Mastodawn

Frédéric Jacobs Apr 5, 2017

Mastodon's federation introduces UX challenges.

One that worries me a lot is about message forgery. Anyone can forge a twoot, even cross-server.

Whereas Twitter Inc might be trustworthy enough to not forge transcripts. Anyone can run a Mastodon server and might want to abuse it to influence people (see Russian troll campaigns).

Should Mastodon "home servers" cryptographically sign updates? Should there be end-to-end signatures? Anyone has thoughts on this?

Show thread

Uncle Mikey

@fj This was always a problem back in the days of USENET, and for that matter, remains a problem in email, although open SMTP relays are less common, and SPF/DMARC and DKIM make it a bit harder. Back in the early 90s, when people asked me about email safety, I cautioned them that I could teach them--even if they were computer illiterate--how to forge email credibly in about an hour. RFC821 and 822 just weren't that complicated, and had no security to speak of.