62
I wouldn't call it Pixelfed's vulnerablility, but a reminder that nothing on Fediverse is private. Even if Pixelfed is fixed, someone can create rogue instance to read other's private posts.
If I understand it correctly, it's kind of both. Sounds like Pixelfed didn't follow best practice setting privacy guardrails in follow request approval, and it exacerbates the inherent lack of privacy on the fediverse.
You're right of course, anyone (with the coding chops) could've intentionally set up an instance that does the same for malicious purposes. That should be a wake-up call for anyone who thinks ActivityPub is a great sexting medium.
I kinda of lean towards the idea of "private accounts" being a bad idea as a result, just because it creates a false sense of security. But I'm not in the target demographic so idk
The private account would still need to accept a follower from that rogue instance.
Edited to add: I got this around the wrong foot, see the reply to this. /edit
Not necessarily, as clearly stated in the linked article:
But sure enough, the toot was followers only and the person that had liked it was not following her Mastodon account. When I took a look at the other persons profile on pixelfed.social, I noticed that the instance was nevertheless claiming the account was following her.
When pixelfed assumes that an account is not locked, it immediately treats a follow attempt as completed. For the server on the other end it looks like a normal follow request. It could be rejected, and pixelfed would still be convinced that a follow relation exists.
Yes, necessarily.
Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server
Ah, good catch. Thanks!
Abolutely necessarily.
it works like this:
@privateuser@mastodon.example.comhas a "followers only account".@someuser@pixelfed.example.comis a friend of above account, requested access and was granted. This now causesmastodon.example.comto push all messages of@privateusertopixelfed.example.com.@anotheruser@pixelfed.example.comrequests access, but gets ignored. But the pixelfed instance marks the user as "follows@privateuser"- In the interface of
@someuser, the messages are shown as expected. - In the interface of
@anotheruser, they are also shown. Because PF basically does a database "select messages of users that the user follows", without checking if the access was ever granted.
Important to note, that this would not happen, if the messages weren't already pushed to the server due to the "allowed" user
Yes, but account/instance would need to actively research which instances are rogue, and beware of them. It could be solved by creating tool which would automatically detect this ~~vulnerability~~ feature.
Wait, are new instances federated by default?
I thought admins had to choose who they were federated with.
There's easily over a thousand fediverse instances at this point, having to whitelist them all would be impractical.
Okay but this demonstrates why defaulting to federation is a bad idea, doesn't it?
The issue is that if you don't default to federation, it becomes essentially impossible for new instances to join the fediverse. A potential new instance would have to go around to every single existing instance and ask to be allowlisted, which is onerous for both the new instances and for the large server admins who would be getting tons of requests. It would also essentially kill small-scale selfhosting as a result.
It demonstrates that nothing on the fediverse is private, and bad hacks that pretend otherwise are a terrible idea.
private posts are only sent to instances that either your followers or the list of people you want to see the post are on. If they all co-operate, you will be fine.
if they all cooperate
Gonna stop you right there
Its like email, an email server can decide to expose everyone's emails to the public, so don't add that email to your mailing list or email chain.
well that's not good
Nope. It looks like crash testing security in production, or "fuck around and find out" with other people's privacy.
Some more US war plans?
this post was submitted on 26 Mar 2025
62 points (95.6% liked)
Fediverse
33606 readers
350 users here now
A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, KBin, etc).
If you wanted to get help with moderating your own community then head over to !moderators@lemmy.world!
Rules
- Posts must be on topic.
- Be respectful of others.
- Cite the sources used for graphs and other statistics.
- Follow the general Lemmy.world rules.
Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)
founded 2 years ago
MODERATORS