Edit: obligatory explanation (thanks mods for squaring me away)…
What you see via the UI isn’t “all that exists”. Unlike Reddit, where everything is a black box, there are a lot more eyeballs who can see “under the hood”. Any instance admin, proper or rogue, gets a ton of information that users won’t normally see. The attached example demonstrates that while users will only see upvote/downvote tallies, admins can see who actually performed those actions.
Edit: To clarify, not just YOUR instance admin gets this info. This is ANY instance admin across the Fediverse.
Check this comment for details on Lemmy’s security. https://lemmy.world/comment/765991
TL;DR: Password security is fine. Server doesn’t get your plaintext password.
I didn’t read the source code too deeply, but it appears the server receives the password, and only then it is hashed. How does it work?
Is it option 1 or 2 (or other). If option 1 an evil admin can collect the password, or am I misinterpreting something?
If the threat is an evil admin who can change the code it doesn’t matter. The admin could change the server code to store unencrypted passwords, they could change the client code to send unencrypted passwords, they could make clients post plaintext passwords whenever you login. Hashing is damage control incase someone absconds with the password database.