Conversation

Notices

1. Aral Balkan (aral@mastodon.ar.al)'s status on Saturday, 22-Jul-2023 21:32:15 JST Aral Balkan

   Direct messages (DMs) on #Mastodon / #ActivityPub / the #fediverse are not end-to-end encrypted (#e2ee) and you should never include sensitive/private information in them.

   Until they are e2ee, this is all we should be telling people. Anything else is irresponsible and could cause vulnerable people harm.

   Specifically, it doesn’t matter:

   - if your instance admin is ethical or not
   - whether Elon Musk can read DMs easier on Twitter
   - etc.

   It’s not end-to-end encrypted. It’s not private. End of.

   • Aral Balkan (aral@mastodon.ar.al)'s status on Saturday, 22-Jul-2023 21:32:11 JST Aral Balkan

     in reply to

     • [                            ]

     @clov And without “technical privacy”, “legal privacy” is worth about as much as the paper it’s written on.

     (Or, more precisely, without “technical privacy” being protected by “legal privacy”.)

   • [                            ] (clov@travelpandas.fr)'s status on Saturday, 22-Jul-2023 21:32:12 JST [                            ]

     in reply to

     @aral "legal privacy" don't need "technical privacy" to be.

   • Aral Balkan (aral@mastodon.ar.al)'s status on Saturday, 22-Jul-2023 21:32:13 JST Aral Balkan

     in reply to

     • [                            ]

     @clov “Legal privacy” without “technical privacy” is wishful thinking.

     Lack of “technical privacy” is what gets people killed.

   • [                            ] (clov@travelpandas.fr)'s status on Saturday, 22-Jul-2023 21:32:14 JST [                            ]

     in reply to

     @aral that's what I call "technical privacy".

     "Legal privacy" is easier to understand: everything not meant to be public, is private.
     And sharing private message, like not-encrypted email or not public AS Object (like mastodon's toots), without correspondent agreement is violating privacy (France also have a "Secret de la Correspondance" legal protection).

   • Aral Balkan (aral@mastodon.ar.al)'s status on Saturday, 22-Jul-2023 21:32:24 JST Aral Balkan

     in reply to

     • Fox Trenton 🎱

     @sintrenton Indeed.

   • Fox Trenton 🎱 (sintrenton@todon.nl)'s status on Saturday, 22-Jul-2023 21:32:33 JST Fox Trenton 🎱

     in reply to

     @aral

     -----BEGIN PGP MESSAGE-----

     jA0ECgMCi3PE+mtctkpg0lMBmCr0apjBNAkbuvOt56TSWQBLVyx8+Qfx+nFfjn1C
     lGxj9OpMdqtYlIb39vAnoNKdgKKDUyhxf8mq/mulG9W7Qo42I0YBs1Nu9m4A5n/x
     4LxLew==
     =QivQ
     -----END PGP MESSAGE-----

   • Aral Balkan (aral@mastodon.ar.al)'s status on Saturday, 22-Jul-2023 23:32:24 JST Aral Balkan

     in reply to

     • La Ursidinoj (Bjornsdottirs)

     @ellenor2000 Which is to say, not private ;)

   • La Ursidinoj (Bjornsdottirs) (ellenor2000@mastodon.top)'s status on Saturday, 22-Jul-2023 23:32:25 JST La Ursidinoj (Bjornsdottirs)

     in reply to

     @aral about as private as unencrypted email.

   • Joe (not2b@sfba.social)'s status on Sunday, 23-Jul-2023 01:35:24 JST Joe

     in reply to

     @aral Certainly journalists should never use DMs on Mastodon *or* Twitter to communicate with sources. I was disturbed to learn how many journalists use DMs heavily on Twitter.

   • Aral Balkan (aral@mastodon.ar.al)'s status on Sunday, 23-Jul-2023 01:38:00 JST Aral Balkan

     in reply to

     • Michael Robinson

     @michael_robinson I use Signal. This isn’t about cursing the darkness. It‘s about countering an article that appears to be making the rounds on the fediverse today that appears to downplay the issue.

   • Michael Robinson (michael_robinson@colloquy.social)'s status on Sunday, 23-Jul-2023 01:38:01 JST Michael Robinson

     in reply to

     @aral

     Light a candle, don't curse the darkness:

     https://getsession.org/

   • Aral Balkan (aral@mastodon.ar.al)'s status on Sunday, 23-Jul-2023 01:39:12 JST Aral Balkan

     in reply to

     • Wer den Fels :verified_coffee:

     @werdenfels Indeed.

   • Wer den Fels :verified_coffee: (werdenfels@troet.cafe)'s status on Sunday, 23-Jul-2023 01:39:13 JST Wer den Fels :verified_coffee:

     in reply to

     @aral for sensitive information, I would always use a messenger like for instance Signal.

   • Aral Balkan (aral@mastodon.ar.al)'s status on Sunday, 23-Jul-2023 01:45:59 JST Aral Balkan

     in reply to

     • [                            ]
     • felix weiland

     @trustno1 @clov My point is you need both. “Legal privacy” either enshrines “technical privacy” into law or it is bullshit. You can have “technical privacy” without “legal privacy” but it you might have to have it from prison and I cannot make guarantees about the state of your kneecaps.

   • felix weiland (trustno1@ruhr.social)'s status on Sunday, 23-Jul-2023 01:46:00 JST felix weiland

     in reply to

     • [                            ]

     @clov @aral „Legal“ Privacy without a proper definition of „Legal“ is worth nothing, besides the fact that it involves relying on external facts (people not breaching agreements, govt not changing laws, court orders). „Legal Privacy“ is something I would never advise clients. I‘m a big fan of technical measures - that‘s something you can more likely rely on.

   • Aral Balkan (aral@mastodon.ar.al)'s status on Sunday, 23-Jul-2023 16:35:33 JST Aral Balkan

     in reply to

     • Flux

     @Flux Yep.

   • Flux (flux@social.fluxfox.dev)'s status on Sunday, 23-Jul-2023 16:35:34 JST Flux

     in reply to

     @aral People need to realise that the only way to improve privacy on the web is to use e2e (p2p is an even better bonus on top) communication