Like most social networks, Mastodon is not end-to-end encrypted. If you're sending sensitive info it's better to use a separate end-to-end encrypted messaging app.
Mastodon itself warns you about this if you are sending a DM through the web interface (see the screenshot).
More info about the risks and how to mitigate them in the guide at:
➡
️ https://fedi.tips/is-mastodon-end-to-end-encrypted
TL:DR - Main risk is your server admin reading your DMs, but they would need techy skills to do this.
#FediTips #Mastodon #E2EE
@FediTips@social.growyourown.services I think the ""they would need techy skills to do this" is moot for someone being a server admin
@FediTips@social.growyourown.services But better than usnig gmail right?
@FediTips@social.growyourown.services
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
I wonder how many Fedi users are using PGP or similar schemes.
-----BEGIN PGP SIGNATURE-----
wnUEARYIAB0FgmqkjuYWIQRfwYaAQ1bC5Ge/wrr1vjwiBlASJgAKCRD1vjwiBlAS
Jk3CAP4pMaf55bsWtYFHRA2dvSN2ZhLpi86TvEaSlBPQ/fr7kwD+MWD6ZwmIb0rW
W4aXPpOuNsBOLol92h9V71m3l6HoWg0=
=9zQN
-----END PGP SIGNATURE-----
@FediTips@social.growyourown.services as a server admin I think it's worth mentioning that the techy skills required to read users' DMs are pretty trivial. I could do it very easily if I wanted.
Of course I don't, and won't, but I assume there are circumstances where I could be compelled to hand them over to law enforcement or something and I don't think I or the users would want to be in that position!
@FediTips@social.growyourown.services yes, this is important to know! It's also worth mentioning that the ActivityPub folks are working to add end-to-end encryption to the protocols, so hopefully we'll get that at some point.
@collective_truth@mastodon.social
Well yeah, email is totally unencrypted and Google is a surveillance company.
Sensitive info should never ever be sent by email, it is totally insecure.
@kev@mcr.wtf
If you're a techy person they're trivial, but if you're e.g. running it on managed hosting the admin doesn't even get database access (though of course the hosting company staff do).
There's also the complication of moderating DMs, if someone reports it it becomes visible to the admin through Mastodon itself.
@kev@mcr.wtf
If you're a techy person they're trivial, but if you're e.g. running it on managed hosting the admin doesn't even get database access (though of course the hosting company staff do).
There's also the complication of moderating DMs, if someone reports it it becomes visible to the admin through Mastodon itself.
@FediTips@social.growyourown.services oh good point. I forget about the hosted services.
@FediTips@social.growyourown.services oh good point. I forget about the hosted services.
Fedi.Tips
