As Elon Musk critics flee from Twitter, Mastodon seems to be the most common replacement. In the last month, the number of monthly active users on Mastodon has rocketed more than threefold, from about 1 million to 3.5 million, while total number of users jumped from about 6.5 million to 8.7 million.
This substantial increase raises important questions about the security of this new platform, and for good reason. Unlike the centralized model of Twitter and virtually every other social media platform, Mastodon is built on a federated model of independent servers, known as instances. In this respect, it’s more akin to email or Internet Relay Chat (IRC), where security depends on the ability and attention of the admin who configured it and maintains each individual server.
The past month has seen the number of instances mushroom from about 11,000 to more than 17,000. The people running these instances are volunteers who may or may not be versed in the nuances of security. The difficulty of configuring and maintaining instances leaves plenty of room for mistakes that can put user passwords, email addresses, and IP addresses at risk of being revealed (more about that later). Twitter security left much to be desired, but at least it had a dedicated staff with a deep background in security.
Security cons
“I honestly think that’s the biggest concern facing security in space,” Mike Lendvay, a certified information security professional and certified cloud security professional who also runs the Mastodon instance friendsofdesoto.social. “Especially with the Twitter diaspora, you’ve had a lot of servers go up very quickly, and there’s going to be a very uneven amount of skill level in the people administering them.”
Another concern is the software powering the Mastodon platform. It has never undergone a formal security audit, although the European Commission sponsored a bug bounty program that resulted in patches for 35 valid bug submissions. Earlier this month, a researcher discovered a misconfiguration in multiple instances that allowed for the downloading and deleting of all files stored on the server and replacing every user’s profile picture.
The lack of an audit and years of robust security testing by outsiders means that serious security weaknesses are almost surely present.
To that point, a separate researcher this month discovered a server that had somehow managed to scrape the data of more than 150,000 users from a misconfigured server. Fortunately, the data was limited to account names, display names, profile pictures, following count, follower count, and last status update. A third vulnerability discovered this month on one instance made it possible to steal users’ plaintext passwords by injecting specially crafted HTML into the site.
Of course, all platforms have these sorts of vulnerabilities, and Mastodon developers and instance admins have been quick to patch them once reported. But other platforms have teams of security engineers, researchers, and compliance specialists who pore over recently patched vulnerabilities to ensure their platform runs up-to-date components. Mastodon’s federated structure can’t replicate this. Expecting volunteers to perform at the same scale as a centralized platform is unrealistic, to say the least.
The lack of dedicated security teams might be a problem, particularly in the event of a high-security vulnerability in the software ecosystem Mastodon relies on. The platform is built on Ruby on Rails, Postgres, and Redis. On the one hand, the combination of these three open source apps is tried and true, with use by notable platforms including GitHub, GitLab, Shopify, and Discourse.
But things could go badly if one of those apps is hit by something with the severity of something like HeartBleed, the 2014 bug in the open source OpenSSL app that caused the disclosure of all kinds of sensitive data from banking websites and other high-value targets.
What’s more, Mastodon software has no auto-update or even update-availability feature.
“You have to check the GitHub releases, personally,” Lendvay said. “I try to do that weekly. But for many, I would imagine they would hear through the grapevine. I’ve seen disparate versions running, so who knows what the consistency will be.”
Mastodon—or at least instances hosting widely known or influential users—is also likely to be much more susceptible to distributed denial-of-service attacks (DDos), which knock sites offline by bombing servers with more traffic or commands than they can handle. Centralized platforms with deep pockets consider DDoS mitigation servers as a basic cost. Volunteer-run instances aren’t likely to have the same resources. If Mastodon’s user base continues its current growth spurt, this susceptibility will likely be used to silence critics of all stripes.
Besides stealing data, hackers might also be tempted to hack the accounts of influential people or take control of administrative functions. In either case, the hacker could go on to impersonate influential users.
“I would bet money there are vulns in the ActivityPub protocol that will allow someone to broadcast a false toot attributable to a famous handle,” one user said. “Or there will be some other protocol issue found.”
Lastly, Mastodon is likely more susceptible to harassment and misinformation campaigns, assuming they run at scale.
“On personal security, there aren’t a lot of protections against harassment,” said Jon Pincus of the Nexus of Privacy. “Many instances aren’t well-moderated (including mastodon.social, which [Mastodon creator] Eugen [Rochko] runs). Even well-moderated instances can be overwhelmed by determined attacks.”