Conversation

Notices

1. Doc Edward Morbius ⭕ (dredmorbius@mastodon.cloud)'s status on Wednesday, 19-Apr-2017 06:24:28 UTC Doc Edward Morbius ⭕

   Is Mastodon private? Does it protect your privacy?

   No, not really.

   Everything you post is public. Your follower and following lists are public. Even your "private" unlisted and direct messages ... are best described as "limited notification scope".

   Why does this matter?

   Consider Thailand's legal threat against SocMed followers of its critics:

   https://globalvoices.org/2017/04/19/thailand-tells-internet-users-to-unfollow-junta-critics-on-social-media-or-face-consequences/

   • Hallå Kitteh repeated this.
   • Maiyannah Bishop (maiyannah@plateia.org)'s status on Wednesday, 19-Apr-2017 06:26:44 UTC Maiyannah Bishop

     in reply to
     @dredmorbius Furthermore, it is important to remember that the moment one of their limited-scope notices hits a GNU social or postActiv server they will become public.
     Hallå Kitteh likes this.
     Hallå Kitteh repeated this.
   • Hallå Kitteh (clacke@social.heldscal.la)'s status on Wednesday, 19-Apr-2017 08:22:02 UTC Hallå Kitteh

     in reply to

     • Maiyannah Bishop
     Mastodon has federated messages with privacy advisory? That's a huge issue if they don't even check which servers claim to implement it.
   • MMN-o ✅⃠ (mmn@social.umeahackerspace.se)'s status on Wednesday, 19-Apr-2017 08:22:22 UTC MMN-o ✅⃠

     in reply to

     • ostatus
     @dredmorbius Well, with !OStatus you can subscribe (using the Atom feed in an ordinary feed reader) to people through Tor without having to identify yourself as a supporter.
     
     Or you can create pseudonymic accounts through Tor (even if the target profile doesn't support it, because you only ever interact with the instance you trust).
     
     As long as you don't give away your real name (or behaviour or metadata), and maybe just use your !OStatus instance as a feed reader, it's only positive that everything is public. How else would you criticise the junta in Thailand?
   • Maiyannah Bishop (maiyannah@plateia.org)'s status on Wednesday, 19-Apr-2017 08:22:47 UTC Maiyannah Bishop

     in reply to

     • Hallå Kitteh
     @clacke They don't.  HLA has had several messages come across it with private scopes that have ended up public because the extras in the Magic Envelope get discarded by GS/pA
     Hallå Kitteh repeated this.
   • MMN-o ✅⃠ (mmn@social.umeahackerspace.se)'s status on Wednesday, 19-Apr-2017 08:23:26 UTC MMN-o ✅⃠

     in reply to

     • MMN-o ✅⃠
     @dredmorbius But as I read your post again I see that your criticism was rather against the "privacy" through obscurity on a web service. Check.
   • Hallå Kitteh (clacke@social.heldscal.la)'s status on Wednesday, 19-Apr-2017 09:03:03 UTC Hallå Kitteh

     in reply to

     • Hallå Kitteh
     Friendica has privacy advisory and OStatus federation, along with a big warning sign that privacy doesn't apply when you're including OStatus people.
   • Tobias (tobias@social.diekershoff.de)'s status on Wednesday, 19-Apr-2017 09:24:32 UTC Tobias

     in reply to

     • Hallå Kitteh
     @clacke I think you are referring to an old behavior of Friendica. If a contact group you are posting a message to, contains an OStatus contact, that one will not get the message. The warning popup also now informs about that the message will not be delivered to those contacts.
     Hallå Kitteh likes this.
     Hallå Kitteh repeated this.
   • Hallå Kitteh (clacke@social.heldscal.la)'s status on Wednesday, 19-Apr-2017 09:32:18 UTC Hallå Kitteh

     in reply to

     • Tobias
     @tobias @dredmorbius Thanks for the update. Haven't used it for years. I was on parlementum.net's instance back in the day.
   • Hallå Kitteh (clacke@social.heldscal.la)'s status on Wednesday, 19-Apr-2017 09:37:10 UTC Hallå Kitteh

     • Maiyannah Bishop
     • The Mysterious Em
     @themysteriousem @maiyannah Time and attention. Diaspora does this, other platforms will probably do it in time.
     
     Note though, that XMPP has the same privacy issues as unencrypted e-mail, Diaspora, ActivityPub or anything else that requires you to trust your server admin not to peek in the inboxes.
     
     Client-side key management in a generic browser is not a solvable problem, depending on your attack scenario. See https://blog.cryptpad.fr/2017/03/24/What-is-Zero-Knowledge/ for a counter-argument.
   • Hallå Kitteh (clacke@social.heldscal.la)'s status on Wednesday, 19-Apr-2017 12:55:36 UTC Hallå Kitteh

     • Jookia
     @jookia Gonna need an addon either way. Native browser interface is one, EME possibly another.