this post was submitted on 19 Mar 2025
44 points (94.0% liked)
Voyager
6206 readers
263 users here now
The official lemmy community for Voyager, an open source, mobile-first client for lemmy.
Rules
- Be nice.
- lemmy.world instance policy
Sponsor development! 👇
💙
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I’m not sure how that would work. When you sign in you can use your username or email. So if you type [email protected] there is no way to know if you’re trying to login to the instance at domain.com or login with your email ending in domain.com, to some other instance.
Edit: and it can’t just assume and try domain.com first, because then if it’s not what the user intended then you just sent your login credentials accidentally to a random domain 🙃
You would only be able to login this way with your username. If you by mistake use your email, then it simply doesn’t resolve to a Lemmy server and the login fails.
[email protected] would simply fail, because that Lemmy instance does not exist.
But what if it does exist? But your have an email server on the same domain? Or what if that domain is being malicious and masquerading as a Lemmy instance to steal your credentials?
It doesn’t matter if there’s an email server or not.
I am not logging in with the credentials “[email protected]”. I am telling Voyager that I want to log into “Lemmy.wtf” with my user “Meldrik”. Before I type a password, the app will check if “Lemmy.wtf” exists and maybe even check if there is in fact a user named “Meldrik”. If all are true, then it will ask for password.
Something like that. I don’t know how Voyager works 😁
that’s still making assumptions about where you want to login to. The fact is that you can login, today, to Lemmy.world with “username” of “[email protected]” assuming Lemmy.wtf has an email server setup. And it’s not a safe assumption because users DO have email addresses saved in their passwords manager as a username for whatever random instance, and there should be a 0% chance of sending user credentials to the wrong domain.
I can’t just trust that domain to say they’re a Lemmy instance, and there is a user with that username on the domain. That’s trivial to exploit.
It’s true you can login with your email, instead of your username. But what I am saying is, in Voyager, it should only ask for your username+instance ([email protected]).
If I by mistake type my email: [email protected] it will obviously fail, right? Because there’s no Lemmy server at that domain.
You already validate Lemmy servers in Voyager, right? So if “[email protected]” doesn’t match a Lemmy server, an error would show.
I validate lemmy servers by asking the server if it's a lemmy server. If the protonmail.com is malicious and says, "sure I'm a lemmy server" then credentials would be sent to it, which is not good
If I typed the wrong domain here and it turned out it’s a malicious server pretending to be a Lemmy server, then what happens?
Also, wouldn’t it be highly unlikely that the users email domain is malicious?
You explicitly select the instance, so there is no question of what domain Voyager will contact. Also, on the next screen where you enter credentials, you see the domain and its icon, and you can click to open in the browser to further confirm that you are connecting to the correct instance (if you accidentally select the wrong one)
I can also enter the instance name myself on that screen and then it checks if it’s a Lemmy server, right?
So if there was a “login with username”, you would type your username@instance, then Voyager would check the domain and show the next page you are talking about, with a pre-filled username.
No, that wouldn't work for aforementioned reasons.
Edit: Also even if you did ignore the security concerns, this approach wouldn't work at all with OAuth flow that is planned. https://github.com/LemmyNet/lemmy/issues/1368
So I can’t type in a domain manually?