Mastodon newbie protip: don't click the "remote follow" button. Just copy the user's URL and paste it into the search bar of your home instance, then click the follow button (the little icon of a person with a "+" on it).

Not only is "remote follow" slower and more awkward; it's a potential security risk, because a malicious instance could trick you into giving them your password (if you're not paying attention to the URL bar).

I don't see any issues on the Mastodon repo mentioning that "remote follow" is a phishing opportunity, and that we're training users to do something that could get exploited one day. I'd file an issue, but there are so many infosec people on here, maybe someone else could articulate it better than me? Or maybe I'm overestimating the risk? /cc @munin @bcrypt

@nolan @bcrypt

No, you're right; it's a pretty nasty UI element that's just asking for trouble.

Loading replies...