Before joining Mastodon I remember reading about how instance owners could potentially have access to their user’s chats and messages. I don’t think I ever saw this about Lemmy, or at least never looked into that much. Is that also the case here? How much info is accessible by the owners here?
That said I love the service and am happy to be here lol
Every like/dislike and comment you make is visible to the owner of every instance that is federated with your home community; due to the nature of federation, nothing on any of these services is private.
Click on a profile, then click on “send message” and you will be greeted with the following warning:
Warning: Private messages in Lemmy are not secure. Please create an account on Element.io for secure messaging.
also to keep in mind, accessing private messages on any website - unless end to end encrypted and verifiable - assume is possible by whoever is running the website. Twitter DMs, Tumbler DMs, any random forum, Reddit. All can access your “private” messages. Fediverse seems to be the only place that actually warns the user of this
due to the nature of federation, nothing on any of these services is private.
I had a feeling this was the case, thanks.
You didn’t need to go with feelings; it’s clearly spelled out when you sign up and in the settings for messaging.
Lemmy is designed to be public and is not meant to be used for private messaging.
What the Fediverse does is gives you control over your profile so it can’t be held hostage by a single entity. It’s still up to you to keep private communications private and segment your accounts on a per-server basis to prevent aggregated analysis of your interests and activities.
I tried it out, and there isn’t a warning message when using a third party app like Voyager.
Basically, everything. There’s no UI but it would trivial for me to go into the db and look at sent / received private messages.
Thats why lemmy has a warning on the dm page saying it’s not secure and to use matrix.
What’s the extent of “everything”, like including logs of all user activity? I’m just trying to understand how the system works and how much of an investment of trust users require.
EDIT: An example that comes to mind is the ongoing copyright infringement news that the IP addresses of Reddit users discussing piracy should be given up to film studios. Do Lemmy users have any kind of protection when lawyers come knocking?
EDIT: An example that comes to mind is the ongoing copyright infringement news that the IP addresses of Reddit users discussing piracy should be given up to film studios. Do Lemmy users have any kind of protection when lawyers come knocking?
If provided with a court order, we could theoretically provide:
- Email address
- Record of all comments / posts made by the user
- Incoming/outgoing DMs for the user
- Voting activity made by that user
- Communities subscribed to
(I think that’s everything off the top of my head)
IP addresses are not logged in the db or linked to a user, but if the RCMP shows up with a warrant and says “We want all IP addresses that submitted a comment at 09:11:43am PST Jan 16 2024” then I’d be able to get that from the access logs. Access logs are only stored for 14 days and then purged, DB backups are taken daily and stored for 30 days.
Thanks for going back and replying to my edit. I had trouble searching for an answer like that, so I really appreciate the response.
Do you happen to know any particular resources that discuss federated privacy?
I don’t, sorry.
Lemmy is pretty light on activity logging, I’m not aware of anywhere that records user IPs. They also made some changes in a recent patch that moved user IDs from a get to a post variable, so I don’t think there’s a way to correlate hits in the access log with a particular user ID. (I haven’t looked into this in a few months, so my info might be slightly wrong)
Basically what we can see is any content you post, even if it’s a private DM (or one you received). We can also see all your voting data.
