmy. I’ve tried all day to delete my account on kbin but it won’t let me. Once I click the delete confirmation pop up it simply reloads the feed and keeps your account.
Be warned. Currently you have no control over your data there. I think that settles it for me. I won’t be using that service again.
One thing that definitely worries me with federation in general is the barrier to entry to hosting an instance is low, by design. On one hand this is great, but on the other hand it means just about anyone can spin up an instance and collect usernames, passwords, emails, etc. from anyone who signs up
I know this is obviously no better than an single giant corporation who can do that. But it’s interesting to think about.
I’m definitely not suggesting kbin.social is doing this by the way. Your post just spurred this thought for me
I am once again reminded of the always relevant XKCD comic
I do see and understand the concern, and honestly, I don’t see a way around it. At some point, you have to supply some information to access services, especially if you want any sort of customization to your experience. I guess if you are really concerned about it, don’t use that email/password/username combo anywhere else.
Edit: Apologies, I am still figuring out how formatting works here.
People should be using a password manager in 2023. No password reuse if you automatically generate new 20+ character passwords for each website or service you use.
Agreed. I use 1Password and love it.
I use Bitwarden, thinking about deploying a local copy of Vaultwarden as a backup as well. I’d be in trouble if access to Bitwarden’s servers went down.
Remember folks, use a password manager and get it to create a random strong password for every site you use
I believe the passwords are stored as hashes, not sent directly to the server, at least I certainly hope so.
They’re sent directly to the server and stored as hashes. There’s nothing stopping someone from logging the plaintext password, or removing the hash mechanism, though. Make sure to follow best practices and use a unique password on every website.
Yeah, this has been on my mind too. Certainly new instances shouldn’t be discouraged, and it helps lighten the load for all the other instances. At the same time, I personally am not sure I’d feel comfortable on a newer instance that doesn’t have a demonstrated history; Beehaw’s stated goals and origin (and having several admins in case one goes dark) helps reassure me.