Gregory's ServerI haven't ever tried to look through a mastodon database dump before, how easy is it to work with? lets say I was an FBI agent looking at the #Kolektiva dump, what sort of things could I do that I couldn't do by just signing up for an account? Looking at any DMs is an obvious one but what are some less obvious things?
 9 comments
 @galaxis @liaizon With a copy of the database, 2FA is a formality since the server needs to know the 2FA seed to match the provided codes. The seed could be encrypted using the account password but it's unlikely. In this specific case, strongly salted and hashed passwords is the actual line of defense. 2FA helps the other way around, when the cleartext password has been compromised any other way (phishing, social engineering, brute force) but the 2FA seed is unknown to the attacker.   @liaizon network analysis. Who follows who, who boosts, and faves. It would be hard to scrape all of that without being noticed. It doesn't sound like this was a target of the raid. But it will give them a clearer view of the movement than the movement has of itself. It's great intelligence for finding emergent leadership and good targets for turning into informants. @liaizon having it all in one place enriched with the network of dm contacts would be slightly better than public information. But they probably have all of that through packet tracing anyway. The longer term threat is that those connections are now recorded in their profiling graph and are available to machine learning efforts and usable by agents with bad agendas. (I.e. Arab teens that they groom into activists for counterterrorism clout) @liaizon would be interesting to get to know this too.... just incase things ever get bad |
@liaizon For something like the FBI, cross-checking accounts / email addresses with the data they already have is probably valuable? Then you can go from there and explore the network of accounts those are communicating with. Also identifies possible aliases of kolektiva.social users they already know by by their email address.
Also makes it theoretically possible to take over live accounts on kolektiva.social when the password is crackable and 2FA is off (which I would hope isn't the case for one of their admins / mods)?
In general the DB is pretty easy to work with given basic SQL knowledge - there's no overly convoluted interdependencies in there.
@liaizon For something like the FBI, cross-checking accounts / email addresses with the data they already have is probably valuable? Then you can go from there and explore the network of accounts those are communicating with. Also identifies possible aliases of kolektiva.social users they already know by by their email address.
Also makes it theoretically possible to take over live accounts on kolektiva.social when the password is crackable and 2FA is off (which I would hope isn't the case for one...