The resilience of centralised networks remains significantly underestimated by p2p challengers. Decentralised movements are dangerously unprepared for a crisis-fuelled future that has very suddenly arrived at their door.

This collection of networks offers no end to end encryption. Anyone with administrator access to an Instance can read anything that travels through that Instance’s infrastructure – including direct messages. The level of risk correlates with the number of cross-Instance interactions between users. If users from different Instances communicate, an attacker need only compel one Instance to reveal the direct messages between all of the interacting accounts. The centralised equivalents – Twitter, Tumblr, etc – can cloak their users through governance and resources. In a peer-to-peer network without encryption, there’s no structure, no agreed-upon governance, and absolutely no protection. Compromising or compelling an Instance or its staff means that all of network traffic is laid bare to its assailant.

I’d love to have a discussion on this (now fairly old) article which IMO has yet to provoke the kind of much-needed action on this topic that we, as a community of cypherpunks, are capable of.

  • cyph3rPunk@infosec.pubOPEnglish
    3·
    1 year ago

    I agree, actually. However, I do think PM’s are problematic in their current state because some users will send confidential information through those channels without realizing how easy it is for an admin to view that data in plain text.

    • fraksken@infosec.pubEnglish
      2·
      1 year ago

      i understand that for these channels there is little oversight in how admins would (ab)use the platform amd it would indeed be easy for a bad actor to set up its own instance and invite users. My point is that a Lemmy instance perhaps has 10 or 20 admins who can access privileged data, while larger platforms have thousands of admins, with or without an NDA in place. I agree that users on the internet are more often than not oblivious to the fact that - if they don’t own the service (self host) - they don’t own the data. This is nothing new. Microsoft administrators (within an organisation, not affiliated with microsoft itself) are able to read user e-mails. there is no secrecy on any network unless you have e2ee in place. There are a few specialised services who’se selling points are security and privacy (signal, proton, …). Outside of those services, I would not trust my data to be private. In my opinion, what you’re describing is a problem of educating people. with the current popular mindset of “I have nothig to hide”, education becomes increasingly difficult. Everybody has things to hide. Their social security number, their passwords, their medical data, their darkest fantasies or deepest fears, all can be exploited by bad actors, and all is just beig published on the internet without afterthought.

      In a perfect world, I agree, pm should have e2ee. I also recognise that the current version of Lemmy is 0.18. no major release yet. I’m confident they will work on it at some point. I might do it myself if I were a programmer (am not, no idea how to get started). Lemmy is young and open source, it will need time to mature.