Conversation

Notices

1. Embed this notice
   Mario Vavti (mario@hub.somaton.com)'s status on Tuesday, 26-Nov-2024 02:27:37 JST Mario Vavti

   • silverpill
   @julian i get your point. But maybe in this case the trust question is more philosophical: do we want to trust the one we have the connection with - in this case the context owner or do we want to trust the author with which we are not connected at all and whose messages might be forged too - even with proof?
   
   @silverpill
   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Tuesday, 26-Nov-2024 12:02:57 JST silverpill

     in reply to

     @mario @julian In FEP-fe34 security model the root of trust is the server. Messages are produced by servers, not by users, and server operator can impersonate any local user. We have to live with it because this is how ActivityPub works (unless the user is nomadic and uses FEP-ae97 client, but this is a different story).

     From this perspective, someone I have a connection with is equal to any other user. Sure, I might trust servers used by my connections more than other servers, but I think this assessment is not reliable and shouldn't be used as an input to authentication procedure.