Mastodon doesn't have encrypted DMs | Hacker News Reader

Mastodon doesn't have encrypted DMs

twitter.com

24 pointstaubek6 comments

I recognize that this is an advisory post, but I have seen a number of people out there that shout this as a valid reason to not use Mastodon, which I hate, and I feel is such a lazy excuse.

You know what other sites don't have encrypted DMs?

- Twitter

- Facebook Messenger

- Instagram

- TikTok

- YouTube

- Reddit

- LinkedIn

- Email

and on and on.

Basically ANY major site that doesn't explicitly advertise DMs as E2E (or encrypted alone) can just be assumed to NOT be encrypted. So why complain about Mastodon alone then (again, directed at the hypothetical person).

Beyond that, yes it's a bit of an issue where the admins of an instance can read your DMs. If that's a problem, then you yourself can self-host an instance, or find a friend to do so, and enjoy peace of mind.

Or, just use an encryption method like PGP, encrypted online text paste services, saltstack, etc new fangled encryption methods, or send pre-encrypted files hosted on external services.

end rant blah

Or just use something that does have e2e (Matrix/WhatsApp/Signal) for the DMs and reserve Mastodon for the microblogging.

The lowered level to hosting is the issue though. It's one thing for Facebook Messenger to be unencrypted, Facebook is this whole big faceless company. A random Facebook employee has zero interest in my local gossip of who's sleeping with who because they have no idea who anybody even is. It's another thing to use Mastodon where the instance is run by your cousin Bob who knows who everyone involved is and would really like to read your DMs to get some juicy info to gossip about.

Is it hard to implement end to end encryption? What is the reason for lack of it on messaging apps?

Do any popular sites or services have them? Most internet forum and social network social you can setup don't. Nor do Facebook, Twitter, Instagram, Reddit, YouTube, LinkedIn, etc.

Honestly, unless you're using a system that specifically markets itself on this (Signal, Telegram, etc), you probably shouldn't expect any encrypted communications.

Mastodon doesn't actually have private-messages (encrypted or not). Mastodon DMs are normal posts, but only visible to mentioned users.

If you are DM-ing someone and you message another user, like for example, reporting someone on the instance, they are going to be added to the conversation: https://twitter.com/MalwareTechBlog/status/15895218992433192...

Now THAT'S BAD

Reply on news.ycombinator.com