@wsocial.eu - I was one of the first to subscribe after Davos, but now I wonder what's the use of WSocial. We had to show our ID to get access, but now it seems there are many backdoors without the need for verification. Maybe I just go back to Mastodon. Nice try, but I feel a little betrayed.
W Social (@wsocial.eu)
It is not strange at all. We where among the first users to signed up. As communicated 👇 wsocial.eu/profile/wsoc...
Wimster9030 🇪🇺 🇧🇪 (@wimster9030.wsocial.eu)
I know, Daniel, but that's not the way WSocial "sold" it to us. We could only access trough ID-verification so we know for 100% they are EU and a "real person". That was the whole point. So we went trough that process, but now it seems that the backdoor are the other ATProt platforms to get in too.
wdonthavetime.selfhosted.social/wsocial-reporting
Scripts for observing public data on the W Social PDS, pds.wsocial.network. They only read what the server already makes public, and none of them need a login.
wdonthavetime.selfhosted.social/wsocial-reporting
Scripts for observing public data on the W Social PDS, pds.wsocial.network. They only read what the server already makes public, and none of them need a login.
Elena Rossini 🌈 (@_elena@mastodon.social)
Attached: 2 images I just refreshed the #WSocial website and it's showing a MAJOR redesign... with a label at the top stating "built on the open AT-protocol." This is the first time ever they acknowledge this – I know, as I've been visiting their website for MONTHS and also never heard about this in any interviews. So the claims in my exposé stand (the Internet Archive's Wayback Machine would confirm this). Of note: they changed their URL from wsocial.eu to wsocial.news BTW thanks for all your feedback ❤️
⠠⠵ avuko (@avuko@infosec.exchange)
@elena@aseachange.com @aral@mastodon.ar.al I couldn't resist, so I've wasted my precious time looking at "W Identity" today. Things are not right. It is basically a repurposed https://github.com/PeterWaher/IoTGateway Just look here: https://root.widentity.eu/Settings/Master.md It has a socks4(?) open on port 1080, some xmpp stuff on 5222 and 5269, another (seemingly broken) version of the website on 8088. The following pages are accessible without auth: (found by a simple "`egrep -LR 'Privilege:|Login:' * |grep md | grep Root`" through the source) ``` /Settings/PersonalData/LocalDatabase.md /Settings/PersonalData/LocalSensorsAndDevices.md /Settings/PersonalData/EventLogs.md /Settings/PersonalData/NetworkIdentity.md /Settings/PersonalData/WebPages.md /Settings/PersonalData/Backups.md /Settings/Master.md /Copyright.md /Starting.md [http response 307] /Login.md /Entities.md /Templates/Repeat.md /AdminDropdownComponent.md /Script.md /AdminDropdown.md /AlertPopup.md /Master.md /PromptPopup.md /ConfirmPopup.md /Markdown.md /Emojis.md /Smileys.md /Index.md /MarkdownEditor.md /ScriptColors.md /Master.md ``` Others pages also exist (no 404), but are only available after login. Which brings me to the biggest problem of all. This is an **ADMIN** interface. Nobody should **ever** put an admin interface to an identity management platform on the internet. #WSocial #Widentity
Elena Rossini 🌈 (@_elena@mastodon.social)
Scoop: #WSocial has been experiencing major technical problems for over a week: it is effectively a ghost town, filled with thousands of new accounts that cannot use the platform. Because my new article contains a possible solution to their problem, by the time you read this the issue may have been fixed. Or not. It has been going on for 7+ days, with complete radio silence by its developers and founders. My exclusive: 🔗 : https://blog.elenarossini.com/w-social-a-broken-ghost-town/ #SocialMedia #ATproto #RateLimiting
W Social (@wsocial.eu)
1/5 We’ve upgraded W’s verified badge to give you more context about the person behind the keyboard. Real humans. More trust. Your real name stays optional.
Kirsten Fiedler (@kiki.eurosky.social)
🤦♀️ #WSocial is posting legal names, nationalities and approx. birthdays of verified users as a public record on the Atmosphere. Confronted, they claim it's "by design" 🤯
@wsocial.eu - I was one of the first to subscribe after Davos, but now I wonder what's the use of WSocial. We had to show our ID to get access, but now it seems there are many backdoors without the need for verification. Maybe I just go back to Mastodon. Nice try, but I feel a little betrayed.
Have you been Wned? W Social says it respects your #privacy. But how much of your personally identifiable information is published by them to the open web for anyone to find? wdonthavetime.tngl.io/wsocial-wned/ #WSocialFacts #WSocial
Have you been Wned: Has W Social made your personal information public?
wdonthavetime.tngl.ioIf WSocial sold people on the idea that everyone they would interact with is ID-verified, then indeed, every single open ATProto community would act as a back door of sorts. The only way for them to deliver would be to de-federate entirely. And it's always a bad idea to bet against openness.
Wimster9030 🇪🇺 🇧🇪
I know, Daniel, but that's not the way WSocial "sold" it to us. We could only access trough ID-verification so we know for 100% they are EU and a "real person". That was the whole point. So we went trough that process, but now it seems that the backdoor are the other ATProt platforms to get in too.
It looks like W Identity, the part of @wsocial.eu that checks your papers before you go in, has a very basic XSS on its admin backend, found hours after launch. This seems almost too predictable... Cyberfriends, any thoughts on how bad? 23.social/@kantorkel/116767220594438841
kantorkel (@kantorkel@23.social)
23.socialHoly fucking shit guys im a W Social trusted verifier wsocial.eu/profile/scanash.com
Scan
W Social is the biggest lie on the AT Protocol
Holy fucking shit guys im a W Social trusted verifier wsocial.eu/profile/scanash.com
Scan
W Social is the biggest lie on the AT Protocol
