TeqGo.com
No Result
View All Result
No Result
View All Result
TeqGo.com
No Result
View All Result
Home Computer

How secure a Twitter replacement is Mastodon? Let us count the ways

Staff by Staff
December 11, 2022
in Computer
0
How secure a Twitter replacement is Mastodon? Let us count the ways
466
SHARES
1.5k
VIEWS
Share on FacebookShare on Twitter


Getty Images

As Elon Musk critics flee from Twitter, Mastodon seems to be the most common replacement. In the last month, the number of monthly active users on Mastodon has rocketed more than threefold, from about 1 million to 3.5 million, while the total number of users jumped from about 6.5 million to 8.7 million.

This substantial increase raises important questions about the security of this new platform, and for good reason. Unlike the centralized model of Twitter and virtually every other social media platform, Mastodon is built on a federated model of independent servers, known as instances. In this respect, it’s more akin to email or Internet Relay Chat (IRC), where security depends on the ability and attention of the admin who configured it and maintains each individual server.

The past month has seen the number of instances mushroom from about 11,000 to more than 17,000. The people running these instances are volunteers who may or may not be versed in the nuances of security. The difficulty of configuring and maintaining instances leaves plenty of room for mistakes that can put user passwords, email addresses, and IP addresses at risk of being revealed (more about that later). Twitter security left much to be desired, but at least it had a dedicated staff with a deep background in security.

Security cons

“I honestly think that’s the biggest concern facing security in space,” Mike Lendvay, a certified information security professional and certified cloud security professional who also runs the Mastodon instance friendsofdesoto.social. “Especially with the Twitter diaspora, you’ve had a lot of servers go up very quickly, and there’s going to be a very uneven amount of skill level in the people administering them.”

Advertisement

Another concern is the software powering the Mastodon platform. It has never undergone a formal security audit, although the European Commission sponsored a bug bounty program that resulted in patches for 35 valid bug submissions. Earlier this month, a researcher discovered a misconfiguration in multiple instances that allowed for the downloading and deleting of all files stored on the server and replacing every user’s profile picture.

The lack of an audit and years of robust security testing by outsiders means that serious security weaknesses are almost surely present.

To that point, a separate researcher this month discovered a server that had somehow managed to scrape the data of more than 150,000 users from a misconfigured server. Fortunately, the data was limited to account names, display names, profile pictures, following count, follower count, and last status update. A third vulnerability discovered this month on one instance made it possible to steal users’ plaintext passwords by injecting specially crafted HTML into the site.

Of course, all platforms have these sorts of vulnerabilities, and Mastodon developers and instance admins have been quick to patch them once reported. But other platforms have teams of security engineers, researchers, and compliance specialists who pore over recently patched vulnerabilities to ensure their platform runs up-to-date components. Mastodon’s federated structure can’t replicate this. Expecting volunteers to perform at the same scale as a centralized platform is unrealistic, to say the least.

The lack of dedicated security teams might be a problem, particularly in the event of a high-security vulnerability in the software ecosystem Mastodon relies on. The platform is built on Ruby on Rails, Postgres, and Redis. On the one hand, the combination of these three open source apps is tried and true, with use by notable platforms including GitHub, GitLab, Shopify, and Discourse.

But things could go badly if one of those apps is hit by something severe like HeartBleed, the 2014 bug in the open source OpenSSL app that caused the disclosure of all kinds of sensitive data from banking websites and other high-value targets.

Advertisement

What’s more, Mastodon software has no auto-update or even update-availability feature.

“You have to check the GitHub releases, personally,” Lendvay said. “I try to do that weekly. But for many, I would imagine they would hear through the grapevine. I’ve seen disparate versions running, so who knows what the consistency will be.”

Mastodon—or at least instances hosting widely known or influential users—is also likely to be much more susceptible to distributed denial-of-service attacks (DDos), which knock sites offline by bombing servers with more traffic or commands than they can handle. Centralized platforms with deep pockets consider DDoS mitigation servers a basic cost. Volunteer-run instances aren’t likely to have the same resources. If Mastodon’s user base continues its current growth spurt, this susceptibility will likely be used to silence critics of all stripes.

Besides stealing data, hackers might also be tempted to hack the accounts of influential people or take control of administrative functions. In either case, the hacker could go on to impersonate influential users.

“I would bet money there are vulns in the ActivityPub protocol that will allow someone to broadcast a false toot attributable to a famous handle,” one user said. “Or there will be some other protocol issue found.”

Lastly, Mastodon is likely more susceptible to harassment and misinformation campaigns, assuming they run at scale.

“On personal security, there aren’t a lot of protections against harassment,” said Jon Pincus of the Nexus of Privacy. “Many instances aren’t well-moderated (including mastodon.social, which [Mastodon creator] Eugen [Rochko] runs). Even well-moderated instances can be overwhelmed by determined attacks.”





Source link

Previous Post

14 Best Portable Battery Chargers (2022): For Phones, iPads, Laptops, and More

Next Post

Dyson’s $949 Headphones Claim to Purify the Air You Breathe

Next Post
Dyson’s $949 Headphones Claim to Purify the Air You Breathe

Dyson’s $949 Headphones Claim to Purify the Air You Breathe

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recommended.

“Please slow down”—The 7 biggest AI stories of 2022

“Please slow down”—The 7 biggest AI stories of 2022

December 27, 2022

What animal poops out of mouth?

August 23, 2022

Trending.

What happened to Andrew Humphrey on Channel 4 weather?

August 24, 2022

Why is Ben Bailey leaving WDIV?

August 24, 2022

Who is the new weather man on Channel 4 Detroit?

August 24, 2022

What is a 100000 year period called?

August 23, 2022

Who recently left WDIV?

August 24, 2022
  • About us
  • Contact Us
  • Home
  • Privacy Policy and Disclaimer

© 2021-2023 Teqgo.com

No Result
View All Result
  • About us
  • Contact Us
  • Home
  • Privacy Policy and Disclaimer

© 2021-2023 Teqgo.com