4 ms·
This is untrue, Actors have a keypair and inbox POSTs are signed with that key to ensure authenticity. For boosts (Announce), mastodon uses a complex signing al
by RX14 8y ago
This is untrue, Actors have a keypair and inbox POSTs are signed with that key to ensure authenticity. For boosts (Announce), mastodon uses a complex signing algorithm based on JSON-LD, and pleroma just re-requests the post from the original instance and uses that, discarding the relayed object.
- NoGravitas 8y agoIt also (now) can verify that the @my_cool_username@mastodon.social is the same person/group as runs my_cool_web.site, by using a rel=me link on my_cool_web.site. So it ties verification to DNS, which is centralized enough to serve for that kind of verification. You can also prove that you hold both a mastodon identity and an identity on another social network, if the other social network lets you post rel=me links in your profile.