IMPORTANT PASSWORD SECURITY/PRIVACY ISSUE
----

For everyone:

If you are using the same password for Mastodon that you use anywhere else, CHANGE YOUR PASSWORD NOW.

A hacker is stealing accounts on Mastodon using something called “credential stuffing.” This means they use email/password combinations stolen from other sites.

This is a common hacking technique. But right now someone is targeting Mastodon accounts.

This is not a security flaw with Mastodon. Someone is just using it across Mastodon.

You can check if your email is in a data breach elsewhere:

https://haveibeenpwned.com

Create a new strong password:

1. 12+ characters
2. Capital/lowercase letters
3. At least one special character

For admins:

The hacker is using the same unique user agent.

Go-http-client/1.1

We’re seeing a pattern of IPs, but they’re from varying ISPs. They’re also not changing the account emails.

#Mastodon #Password #InfoSec #OpSec #Security #Privacy #Hacked #Hacker