Hacker News Reader

Comment by throwaway0x7E6 | Hacker News Reader

>Anyway, a reminder that the moderator of your Mastodon server can read your DMs

holy shit

If you give your messages to a service provider of course they can read it. Same as if you give your messages to twitter, facebook, your telecom operator or anyone else. Either make sure that the party is trustworthy or make sure the service is end-to-end encrypted.

yeah, but it was trivial to implement E2EE, and I'd expect such a recent protocol to have it

There's work on it, and implementing it at the protocol level may not be as easy, obvious, or as helpful as it seems.

https://github.com/soatok/mastodon-e2ee-specification

https://twitter.com/LeaKissner/status/1592937764684980224

Why do you think it's trivial to implement E2EE? It's extremely complicated to do it in a way that works well, and handling things like backup/restore of messages, how to handle key recovery in case of lost devices/logins, how to allow parties to verify each other are all extremely complicated questions both technologically and socially.

the alternative to those inconveniences is random peole running your instance being able to read your correspondence

So you don't have an answer to why you think it's trivial to implement E2EE?

it would've been during development, yeah. less so now, with many servers already deployed. it would be a clusterfuck like the email.

Same as every online service. There's always admins (even on Twitter of course) who can read the DMs (unless you have proper end-to-end encryption).

FYI: especially now that Elon Musk owns Twitter.. And fired everyone who is not loyal.. The idea of reading DMs of employees at competing companies is not far fetched at all.

Aren't companies much more tightly controlled than a random dude who hosts a mastodon server though ?

Every company is different, but anybody with access to the database or tools can do whatever they want. There might be a papertrail(that can sometimes be edited if it's centralized and you have sufficient privileges) but there is much less "regulation" than you think. Nobody from the government comes over like some kind of health inspector to make sure Employee 93457X isn't spying on people.

I mean... in theory? But see the history of social media privacy scandals.

Really, Mastodon shouldn't call the feature DM at all, IMO. It's effectively just a normal message with special visibility rule.

I wouldn't put a whole lot of trust in that.

Reply on news.ycombinator.com