🚨 Kolektiva.social SECURITY ALERT 🚨
This is an alert for Kolektiva.social users. Please read this post in its entirety!
In mid-May 2023, the home of one of Kolektiva.social's admins was raided, and all their electronics were seized by the FBI. The raid was part of an investigation into a local protest. Kolektiva was neither a subject nor target of this investigation. Today, that admin was charged in relation to their alleged participation in this protest.
Unfortunately, at the time of the raid, our admin was troubleshooting an issue and working with a backup copy of the Kolektiva.social database. This backup, dated from the first week of May 2023, was in an *unencrypted* state when the raid occurred and it was seized, along with everything else.
The database is the heart of a Mastodon server. A database copy such as the one seized may include any of the following user data, in this case up to date as of early May 2023:
- User account information like the e-mail address associated with your account, your followers and follows, etc.
- All your posts: public, unlisted, followers-only, *and direct ("DMs")*.
- Possibly IP addresses associated with your account - IP addresses on Kolektiva.social are logged for 3 days and then deleted, so IP addresses from any logins in the 3 days prior to the database backup date would be included.
- A hashed ("encrypted") version of your password.
🚨 👉 As a precaution we highly recommend that all users on Kolektiva.social *change their password immediately* to a new, unique, and strong password.
We sincerely apologize to all our users and regret this breach. In hindsight, it was obviously a mistake to leave a copy of the database in an unencrypted state. Unfortunately, what would otherwise have been a small mistake happened to coincide with a raid, due to bad luck and spectacularly bad timing.
We understand that our users and other people on the Fediverse will have a lot of questions. We will try to answer them as best we can, but please be patient and bear in mind that we may be overwhelmed with messages, and may be delayed in responding or unable to provide answers to certain questions for legal or technical reasons. As a security culture reminder, it can be extremely harmful to the individuals charged and to our community to openly speculate on the Internet about alleged criminal activity or about what law enforcement may be able to do with seized data. Our present awareness is that the seized Kolektiva data is unrelated to the federal investigation and prosecution and we are exploring legal avenues to have the seized data returned and copies destroyed.
Thank you for your understanding and solidarity :black_sparkling_heart:
👇 Please see our replies to this post for additional information (1/?) 👇
The FBI raided one of the admins of Kolektiva and a full copy of the website's database, dated early-may, was among the data seized. Full details in the linked URL.
Kolektiva.social is a Mastodon instance focused on radical politics and activism, with about 6.6K active users. One of the largest open-signup instances of its kind.
To quote a thread from somebody who did a good job explaining:
For people who are not really up on how federation works regarding kolektiva.social's database news above, instances serve you content that has been federated to the server you're on. Which means for you to see it, your local server has downloaded a copy.
So if you are on a third party server and have been boosted onto tls of people on kolektiva, share DMs or private posts with people on kolektiva, that content is stored on their servers too, not just yours.
Private media, for example, is not just in the hands of your admin. It is in the hands of the admins of followers or people you dm on other servers etc
And I know a lot of people who are familiar with mastodon software or have been here forever see this as a 'well duh', which I've seen come up a lot already from the usual suspects, but a lot of people don't know how this stuff works and with some things, like this, it can be really important.
To quote a thread from somebody who did a good job explaining:
It's really lame how a lot of these open source projects don't have a "privacy policy" that educates people on what types of communication are secure.