this post was submitted on 24 Jun 2024
27 points (88.6% liked)

Open Source

30924 readers
143 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[โ€“] [email protected] 2 points 4 months ago (1 children)

How would encryption even make sense here? Up to the server, everything is protected via TLS. And if you don't trust the server provider, you can encrypt all you want, but they can just read out the RAM of the VPS or they could have backdoored the bare metal hardware to do the same. As long as the server has to somehow work with the data in question, the decryption keys have to be somewhere in there. And what do you mean by code integration? We're talking FOSS here, how could someone prevent me from removing any "is everything encrypted?" checks in Mastodon? Also, what does the encryption on other federated instances even matter? Without having any in depth knowledge about Mastodon, your user agent will hardly be sent to other instances, and when and what you posted is meant to be visible.

[โ€“] [email protected] 1 points 4 months ago

Code integration means that all Mastodon data a server stores is automatically encrypted on arrival. But even in that case it can be intercepted on decryption or in RAM as you mentioned. FDE + trustworthy provider can be a good option still. I don't think any providers except the most sketchy ones will try to read the RAM. Anyways all of that is impossible to enforce so we're really waiting for a breach with this one.