this post was submitted on 10 Jul 2023
2997 points (99.6% liked)
Fediverse
28561 readers
312 users here now
A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, KBin, etc).
If you wanted to get help with moderating your own community then head over to [email protected]!
Rules
- Posts must be on topic.
- Be respectful of others.
- Cite the sources used for graphs and other statistics.
- Follow the general Lemmy.world rules.
Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration), Search Lemmy
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This is literally all instances... Nothing you do here should be considered private or be linked to your real information.
Agreed, but we have to trust the instances we keep accounts on. Trust is subjective, but I certainly wouldn't trust a government ran instance for anything other than an outlet for information originating from the owning government.
If I run a private instance or know the maintainer of another, then I can have greater confidence in the security/privacy implementations.
I would trust most government instances more than most of the private instances. Would I trust them not to harvest all of that info? Absolutely not. Would I trust them to not masquerade as me? Way more. Governments have way more to lose by being caught.
I've spent quite a bit of time as a penetration tester and one of the first things we do once we recover credentials is check for validity against online accounts known to be good for a given user. We do that because it simulates attackers and government operators alike. It's a guarantee that free credentials will be abused in one manner or another when they're available to government entities.
The obvious control for this is to maintain a unique password for each account but that's not always feasible for users due to myriad conditions.
I didn't say they wouldn't be abused. I said they wouldn't be impersonated.
Masquerading is literally the term used for this.
Exactly? I'm confused. Did you not understand my position?