Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
mas.to is one of the many independent Mastodon servers you can use to participate in the fediverse.
Hello! mas.to is a fast, up-to-date and fun Mastodon server.

Administered by:

Server stats:

12K
active users

mas.to: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

Public
Rob Hafner :verified_bi:

In exciting news I appear to be part of one of the first data breaches of the fediverse era!

I got this email 20 minutes ago letting me know my data migration from mastodon.social was dumped in a breach.

I'm going to be honest, I've got some opinions on the fact that a public bucket is used to store archives, with just obfuscation to stop people from downloading them.

Hello tedivm, Early morning Feb 24 we were indirectly made aware of a misconfiguration on our object storage domain (files.mastodon.social) that allowed anyone to see the list of all uploaded files. Within 30 minutes this mistake was corrected. However, we have reasons to believe that the issue has existed since Feb 2, when we began upgrading our infrastructure. Normally Mastodon relies on long, randomly generated file names with high entropy to ensure that certain files are accessed only by those who know the link. However, that misconfiguration allowed that measure to be bypassed. Most files in our object storage are public in nature—profile pictures, custom emojis, images and videos attached to public posts. But there is a type of file that should never be accessed by anyone but its owner, and it’s the user’s archive takeout. Unfortunately, your archive takeout was among those in the system when the incident occurred. We have immediately deleted all archive takeouts to prevent anyone from downloading them, but we have reasons to believe that at least some of them were downloaded by unauthorized parties. Archive takeouts contain the following information: * Your public profile * Your favorites * Your bookmarks * Your posts and media attachments (including followers-only and mention-only posts)
They DO NOT contain your e-mail address or any other Personal Identifiable Information from your account, excepting anything you've manually put in your public profile or shared in posts. No action is required on your part. We apologize sincerely for this mistake. We are changing the Mastodon software to not rely on high entropy links for access control to archive takeouts any longer, as well as adding an automated check into the admin dashboard to detect similar misconfigurations and notify other server operators about them. Security is important to us and we are continuously improving our processes as we scale our organization from one employee to multiple to ensure that mistakes like this do not happen in the future. Eugen Rochko | CEO Mastodon gGmbH joinmastodon.org | e: hello@joinmastodon.org
#mastodon#infosec#fediverse
Mark Wyner Won’t Comply :vm:

@tedivm agree about the obfuscation method. But their transparency is really important here. There’s integrity in that, especially as part of an open-source community.

Mar 17, 2023, 07:57 PM·Public
0boosts·2favorites
Public
Rob Hafner :verified_bi:

@markwyner this notification was required by law since they fall under GDPR

ExploreLive feeds
About