Pixelfed leaks private posts from other Fediverse instances
1–10 of 26 posts
Re: Pixelfed leaks private posts from other Fediverse instances
#2There was an interesting follow-up to this post that adds more context to the incident and problem space: https://lemmy.world/post/27522773
Re: Pixelfed leaks private posts from other Fediverse instances
#3ActivityPub just hands out "private" posts and trusts the foreign server implicitly to only show them to the right users.
But it's pixelfed's fault
Re: Pixelfed leaks private posts from other Fediverse instances
#4ActivityPub just hands out "private" posts and trusts the foreign server implicitly to only show them to the right users. But it's pixelfed's fault
The post states clearly that the foreign server only gets private posts if one of that server’s users is authorized to read the posts. How else do you expect it to work?
Re: Pixelfed leaks private posts from other Fediverse instances
#5I enjoyed reading this. Admittedly I'm very new to the activity pub protocol, but it's hard to grasp at first how this leak actually occurs.
I read this part of the activity pub spec and I think I get it, but not completely. So it is really up to the activity pub server implementation to strip the bto/bcc audience fields and do the "right thing" in order to preserve privacy? Could anyone shed some light on this?
https://www.w3.org/TR/activitypub/#remove-bto-bcc-before-del...
Re: Pixelfed leaks private posts from other Fediverse instances
#6So wait. You have a federated protocol that trusts and expects every instance to enforce a user privacy setting?
That is, put simply, utterly incompetent shitty design.
Re: Pixelfed leaks private posts from other Fediverse instances
#7ActivityPub just hands out "private" posts and trusts the foreign server implicitly to only show them to the right users. But it's pixelfed's fault
The post states clearly that the foreign server only gets private posts if one of that server’s users is authorized to read the posts. How else do you expect it to work?
Either encrypt it such that only the authorized user can read it, or require the authorized user to retrieve it directly. Or don't lead users to expect that you're offering any privacy.
From the user's point of view, authorizing some other user to read something doesn't mean authorizing whoever runs that user's instance to read it. If your protocol has an architectural problem with that, it means you designed your protocol wrong.
Re: Pixelfed leaks private posts from other Fediverse instances
#8This really sounds like a problem with ActivityPub if it doesn't have a protocol-level mechanism for this. The idea that an incomplete AP implementation is less secure than a complete one is worrisome to say the least.
Re: Pixelfed leaks private posts from other Fediverse instances
#9So wait. You have a federated protocol that trusts and expects every instance to enforce a user privacy setting? That is, put simply, utterly incompetent shitty design.
How is that different from email?
Most email is not E2EE. Thus, it's up to the email server to ensure that only authorized accounts on the server can read the received emails. The sender's email server has no control over the receiver's email server.
It would be a scandal if a popular mail server implementation allowed any account on the server to read private emails.
Re: Pixelfed leaks private posts from other Fediverse instances
#10So wait. You have a federated protocol that trusts and expects every instance to enforce a user privacy setting? That is, put simply, utterly incompetent shitty design.
How is that different from email? Most email is not E2EE. Thus, it's up to the email server to ensure that only authorized accounts on the server can read the received emails. The sender's email server has no control over the receiver's email server. It would be a scandal if a popular mail server implementation allowed any account on the server to read private emails.
One would hope that a protocol designed in 2018 would have more security than email.