▲ 126 ▼ How do DM's work in Lemmy? How safe are they? (lemm.ee) submitted 2 years ago by Kidplayer_666@lemm.ee to c/privacy@lemmy.ml 32 comments fedilink hide all child comments
[–] SharkEatingBreakfast@sh.itjust.works 14 points 2 years ago (3 children) besides the admins of both instances can read them as well. What? permalink fedilink source parent hideshow 6 child comments replies: [–] trk@aussie.zone 57 points 2 years ago (1 child) Wait until you hear about the people hosting your email permalink fedilink source parent hideshow 2 child comments replies: [–] reddthat@reddthat.com 8 points 2 years ago (1 child) permalink fedilink source parent hideshow 2 child comments replies: [–] VolunTerry@monero.town 2 points 2 years ago* Haha, love the image. I think everyone feels that way the first time they learn it. End to end encrypt emails whenever you can too. Now, getting those you communicate with to implement and utilize pgp? That's a whole other battle. permalink fedilink source parent [–] rog@lemmy.one 32 points 2 years ago (1 child) Nothing on lemmy is private. Your instance is just hosted on a server, and in this instance that server is essentially just someone elses computer. Anything you do or say on the server can be viewed by the admin and whoever they decide to delegate access to. This is true for practically every online service ever. permalink fedilink source parent hideshow 2 child comments replies: [–] DivergentHarmonics@sopuli.xyz 3 points 2 years ago This is true for practically every online service ever. Sorry i have to correct this statement. Unless all encryption can be broken one day (which is a different discussion), end-to-end encryption can be seen as private ... if both parties can trust each other to keep it so. One can see if a service/app does e2ee if they (best) ask you to enter your public key (and only that) which will be shared to others to enable them to encrypt messages to you (such PMs can only get decrypted with your private key which is stored nowhere but on your own devices), and verify signatures done using your privkey. In the second-best case, an application will generate a key pair on your device and instruct you to store away the private key it just generated somewhere safe and protected by a long passphrase because if you lose it your PMs can not be recovered. Interestingly, the ActivityPub protocol and IIRC also the Lemmy database have a "public key" field which could be used for e2ee purposes but the functionality is just not implemented. permalink fedilink source parent [–] Still@programming.dev 22 points 2 years ago (1 child) the admin of your Instance has full access to your account as they have full access to the database that holds your dms permalink fedilink source parent hideshow 2 child comments replies: [–] Lanthanae@lemmy.blahaj.zone 14 points 2 years ago Yeah, really it would be surprising to me if this wasn't the case. permalink fedilink source parent
[–] trk@aussie.zone 57 points 2 years ago (1 child) Wait until you hear about the people hosting your email permalink fedilink source parent hideshow 2 child comments replies: [–] reddthat@reddthat.com 8 points 2 years ago (1 child) permalink fedilink source parent hideshow 2 child comments replies: [–] VolunTerry@monero.town 2 points 2 years ago* Haha, love the image. I think everyone feels that way the first time they learn it. End to end encrypt emails whenever you can too. Now, getting those you communicate with to implement and utilize pgp? That's a whole other battle. permalink fedilink source parent
[–] reddthat@reddthat.com 8 points 2 years ago (1 child) permalink fedilink source parent hideshow 2 child comments replies: [–] VolunTerry@monero.town 2 points 2 years ago* Haha, love the image. I think everyone feels that way the first time they learn it. End to end encrypt emails whenever you can too. Now, getting those you communicate with to implement and utilize pgp? That's a whole other battle. permalink fedilink source parent
[–] VolunTerry@monero.town 2 points 2 years ago* Haha, love the image. I think everyone feels that way the first time they learn it. End to end encrypt emails whenever you can too. Now, getting those you communicate with to implement and utilize pgp? That's a whole other battle. permalink fedilink source parent
[–] rog@lemmy.one 32 points 2 years ago (1 child) Nothing on lemmy is private. Your instance is just hosted on a server, and in this instance that server is essentially just someone elses computer. Anything you do or say on the server can be viewed by the admin and whoever they decide to delegate access to. This is true for practically every online service ever. permalink fedilink source parent hideshow 2 child comments replies: [–] DivergentHarmonics@sopuli.xyz 3 points 2 years ago This is true for practically every online service ever. Sorry i have to correct this statement. Unless all encryption can be broken one day (which is a different discussion), end-to-end encryption can be seen as private ... if both parties can trust each other to keep it so. One can see if a service/app does e2ee if they (best) ask you to enter your public key (and only that) which will be shared to others to enable them to encrypt messages to you (such PMs can only get decrypted with your private key which is stored nowhere but on your own devices), and verify signatures done using your privkey. In the second-best case, an application will generate a key pair on your device and instruct you to store away the private key it just generated somewhere safe and protected by a long passphrase because if you lose it your PMs can not be recovered. Interestingly, the ActivityPub protocol and IIRC also the Lemmy database have a "public key" field which could be used for e2ee purposes but the functionality is just not implemented. permalink fedilink source parent
[–] DivergentHarmonics@sopuli.xyz 3 points 2 years ago This is true for practically every online service ever. Sorry i have to correct this statement. Unless all encryption can be broken one day (which is a different discussion), end-to-end encryption can be seen as private ... if both parties can trust each other to keep it so. One can see if a service/app does e2ee if they (best) ask you to enter your public key (and only that) which will be shared to others to enable them to encrypt messages to you (such PMs can only get decrypted with your private key which is stored nowhere but on your own devices), and verify signatures done using your privkey. In the second-best case, an application will generate a key pair on your device and instruct you to store away the private key it just generated somewhere safe and protected by a long passphrase because if you lose it your PMs can not be recovered. Interestingly, the ActivityPub protocol and IIRC also the Lemmy database have a "public key" field which could be used for e2ee purposes but the functionality is just not implemented. permalink fedilink source parent
[–] Still@programming.dev 22 points 2 years ago (1 child) the admin of your Instance has full access to your account as they have full access to the database that holds your dms permalink fedilink source parent hideshow 2 child comments replies: [–] Lanthanae@lemmy.blahaj.zone 14 points 2 years ago Yeah, really it would be surprising to me if this wasn't the case. permalink fedilink source parent
[–] Lanthanae@lemmy.blahaj.zone 14 points 2 years ago Yeah, really it would be surprising to me if this wasn't the case. permalink fedilink source parent