3 ms·
My only issue with Mastodon is that it does not solve the issue of authenticity - you can't verify that a post sent by a user was not forged or modified by one
by AnaniasAnanas 8y ago
My only issue with Mastodon is that it does not solve the issue of authenticity - you can't verify that a post sent by a user was not forged or modified by one of the servers in the federation. This is where public key crypto could help.
- deleted 8y ago[deleted]
- RX14 8y agoThis is untrue, Actors have a keypair and inbox POSTs are signed with that key to ensure authenticity. For boosts (Announce), mastodon uses a complex signing algorithm based on JSON-LD, and pleroma just re-requests the post from the original instance and uses that, discarding the relayed object.
- NoGravitas 8y agoIt also (now) can verify that the @my_cool_username@mastodon.social is the same person/group as runs my_cool_web.site, by using a rel=me link on my_cool_web.site. So it ties verification to DNS, which is centralized enough to serve for that kind of verification. You can also prove that you hold both a mastodon identity and an identity on another social network, if the other social network lets you post rel=me links in your profile.