foxpeter17 @lemmy.world
Posts 0
Comments 1
With the recent hack, there is now irrefutable proof of malicious actors trying to break Lemmy and steal user accounts. Please be careful about entering your password into random Lemmy apps!
That's not how tokens work. Tokens are (usually short-lived) credentials that are passed to a client after it authenticated e.g. with username + password. But the password is never contained in a token. They are also not encrypted, but signed, meaning the Lemmy instance can verify that the plain-text token ist authentic. Also, not the decoding algorithm has changed, but the signing key was rotated, meaning all JWTs created before the signing key rotation would not look authentic anymore