7 ms·
Yes. If you follow me, you tell my my server that you want my posts to be delivered to you. That means my server has to know your account exists. I also have
by edent 3y ago
Yes.
If you follow me, you tell my my server that you want my posts to be delivered to you.
That means my server has to know your account exists.
I also have to know that you follow me because I can export my followers if I move to a new service.
My server can choose to publicise the relationship. So anyone looking through my social graph will see "fsckboy follows edent".
By default, I believe the current Mastodon software does show that relationship - but only to me, people on my instance, and people on your instance. No one else. I'm happy to be corrected on that though.
In theory, an attacker could scrape the social graph of every user in the entire fediverse and build a list of who you follow from that. I don't think that's a realistic threat.
- fsckboy 3y ago>That means my server has to know your account exists. That doesn't mean your server has to share my data without checking my prefs. If the community is privacy conscious, and it works this way, they're idiots. Taking the attitude "well, a bad actor could share your data anyway, so we'll just have everybody share it anyway" is not privacy conscious at all.
- kissgyorgy 3y agoNot sure what you mean by privacy when everything is literally public on the Fediverse. Users should be aware of that fact.
- deleted 3y ago[deleted]
- mariusor 3y agoThat is wrong, not everything is public on the Fediverse. Usually the content which is published with the Public namespace as a recipient is public, the rest of the activities are only disseminated to just the recipient's and author's servers. There might be bad actors, or badly implemented software which don't do that, but the Fediverse is composed of more than just Mastodon.
- superb_dev 3y agoIn this case the other server is just anyone with an http client. The fediverse is completely open you can crawl the whole thing yourself
- 3np 3y ago> In theory, an attacker could scrape the social graph of every user in the entire fediverse and build a list of who you follow from that. I don't think that's a realistic threat. In practice, multiple entities across the proficiency-spectrum are already doing this. An average motivated CS undergrad or two could certainly pull it off. Up to you if you find that a threat, as with anything.
- fallat 3y ago> I don't think that's a realistic threat oh boy, i think you just declared a challenge .
- appplication 3y agoHonestly I think it is pretty realistic. The content is public, what about this would be particularly difficult?
- diggan 3y agoI don't think it's difficult per se, it would just take long time, as most implementations have pretty low rate limits so the crawl would be slow.
- omoikane 3y agoMaybe they meant it's not a threat because people don't care about who they are following being revealed, since it used to be publicized on Twitter. Though note that Twitter has a "list" feature that allows users to differentiate people they follow versus contents that they want to read[1], whereas Fediverse's "list" feature is more of a filter since users must follow an account first before it can be placed on a list[2]. I think the workaround for Mastodon would be to bookmark profile pages for people you want to check on but don't want to follow. [1] https://lee-phillips.org/howtotwitter/ https://lee-phillips.org/howtotwitter/ [2] https://docs.joinmastodon.org/methods/lists/#accounts-add https://docs.joinmastodon.org/methods/lists/#accounts-add