Authorized Fetch (also referred to as Secure Mode in Mastodon) was recently circumvented by a stupidly easy solution: just sign your fetch requests with some other domain name.

  • Skull giver@popplesburger.hilciferous.nl
    link
    fedilink
    English
    arrow-up
    3
    ·
    9 months ago

    Decentralised, open social networks cannot offer privacy. Private groups are perfectly feasible within a locked-down system with the necessary gatekeeping.

    In theory isolated Mastodon servers without open signups could work as their own private communities as well.

    All you need to do is take out or several restrict federation capabilities, and most of the Fediverse privacy problems go out of the window.

    I think someone built a social network on top of Matrix that could use the builtin E2EE to restrict read access. Like with normal social media, you would need to hack servers or clients to get any chance at reading those posts unnoticed as an outsider.

    In this case, Threads (and Tumblr, Foursquare, Mastodon) can mitigate this problem by simply not federating with anyone but known-good servers.