D-sign Studio 10/Shutterstock Pillowfort (Licensed) Ana Valens

After security woes, Tumblr alternative Pillowfort promises relaunch

Users found 'old school' exploits after the site's debut.

 

Ana Valens

Internet Culture

Published Mar 23, 2021   Updated Mar 23, 2021, 1:15 pm CDT

Pillowfort, the NSFW-friendly Tumblr social media alternative, is set to return in April. The social media network announced the news on Friday after a turbulent winter launch.

Featured Video Hide

A message on the Pillowfort website explains that the site, which initially launched its free public registrations on Jan. 25, had “some security-related issues” that required the site to be pulled offline for a full overview and investigation.

Advertisement Hide

Pillowfort is onboarding a security consultant for a sitewide evaluation during the end of March, the site notes, and now projects a relaunch “sometime before the end of April 2021.” The social media network initially planned for an end of March reopening.

“Meanwhile, our developers are using the downtime to complete a thorough assessment of Pillowfort and finish systemic improvements of our site’s security & permission checks from the top down to strengthen our platform in the long term, and to ensure such issues do not occur again,” the site’s message says.

Pillowfort’s January launch was marked with a series of bugs and exploits that would allow HTML-based user exploits, or cross-scripting attacks, Vice reports. This included an HTML injection that would sign users out through an image load request, sparking fears that malicious users could implement scripts to steal user data.

Advertisement Hide

These exploits raised concerns for Pillowfort’s target demographic, which includes ex-Tumblr users, adult content creators, and sex workers. Sex workers, in particular, may be at serious risk if a security flaw or exploit leads to a personal data leak.

In a Q&A posted on Twitter on March 19, Pillowfort said its team restructured “certain parts of Pillowfort’s coding, as well as our development process itself” to make sure the previous vulnerabilities “will not arise again.”

“While completing this process is lengthy & inconvenient to our current user base due in part to limited resources & staffing, we are confident the end result of our new audit & site restructure benefit’s Pillowfort’s long-term longevity,” Pillowfort tweeted.

Advertisement Hide

The Daily Dot reached out to Pillowfort for comment.


Must-reads on the Daily Dot

Post Office accused of using facial recognition as part of covert surveillance program
Video allegedly shows Jewish diners being attacked, incident to be investigated as possible hate crime
Bella Hadid’s fans are mad at Dior due to an unverified rumor
Sign up to receive the Daily Dot’s Internet Insider newsletter for urgent news from the frontline of online.

Share this article
*First Published: Mar 23, 2021, 12:56 pm CDT