2218
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 09 Jul 2023
2218 points (97.9% liked)
Technology
34430 readers
247 users here now
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
founded 5 years ago
MODERATORS
The federation API isn't using E2E either. It makes no difference if you use your mobile client to contact the mobile API or if you're hosting your own instance to use the federation API in safety regards. You should always be aware that every message / post / image you publish (even in a closed group) in the internet could be traced back to you and with enough afford be available to anybody with the right skills.
Only end to end encryption can help you there - this is the way.
Is it even possible to implement E2E in the context of ActivtyPub? I mean, as far as I know, the federation doesn't specify what content you send, only activities, groups and object definitions. There's nothing stopping you from making the actual data E2E encrypted, altough making it so would be a hard problem.
On the other hand... As I've mused about in the other comments, it should be possible to create a fediverse app that serves as a self-hosted front-end for interacting with different fediverse apps. All of your personal data would live on it, and you are in full control. Which would also allow for a safe implementation of E2E, because you just publish your public key, and know that since the app is under your control, noone can get to it. However, this would mean that the other users whould have to use the same standart.
I actually really like that idea. If we can separate users from servers with content, so Lemmy instances would only host posts and comments, but DMs would be handled by the private user instances, it would make Fediverse a lot more private.
The only question standing in the way is - who hosts the content of the posts I make? If my home is programming.dev, and I post to lemmy.ml, do I send the post data through ActivityPub to Lemmy to host, or do I host in on programming.dev, and Lemmy.ml just gets the ID of the post? If it's first one, making the self-hosted user frontend will be easy, since all you need is a few API calls to make posts, and the only storage you need is for DMs and your account details (which may actually static, so a faked webpage returning your data may suffice). If it's the latter, then it will be a lot more difficult to easily self-host.
There is also the question of trust: The best solution should be an infrastructure that is due to E2E not able to read the messages it processes. The problem with this setup is, that you want to communicate publicly and you never know, who is part of your communication. I would advice to use signal or matrix if you need E2E. If not, use either Tor to proxy lemmy and try to stay anonymous or be aware, that your messages are not (which is always the best approach in my opinion).
Yes however they can't get your phone without nearly as easily as a third party's data