Like most social networks, Mastodon is not end-to-end encrypted.
-
@FediTips as a server admin I think it's worth mentioning that the techy skills required to read users' DMs are pretty trivial. I could do it very easily if I wanted.
Of course I don't, and won't, but I assume there are circumstances where I could be compelled to hand them over to law enforcement or something and I don't think I or the users would want to be in that position!
If you're a techy person they're trivial, but if you're e.g. running it on managed hosting the admin doesn't even get database access (though of course the hosting company staff do).
There's also the complication of moderating DMs, if someone reports it it becomes visible to the admin through Mastodon itself.
-
If you're a techy person they're trivial, but if you're e.g. running it on managed hosting the admin doesn't even get database access (though of course the hosting company staff do).
There's also the complication of moderating DMs, if someone reports it it becomes visible to the admin through Mastodon itself.
@FediTips oh good point. I forget about the hosted services.
-
If you need an E2EE messaging but with a UI that even your toddler can work with, you can try #DeltaChat https://delta.chat
Other than that, you can also try #Matrix, and #XMPP. They are all #decentralized and #opensource
-
Like most social networks, Mastodon is not end-to-end encrypted. If you're sending sensitive info it's better to use a separate end-to-end encrypted messaging app.
Mastodon itself warns you about this if you are sending a DM through the web interface (see the screenshot).
More info about the risks and how to mitigate them in the guide at:
️ https://fedi.tips/is-mastodon-end-to-end-encryptedTL:DR - Main risk is your server admin reading your DMs, but they would need techy skills to do this.
-
Like most social networks, Mastodon is not end-to-end encrypted. If you're sending sensitive info it's better to use a separate end-to-end encrypted messaging app.
Mastodon itself warns you about this if you are sending a DM through the web interface (see the screenshot).
More info about the risks and how to mitigate them in the guide at:
️ https://fedi.tips/is-mastodon-end-to-end-encryptedTL:DR - Main risk is your server admin reading your DMs, but they would need techy skills to do this.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256I wonder how many Fedi users are using PGP or similar schemes.
-----BEGIN PGP SIGNATURE-----wnUEARYIAB0FgmqkjuYWIQRfwYaAQ1bC5Ge/wrr1vjwiBlASJgAKCRD1vjwiBlAS
Jk3CAP4pMaf55bsWtYFHRA2dvSN2ZhLpi86TvEaSlBPQ/fr7kwD+MWD6ZwmIb0rW
W4aXPpOuNsBOLol92h9V71m3l6HoWg0=
=9zQN
-----END PGP SIGNATURE----- -
Like most social networks, Mastodon is not end-to-end encrypted. If you're sending sensitive info it's better to use a separate end-to-end encrypted messaging app.
Mastodon itself warns you about this if you are sending a DM through the web interface (see the screenshot).
More info about the risks and how to mitigate them in the guide at:
️ https://fedi.tips/is-mastodon-end-to-end-encryptedTL:DR - Main risk is your server admin reading your DMs, but they would need techy skills to do this.
@FediTips But better than usnig gmail right?
-
@FediTips But better than usnig gmail right?
Well yeah, email is totally unencrypted and Google is a surveillance company.
Sensitive info should never ever be sent by email, it is totally insecure.
-
Like most social networks, Mastodon is not end-to-end encrypted. If you're sending sensitive info it's better to use a separate end-to-end encrypted messaging app.
Mastodon itself warns you about this if you are sending a DM through the web interface (see the screenshot).
More info about the risks and how to mitigate them in the guide at:
️ https://fedi.tips/is-mastodon-end-to-end-encryptedTL:DR - Main risk is your server admin reading your DMs, but they would need techy skills to do this.
@FediTips I think the ""they would need techy skills to do this" is moot for someone being a server admin
-
@FediTips I think the ""they would need techy skills to do this" is moot for someone being a server admin
A lot of admins use managed hosting services which do all the techy stuff for them (e.g. https://fedihost.co or https://masto.host or https://cloud68.co etc), so they aren't necessarily techy people.
-
A lot of admins use managed hosting services which do all the techy stuff for them (e.g. https://fedihost.co or https://masto.host or https://cloud68.co etc), so they aren't necessarily techy people.
@FediTips Doesn't that just pass the buck to whoever is actually doing the techy job of hosting?
Although it does mean there are a lot fewer people who can snoop than I thought. -
@FediTips Doesn't that just pass the buck to whoever is actually doing the techy job of hosting?
Although it does mean there are a lot fewer people who can snoop than I thought.Main thing I was trying to get across with the "techy" comment is that there is nothing in Mastodon's own software that allows admins to view DMs, there is no admin tool for doing that (I was saying this because some people thought there was). You have to step outside Mastodon and look at the raw database directly, which requires tech skills and database access.
And yes that does mean the hosting company would have access, so it's always best to avoid sensitive data.
