Direct messages (DMs) on #Mastodon / #ActivityPub / the #fediverse are not end-to-end encrypted (#e2ee) and you should never include sensitive/private information in them.
Until they are e2ee, this is all we should be telling people. Anything else is irresponsible and could cause vulnerable people harm.
Specifically, it doesn’t matter:
if your instance admin is ethical or not
whether Elon Musk can read DMs easier on Twitter
etc.
It’s not end-to-end encrypted. It’s not private. End of.
@aral Mastodon shows a very clear warning if you try to write a DM and it's called "direct" message, not "private" message. I do not know how Mastodon could make this any clearer.
@aral this is at the top of the direct messages, Mastodon is very upfront about it (as it should be!)
Another, IMO, less discoverable problem is, how easily one can compromise their own direct messages when they mention a third party by name - which apparently includes that third party in the conversation.
@claudius@defnull
Mastodon isn't the only software used on Fediverse and, I'm not sure about it, but I think this message appears precisely because a lot of people were raising awareness of the issue. Some ignore even the most explicit warnings — society often instructs us to break the rules, and unless they understand what the warning is about they will likely just dismiss it.
No harm in mentioning it one more time and having a discussion about it 🤷 @aral
"Legal privacy" is easier to understand: everything not meant to be public, is private.
And sharing private message, like not-encrypted email or not public AS Object (like mastodon's toots), without correspondent agreement is violating privacy (France also have a "Secret de la Correspondance" legal protection).
@clov@aral „Legal“ Privacy without a proper definition of „Legal“ is worth nothing, besides the fact that it involves relying on external facts (people not breaching agreements, govt not changing laws, court orders). „Legal Privacy“ is something I would never advise clients. I‘m a big fan of technical measures - that‘s something you can more likely rely on.
@trustno1@clov My point is you need both. “Legal privacy” either enshrines “technical privacy” into law or it is bullshit. You can have “technical privacy” without “legal privacy” but you might have to have it from prison and I cannot make guarantees about the state of your kneecaps.
Add comment