Aral Balkan
Direct messages (DMs) on #Mastodon /#ActivityPub / the #fediverse are not end-to-end encrypted (#e2ee) and you should never include sensitive/private information in them.
Until they are e2ee, this is all we should be telling people. Anything else is irresponsible and could cause vulnerable people harm.
Specifically, it doesn’t matter:
- if your instance admin is ethical or not
- whether Elon Musk can read DMs easier on Twitter
- etc.
It’s not end-to-end encrypted. It’s not private. End of.
La Ursidinoj (Bjornsdottirs)
@aral about as private as unencrypted email.
Aral Balkan
@ellenor2000 Which is to say, not private ;)
Aral Balkan
@clov “Legal privacy” without “technical privacy” is wishful thinking.
Lack of “technical privacy” is what gets people killed.
![[ ]](https://gnusocial.jp/avatar/11106-48-20240312151917.webp){kind=small}
[ ]
@aral that's what I call "technical privacy".
"Legal privacy" is easier to understand: everything not meant to be public, is private.
And sharing private message, like not-encrypted email or not public AS Object (like mastodon's toots), without correspondent agreement is violating privacy (France also have a "Secret de la Correspondance" legal protection).
Aral Balkan
@clov And without “technical privacy”, “legal privacy” is worth about as much as the paper it’s written on.
(Or, more precisely, without “technical privacy” being protected by “legal privacy”.)
[ ]
@aral "legal privacy" don't need "technical privacy" to be.
Aral Balkan
@sintrenton Indeed.
Fox Trenton 🎱
-----BEGIN PGP MESSAGE-----
jA0ECgMCi3PE+mtctkpg0lMBmCr0apjBNAkbuvOt56TSWQBLVyx8+Qfx+nFfjn1C
lGxj9OpMdqtYlIb39vAnoNKdgKKDUyhxf8mq/mulG9W7Qo42I0YBs1Nu9m4A5n/x
4LxLew==
=QivQ
-----END PGP MESSAGE-----
Joe
@aral Certainly journalists should never use DMs on Mastodon *or* Twitter to communicate with sources. I was disturbed to learn how many journalists use DMs heavily on Twitter.
Aral Balkan
@michael_robinson I use Signal. This isn’t about cursing the darkness. It‘s about countering an article that appears to be making the rounds on the fediverse today that appears to downplay the issue.
Michael Robinson
Light a candle, don't curse the darkness:
Aral Balkan
@werdenfels Indeed.
Wer den Fels :verified_coffee:
@aral for sensitive information, I would always use a messenger like for instance Signal.
Aral Balkan
@trustno1 @clov My point is you need both. “Legal privacy” either enshrines “technical privacy” into law or it is bullshit. You can have “technical privacy” without “legal privacy” but it you might have to have it from prison and I cannot make guarantees about the state of your kneecaps.
felix weiland
@clov @aral „Legal“ Privacy without a proper definition of „Legal“ is worth nothing, besides the fact that it involves relying on external facts (people not breaching agreements, govt not changing laws, court orders). „Legal Privacy“ is something I would never advise clients. I‘m a big fan of technical measures - that‘s something you can more likely rely on.
Aral Balkan
@Flux Yep.
Flux
@aral People need to realise that the only way to improve privacy on the web is to use e2e (p2p is an even better bonus on top) communication
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.