4 ms·

>Anyway, a reminder that the moderator of your Mastodon server can read your DMs holy shit

kirab 4y ago
Same as every online service. There's always admins (even on Twitter of course) who can read the DMs (unless you have proper end-to-end encryption). FYI: especially now that Elon Musk owns Twitter.. And fired everyone who is not loyal.. The idea of reading DMs of employees at competing companies is not far fetched at all.
- lm28469 4y ago
  Aren't companies much more tightly controlled than a random dude who hosts a mastodon server though ?
  - orange_fritter 4y ago
    Every company is different, but anybody with access to the database or tools can do whatever they want. There might be a papertrail(that can sometimes be edited if it's centralized and you have sufficient privileges) but there is much less "regulation" than you think. Nobody from the government comes over like some kind of health inspector to make sure Employee 93457X isn't spying on people.
  - deleted 4y ago
    [deleted]
  - rsynnott 4y ago
    I mean... in theory? But see the history of social media privacy scandals. Really, Mastodon shouldn't call the feature DM at all, IMO. It's effectively just a normal message with special visibility rule.
  - JohnFen 4y ago
    I wouldn't put a whole lot of trust in that.
SahAssar 4y ago
If you give your messages to a service provider of course they can read it. Same as if you give your messages to twitter, facebook, your telecom operator or anyone else. Either make sure that the party is trustworthy or make sure the service is end-to-end encrypted.
- throwaway0x7E6 4y ago
  yeah, but it was trivial to implement E2EE, and I'd expect such a recent protocol to have it
  - Kye 4y ago
    There's work on it, and implementing it at the protocol level may not be as easy, obvious, or as helpful as it seems. https://github.com/soatok/mastodon-e2ee-specification https://github.com/soatok/mastodon-e2ee-specification https://twitter.com/LeaKissner/status/1592937764684980224 https://twitter.com/LeaKissner/status/1592937764684980224
  - SahAssar 4y ago
    Why do you think it's trivial to implement E2EE? It's extremely complicated to do it in a way that works well, and handling things like backup/restore of messages, how to handle key recovery in case of lost devices/logins, how to allow parties to verify each other are all extremely complicated questions both technologically and socially.
    - throwaway0x7E6 4y ago
      the alternative to those inconveniences is random peole running your instance being able to read your correspondence
      - SahAssar 4y ago
        So you don't have an answer to why you think it's trivial to implement E2EE?

Same as every online service. There's always admins (even on Twitter of course) who can read the DMs (unless you have proper end-to-end encryption). FYI: especially now that Elon Musk owns Twitter.. And fired everyone who is not loyal.. The idea of reading DMs of employees at competing companies is not far fetched at all.

lm28469 4y ago
Aren't companies much more tightly controlled than a random dude who hosts a mastodon server though ?
- orange_fritter 4y ago
  Every company is different, but anybody with access to the database or tools can do whatever they want. There might be a papertrail(that can sometimes be edited if it's centralized and you have sufficient privileges) but there is much less "regulation" than you think. Nobody from the government comes over like some kind of health inspector to make sure Employee 93457X isn't spying on people.
- deleted 4y ago
  [deleted]
- rsynnott 4y ago
  I mean... in theory? But see the history of social media privacy scandals. Really, Mastodon shouldn't call the feature DM at all, IMO. It's effectively just a normal message with special visibility rule.
- JohnFen 4y ago
  I wouldn't put a whole lot of trust in that.

SahAssar 4y ago

If you give your messages to a service provider of course they can read it. Same as if you give your messages to twitter, facebook, your telecom operator or anyone else. Either make sure that the party is trustworthy or make sure the service is end-to-end encrypted.

throwaway0x7E6 4y ago
yeah, but it was trivial to implement E2EE, and I'd expect such a recent protocol to have it
- Kye 4y ago
  There's work on it, and implementing it at the protocol level may not be as easy, obvious, or as helpful as it seems. https://github.com/soatok/mastodon-e2ee-specification https://github.com/soatok/mastodon-e2ee-specification https://twitter.com/LeaKissner/status/1592937764684980224 https://twitter.com/LeaKissner/status/1592937764684980224
- SahAssar 4y ago
  Why do you think it's trivial to implement E2EE? It's extremely complicated to do it in a way that works well, and handling things like backup/restore of messages, how to handle key recovery in case of lost devices/logins, how to allow parties to verify each other are all extremely complicated questions both technologically and socially.
  - throwaway0x7E6 4y ago
    the alternative to those inconveniences is random peole running your instance being able to read your correspondence
    - SahAssar 4y ago
      So you don't have an answer to why you think it's trivial to implement E2EE?