# Umbrel 0.4.8 is out with cryptographically secure default app passwords **URL:** \ **Category:** Announcements\ **Created:** [November 15, 2021, 2:05pm UTC](https://community.umbrel.com/t/umbrel-0-4-8-is-out-with-cryptographically-secure-default-app-passwords/4696 "2021-11-15T14:05:54Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![mayank](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.umbrel.com/mayank/32/26_2.png) [@mayank](https://community.umbrel.com/u/mayank)\ **Post date:** [November 15, 2021, 2:05pm UTC](https://community.umbrel.com/t/umbrel-0-4-8-is-out-with-cryptographically-secure-default-app-passwords/4696/1 "2021-11-15T14:05:54Z")
Umbrel 0.4.8 is now out with a new security feature — unique cryptographically secure default app passwords derived from your 24 secret words. This will help protect your Umbrel even if an app’s unique Tor URL gets leaked and you have not changed that app’s default password. ![Umbrel 0.4.8](https://canada1.discourse-cdn.com/flex030/uploads/getumbrel/original/2X/a/aded62c4df86855b41e5b348e020c7dedc908a7b.jpeg) We’re also currently investigating some incidents where funds were drained from users’ Lightning nodes on various node managers and operating systems, including Umbrel. While there is no evidence that funds were stolen due to leakage of Tor URLs of apps like ThunderHub that use static default passwords, we decided to release this feature on priority and to introduce an additional layer of security. If you have currently installed ThunderHub, Lightning Terminal, Ride The Lightning, Squeaknode or Code Server on your Umbrel, their default passwords will automatically upgrade to the newer, more secure passwords which can be found on their app store listing pages. In case you have already updated passwords of these apps manually, you can continue to use the same. ![Cryptographically secure default app passwords in Umbrel 0.4.8](https://canada1.discourse-cdn.com/flex030/uploads/getumbrel/original/2X/2/245c816bc0f8b44f42423d6395ab761ada78305e.jpeg) Twitter announcement: [https://twitter.com/getumbrel/status/1460245730971451392](https://twitter.com/getumbrel/status/1460245730971451392) ---
**Author:** ![DarthCoin](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.umbrel.com/darthcoin/32/1628_2.png) [@DarthCoin](https://community.umbrel.com/u/DarthCoin)\ **Post date:** [November 15, 2021, 4:24pm UTC](https://community.umbrel.com/t/umbrel-0-4-8-is-out-with-cryptographically-secure-default-app-passwords/4696/2 "2021-11-15T16:24:10Z")
Take also in consideration this aspect. Some users were already blaming Umbrel for being “insecure”, but they never look into their own backyard (router)… > **[AT&T Alien Labs finds new Golang malware (BotenaGo) targeting...](https://cybersecurity.att.com/blogs/labs-research/att-alien-labs-finds-new-golang-malwarebotenago-targeting-millions-of-routers-and-iot-devices-with-more-than-30-exploits)** > > Executive summary > > AT&T Alien Labs™  has found new malware written in the open source programming language Golang. Deployed with more than 30 exploits, it has the potential of targeting millions of routers and IoT devices. > > Key... ---
**Author:** ![wvdg](https://avatars.discourse-cdn.com/v4/letter/w/7bcc69/32.png) [@wvdg](https://community.umbrel.com/u/wvdg)\ **Post date:** [November 15, 2021, 7:17pm UTC](https://community.umbrel.com/t/umbrel-0-4-8-is-out-with-cryptographically-secure-default-app-passwords/4696/3 "2021-11-15T19:17:13Z")
Nice! There seems to be a small formatting problem that I did not see in the previous version (my umbrel server just completed syncing today :). ![image](https://canada1.discourse-cdn.com/flex030/uploads/getumbrel/original/2X/1/123b4895ff10f1368ac8d948512c1fa1c363507d.png) ---
**Author:** ![DHD](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.umbrel.com/dhd/32/485_2.png) [@DHD](https://community.umbrel.com/u/DHD)\ **Post date:** [November 15, 2021, 10:41pm UTC](https://community.umbrel.com/t/umbrel-0-4-8-is-out-with-cryptographically-secure-default-app-passwords/4696/4 "2021-11-15T22:41:57Z")
@DarthCoin I’m glad that I don’t even have any of those routers listed on that website, as it’s an authentic Cisco router and I always check for updates weekly no matter what. ---
**Author:** ![retinadoc](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@retinadoc](https://community.umbrel.com/u/retinadoc)\ **Post date:** [November 16, 2021, 3:06am UTC](https://community.umbrel.com/t/umbrel-0-4-8-is-out-with-cryptographically-secure-default-app-passwords/4696/5 "2021-11-16T03:06:17Z")
Hi, Thanks for this update. My BTCPay server app still lists the old version in the App Store. Is there something I need to do to get it up to the current version? My Umbrel is on the latest version. ---
**Author:** ![PumbrelWumbrel](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@PumbrelWumbrel](https://community.umbrel.com/u/PumbrelWumbrel)\ **Post date:** [November 16, 2021, 6:28am UTC](https://community.umbrel.com/t/umbrel-0-4-8-is-out-with-cryptographically-secure-default-app-passwords/4696/6 "2021-11-16T06:28:36Z")
How do we manually change the password of thunderhub and lightning terminal? If they are not changed anyone granted access to device will be able to use those applications fully because the default unchanged password will be exposed to them in the app store menu. ---
**Author:** ![DarthCoin](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.umbrel.com/darthcoin/32/1628_2.png) [@DarthCoin](https://community.umbrel.com/u/DarthCoin)\ **Post date:** [November 16, 2021, 8:37am UTC](https://community.umbrel.com/t/umbrel-0-4-8-is-out-with-cryptographically-secure-default-app-passwords/4696/7 "2021-11-16T08:37:56Z")
As it says in the announcement: Updating to 0.4.8 it will force to create cryptographic all new passwords. When you enter into your dashboard (with your regular password) and go to the apps, you will see a small box with the new password. Did you read the announcement? Is right there an image showing you. ---
**Author:** ![5.10](https://avatars.discourse-cdn.com/v4/letter/5/dfb087/32.png) [@5.10](https://community.umbrel.com/u/5.10)\ **Post date:** [November 21, 2021, 2:59pm UTC](https://community.umbrel.com/t/umbrel-0-4-8-is-out-with-cryptographically-secure-default-app-passwords/4696/8 "2021-11-21T14:59:13Z")
Mayank, is it realistic to add WireGuard to the app store? ---
**Author:** ![lightning-cortado](https://avatars.discourse-cdn.com/v4/letter/l/2acd7d/32.png) [@lightning-cortado](https://community.umbrel.com/u/lightning-cortado)\ **Post date:** [October 12, 2022, 8:10am UTC](https://community.umbrel.com/t/umbrel-0-4-8-is-out-with-cryptographically-secure-default-app-passwords/4696/9 "2022-10-12T08:10:10Z")
Hey guys, out of which 24 words is this default app password derived?