OK there now is a LoginToken class. This was not the case last time I checked. Good. Thanks for your answers.

The jwt is invalidated once you logout.

Invalidated how?

You can also change/reset your password to invalidate all login tokens for your account.

OK. I was afraid this would not be the case. Thanks for confirming.

One thing to be aware of is that there is currently, AFAIK, no now (since 0.19.3) a way to “disable” a JWT.

Before that, once you had created it, if you leaked it, your account was, as far as I can tell, definitely compromised.

Now, it is possible to logout, to mark the JWT as “invalid”.

I will add, as a disclaimer, that I have not checked if that as Nutomic highlighted below, there are conditions (password change, etc) under which any or all JWT (user, instance, etc) become invalid. So do audit the code if this is something that concerns you. As far as I am concerned, I treat the JWTs as extra-sensitive information, and store them only on machines I own.

Edit: correct information in the light of Nutomic’s comments.

As people have answered, it already exists, but not every client has support.

Edit: how tf did you get downvoted in 8h on a dead post??? 😧

Hold on, is that a grant or a donation? (The difference is that a donation is definitive, while there are conditions, such as failing to fulfil an obligation, under which a grant has to be repaid)

Thanks for doing this. However, the saying goes “add foolproof measures, and the world will send better fools at you”, and I’m afraid this will lead to DDoS and other abuse vectors. But if the alternative is csam, then this is preferable, yes.

Another possibility would be to bypass the scanner for long term accounts with good standing and no history of abuse. That way, even in the event of a DDoS attempt by overloading the scanner, the regulars/old timers will be able to post. The system also has to make sure the trusted accounts don’t raise any flags either (sudden network change, host change, etc).

Edit: godamn, the swipe keyboard sure is convenient, but the amount of mistakes it types in is a bit much… I didn’t take the time to reread myself, and I should have.

I can’t wait for the first of April Lemmy RFC featuring actual lemmings… 😛

What’s the count now anyway?

expired

expired

expired

expired

expired

expired