News for hackers. Stuff that matters.
Re:Mastodon.technology Shutdown by bondarchuk on Friday October 07, 2022 @09:22AM (#33120897)
Wouldn't it make sense for there to be a cryptographic verification based on a private key held by the user, so that they can prove to other servers/users that they are the same account as one that existed on a server that has shut down already? Is there something like that in Mastodon?
Re:Mastodon.technology Shutdown by Kye on Friday October 07, 2022 @10:33AM (#33121905)
I think most people in this situation do the same thing people do on Twitter when it suspends an account for nonsense reasons like telling a Nazi to eat paste: make another, make a post, share it with a few friends off Twitter/Mastodon, have them RT/boost to circulate it within their circles. This seems to work pretty well.

Cryptographic certainty is fun to think about, but sometimes you just need people.

Re:Mastodon.technology Shutdown by KvanteKat on Friday October 07, 2022 @10:43AM (#33122052)
It doesn't involve cryptography, but mastodon has for at least a couple of years supported link-verification in profiles (it basically checks if a link back to your mastodon profile exists on a page linked on your profile), so a linking to a page that only you credibly control (say, a personal website) is the de-facto system of decentralized user-verification on mastodon.

Edit: supported since 2018 https://github.com/mastodon/mastodon/pull/8703

Re:Mastodon.technology Shutdown by jefftk on Friday October 07, 2022 @11:00AM (#33122267)
It does sort of involve crypto: if the page you control weren't served over HTTPS it wouldn't be too hard (DNS poisoning) for someone else to trick a server into verifying the wrong user.
Re:Mastodon.technology Shutdown by account42 on Monday October 10, 2022 @06:35AM (#33149781)
If DNS poisoning is so easy why don't you perform the same attach on Let's Encrypt since that also uses plain HTTP.
Re:Mastodon.technology Shutdown by jefftk on Monday October 10, 2022 @06:54AM (#33149892)
Certificate Authorities are extremely careful about DNS (and BGP hijacking), more so than basically everyone else.