Discussion
On the current spam wave some of you experience on the Fediverse: I think @stux is right by suspecting it might be one or more 3rd party apps that got hacked or are leaking authentication tokens.
So. Go to your account settings and check the "Authorized Apps" part. Revoke the permissions of apps you don't use anymore. Consider it housekeeping and make it a regular Todo :)
@gbargoud Could be a quick win for @MastodonEngineering to add a check for tokens that have not been used for, say, 12 months and show a warning/notification to the user to check if this token is still needed. Or maybe even automatically delete such tokens. @stux
@jwildeboer @gbargoud @MastodonEngineering I exactly suggested this yesterday to the dev team
Also password resets maybe after X time of inactive
@stux @jwildeboer @gbargoud The issue here is not stolen tokens, but users who reused their password somewhere else, or got their password leaked.
We recently merged https://github.com/mastodon/mastodon/pull/40745 which should help for inactive users.
For active users, they should configure 2FA, and we are working on prompting them to do so when they log in.
Install bonfire.cafe
Get the full app experience
@jwildeboer @stux
Finally enabled 2fa (been meaning to do that for a while) and cleaned out every authorized app I don't actively use.
I wonder why the authorization isn't time limited