I noticed that there were some accounts that were hijacked by the instance owners. All the posts from that user were then edited to say what happened.

This kind of surprised me, I figured instances could delete posts, but not edit them. So how much control do they have?

I assume they can’t see my password (hopefully). Can they post in my name? Do they have all the access to my posts to foreign instances that they do over local posts?

Edit: thanks for all the responses everyone! I’ve wanted my own instance for a while, but maybe I’ll get on it now

  • Shadow@lemmy.ca
    link
    fedilink
    arrow-up
    71
    ·
    1 year ago

    Just to correct the people who say they can’t see your password - this is only true if they’re running a stock copy of lemmy, which hashes passwords in the database.

    They’re free to modify their instance however they want, including storing unencrypted passwords or emailing your password on registration to a bot farm.

    Always use a unique password for every site you use.

    • James@lemmy.ca
      link
      fedilink
      arrow-up
      22
      ·
      edit-2
      1 year ago

      Before people get worried about this, this is how literally any online service works. If you have an account anywhere, you trusted that service to not record your password.

      Only exception is oauth, which actually might be a good idea for Lemmy.

    • Michal@discuss.tchncs.de
      link
      fedilink
      arrow-up
      4
      ·
      1 year ago

      An instance owner having access to the database can surely change the password to access the account and then change it back. If you’re the server owner, you can do anything you want directly on the database.

    • amos@lemmy.world
      link
      fedilink
      arrow-up
      3
      ·
      1 year ago

      Or even modifying the login page to send and store unencrypted passwords to get passwords from people who already registered long ago