Brutkey

Fedi.Tips
@FediTips@social.growyourown.services 🌐

Like most social networks, Mastodon is not end-to-end encrypted. If you're sending sensitive info it's better to use a separate end-to-end encrypted messaging app.

Mastodon itself warns you about this if you are sending a DM through the web interface (see the screenshot).

More info about the risks and how to mitigate them in the guide at:

➡️ https://fedi.tips/is-mastodon-end-to-end-encrypted

TL:DR - Main risk is your server admin reading your DMs, but they would need techy skills to do this.

#FediTips #Mastodon #E2EE

Punnamaraju Vinayaka Tejas
@PVTejas@mstdn.social 🌐

@FediTips@social.growyourown.services I think the ""they would need techy skills to do this" is moot for someone being a server admin

Fedi.Tips
@FediTips@social.growyourown.services 🌐

@PVTejas@mstdn.social

A lot of admins use managed hosting services which do all the techy stuff for them (e.g. https://fedihost.co or https://masto.host or https://cloud68.co etc), so they aren't necessarily techy people.

Punnamaraju Vinayaka Tejas
@PVTejas@mstdn.social 🌐

@FediTips@social.growyourown.services Doesn't that just pass the buck to whoever is actually doing the techy job of hosting?
Although it does mean there are a lot fewer people who can snoop than I thought.

Fedi.Tips
@FediTips@social.growyourown.services 🏠

@PVTejas@mstdn.social

Main thing I was trying to get across with the "techy" comment is that there is nothing in Mastodon's own software that allows admins to view DMs, there is no admin tool for doing that (I was saying this because some people thought there was). You have to step outside Mastodon and look at the raw database directly, which requires tech skills and database access.

And yes that does mean the hosting company would have access, so it's always best to avoid sensitive data.