this post was submitted on 19 Jun 2023
6 points (100.0% liked)

Technology

39806 readers
45 users here now

A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.

Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.

Subcommunities on Beehaw:


This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 3 years ago
MODERATORS
 

I used a tool to see how many users my site had. Once I saw the count was larger than expected, I wondered who these users were. I checked the database table and saw a huge list. I know for a fact that all these users are not on my instance. I was able to confirm that the database includes email address and password hash. This SHOULD mean that if someone tries to login, and their authentication information is sitting in my database, they can login at my site locally, correct? I only ask because I did not find an entry anywhere that lists a “home” instance for them to log in to. Am I correct in understanding that accounts are distributed like communities are?

top 3 comments
sorted by: hot top controversial new old
[–] rknuu@beehaw.org 4 points 2 years ago* (last edited 2 years ago)

Yep, but its only the Metadata[1]. I can't log in to your instance, but because your instance has consumed content from beehaw from my account I'm listed.

See https://lemmy.ninja/u/rknuu@beehaw.org

  1. at least I haven't been able to share logins between instances yet.
[–] dead@keylog.zip 0 points 2 years ago* (last edited 2 years ago) (1 children)

People from different instances are not able to login on your instance. For example you might see me in the people table, but local should be false. People registered on your instance shows up on local_users and on people with local set to true.

There have been mass registrations going on recently. Imagine my surprise when my 3 people instance had 460 users but no one online today. Took my instance down to investigate and deleted all local users in person table except the known users. Not the cleanest way to do it but I don't think I broke anything :D

[–] Kerb@discuss.tchncs.de 1 points 2 years ago* (last edited 2 years ago)

That reminds me of an incident we had.
On of our customers sites suddenly had hundred's of new signups.

It turns out a hacker tried to fuzz the site,
and since there was no captcha/spam protection in the signup form he created hundred's of accounts.