this post was submitted on 12 Dec 2021
37 points (100.0% liked)
Lemmy
12715 readers
69 users here now
Everything about Lemmy; bugs, gripes, praises, and advocacy.
For discussion about the lemmy.ml instance, go to [email protected].
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
We've recently removed that logging line, which logged all websocket requests. But yes most importantly, the database stores no plaintext passwords.
You don't want to client side hash passwords before sending, because different clients might not do it the same way. But also we have to add oauth at some point, so 3rd party clients don't even have to know your pass. This is less important with open source apps imo, which are the only ones we're gonna link to anyway, but it'd be nice to have.
That's very nice. Thank you for your hard work! I am curious about oauth. I did not know that 3 rd party clients needed to know the password, I will look into that!