Mastodon, one of many social media platforms on the Fediverse, has attracted a lot of attention since the purchase of Twitter by Elon Musk.
With some instances growing by tens of thousands of users in as little as a week, and new personal instances popping up everywhere, I thought I’d take a moment to look at some of the security and privacy features.
As instances are usually ran by a tech savvy individual and service a small group of friends, family, and colleagues, it seems imperative that privacy be at the forefront, especially for marginalized groups.
To that end, Mastodon provides several features to protect users of an instance.
User Options
One notable user feature is “hide social graph” which blocks a user’s follows and followers from being visible.
While this will keep users from being able to see exactly who you follow or who follows you, with absolute certainty, this data may still be reasonably accessible and associated with you.
Let’s look at the options available to administrators.
Admin Options
Within the Server Administration options under Discovery, server admins may choose to hide the Local and Federated timelines.
Available at:
- domain.TLD/public/local
- domain.TLD/public
While users may not know this option exists, testing of our own instance at DigitalDarkAge.cc has shown that if unchecked, users’ follows can be determined with a great deal of confidence.
Why Does This Happen? Though Mastodon has an overwhelming number of user privacy protections, it is nonetheless a social media network. And like any network, benefits from the addition of nodes and content. The Federated timeline, when utilized by a heavily populated instance, serves to bring in and showcase an outstanding amount of new content that users may be interested in. This follows, as you are likely occupying an instance with people with shared hobbies, political, career, or geographic interests. The Federated timeline does so by showing users all content currently flowing into the server from across the Fediverse. Every post and boost from every followed user on any instance appears here. However, users who have opted to hide their social graph are not opted out of the Federated timeline. This creates an opportunity where misconfiguration or unintentional configuration by admins may result in users follows being identifiable. ### What can I do? If you’re on a small instance and want to protect your privacy, reach out to your admins. Feel free to point them to this post and voice your concerns. Federation is a great benefit of the move away from walled gardens, but if your threat profile includes being able to mask your followers, ask them to change the settings. If you’re running an instance, assess your users’ needs and preferences. Is a publicly accessible federated timeline essential to the health and safety of your instance? Likely not, in that case, update your settings! \#\#\# Conclusion Users have the opportunity to enjoy a safe and private social media experience on the fediverse. But like any other software, misconfigurations or unintentional configurations can put the safety and privacy of users at risk. Having a publicly viewable federated timeline, while beneficial to prospective users, may disproportionately affect users’ safety and privacy. You can find me on the Fediverse at @IAintShootinMis@DigitalDarkAge.cc
