Mastodawn

AchillesUltimate Aug 9, 2023

How much control/access does my instance owner haver over my account?

https://lemy.lol/post/3209094

How much control/access does my instance owner haver over my account? - lemy

I noticed that there were some accounts that were hijacked by the instance owners. All the posts from that user were then edited to say what happened. This kind of surprised me, I figured instances could delete posts, but not edit them. So how much control do they have? I assume they can’t see my password (hopefully). Can they post in my name? Do they have all the access to my posts to foreign instances that they do over local posts?

Show thread

Salamander Aug 10, 2023

Password hashing occurs server-side. Even without removing the hashing step an admin can intercept the plaintext password during login. Use unique safe passwords.
An admin can intercept the jwt authentication cookie and use any account that lives in the instance.
Private messages are stored as plaintext in the database
Admins can see who upvotes/downvotes what
These are not things that are unique to Lemmy. This is common.
To avoid having to trust your admin, run an instance.

Show thread

Ziggurat Aug 10, 2023

Quick note,

this is note unique to Lemmy/Fediverse. Reddit admin or twitter admin (and even gmail) can also read your MP, see the hash of your password and remove your comments. Reading your MP is even part of their business model so they can show you personalized ads.

There is definitely a probability to deal with a non reliable instance admin, but not less than with any other social media, and in principle they collect even less data

Show thread

redballooon

Technically that’s true.

To build trust and adhere to law, corporations will usually have processes and regulations in place that determine which employees can access and modify what. That is why spez modifying user comments is such a big deal. It showed that Reddit is not to be trusted. Nevertheless, for corporations that value customers trust, any employee who does not adhere to these procedures risks their employment.

On smallish fediverse instances none of these procedures need to be in place, the admin is bound only by his own moral code.

Show thread

Azura Aug 10, 2023

This is true. However keep in mind that instances survive on reputation. As soon as something like this came out, which is inevitable with time, nobody will trust that instance, or the person running that instance, again. And people are usually quite quick to find this out as already demonstrated by other online services. Hiding is very difficult. Even worse, once your reputation falls, people can move to a more respectful server and continue participating in the network, so in the end it’s a losing game for the instance owner. Password safety obviously applies, but if you take a look at big social media privacy and terms, a little password manager in my personal opinion is preferable.