@mray But now you know why I'm asking. There is lots of energy around encryption but it's a very tricky thing to be done right. My point was simply that we start with some simple UX improvements and not wait for the encryption (given we already have private messages)
Post
Replies:
0
@scottjenson My take (which seems to fly in the face of the zeitgeist) is that Mastodon is not meant foremost as a private messaging app. It is at its core, an *open, social* microposting platform. There are apps that are radically better suited for private and safe comms, and I am a huge proponent of letting things be true to themselves. When you try to shoehorn stuff into a system not intended to do that stuff, it ends poorly.
So, sure, DMs out of the timeline, but no Signal-like hardening.
@octothorpe Thank you! To be clear, I'm not against adding encryption to Mastodon but it would be rather different than what you get with Signal. Here is a simple example. Many people are quite public with their real name here on mastodon, that makes sense. But if you REALLY wanted to use an encrypted message you ikely wouldn't want to use your public name. So in many ways, encrypted messages by you very little (well,in some situations)
That's kind of my point, I don't think people really see the FULL JOURNEY necessary for encryption.
However, many have said "I just don't want to have to trust my admin. I just need it for privacy" and you know, that's a perfectly good reason and to be fair, has NOTHING to do with competing with Signal.
That's all I'm trying to do here, understand how and why it would be used.
@scottjenson I dig it. And yeah, the complications you implied are probably exactly the same I did (my post char limit is small)… which is why I shorthanded to ‘signal-like’.
But yeah, I get why folks may want it. I think it’s probably best to not encourage that behaviour in the app (because of how easily it could be accidentally borked, ex: public posting passwords). The notion being if you KNOW it’s not encrypted, you’re less likely to send sensitive material.
@scottjenson I think, given today's climate, encryption should be a priority over UX changes. My thought is not whether microblogging DMs should be encrypted or not, but simply if *any* kind of messaging exists that is not public, on any service, it should be encrypted. It's the sad world we live in now where services can't be trusted. Non-public messaging that isn't encrypted shouldn't exist. Should microblogging services be Signal? Not at all. But DMs already exist, so now it has to be dealt with. Simply telling users "it's not for private discussions" isn't enough.
in 2026, gabe is absolutely right. a few years ago, i would've been the first one debating this position... but it's 2026.
@gabek @scottjenson
“It’s 2026” is about to be the final boss of product design:
Dev: Should we do this feature?
Me: It’s 2026, what do you think?
Dev: Say no more…
@by_caballero @gabek We've publicly announced we're working on encryption. It's a TON of backend work. It can proceed in parallel with UX work. It's not one vs the other. Especially as the UX work is FAR less than the encryption work
@scottjenson some of these are in the Mastodon roadmap!
https://blog.joinmastodon.org/2026/02/our-technical-direction/
@mapache Yes, I know! 😉 I'm not saying no I'm exploring when (as encryption will take longer than UX improvements
As long as there's a "hey, this isn't encrypted!" Kind of Disclaimer, I'm fine. If we wanted encryption, there's other apps or services. But, I don't want people to mistakingly share sensitive info on this platform.
That said, encryption in the future would be amazing, but I prefer other improvements not be blocked by that for the moment.
@scottjenson broadly, encryption for DMs on a social network isn't something I'd expect.
Would any of the proposed changes to DMs trigger age-verification requirements in the UK, Australia, etc?
@mia Honestly I hadn't even thought of that, thank you for bringing it up!
Yes, I need it.
Because I do not trust you, the admin.
I also don't trust those who will seize servers.
@katzenberger Fair enough, but can you tell me when you'd use it on Mastodon vs when you'd use it for Signal? I'm trying to understand if Mastodon, by implementing this is likely to replace Signal usage for many people? I don't think it will so I'm trying to understand WHY you'd need it in Mastodon when you just use an app that specializes in this.
Because "private" means "private", on whatever platform.
Platforms have different purposes. I'm not seeking for a Signal replacement, I just want the promise of "private" conversations to be kept. Like I'd expect it from any other platform that is speaking of "private" messages.
More pointedly, I would accept DMs from (and periodically check my inbox for) Mastodon but i would not give my unique and precious signal identifier to all of mastodon and all who crawl it @katzenberger @scottjenson
@by_caballero @katzenberger This is something that I have to admit a blindspot. There appear to be so many nuanced layers to "sending and encrypted message". For example, some just want to keep the admin from seeing stuff (that seems like the lowest level)
But at the highest level is for example protext organizing. I can't imagine ANYONE wanting to do that from a Mastodon account only because your profile and public posts likely leak a tremendous amount of personal info.
If you had a LOCKED DOWN account, sure it could work. My point is that I'm trying to understand these very different usages as we could naively asume we're good at one when we aren't. For example, I strongly feel that Signal very much still has a role here even if we do implement it correctly.
You know who's thought a lot about secure messaging? SWF's @mallory .
See also:
https://socialwebfoundation.org/2025/12/19/implementing-encrypted-messaging-over-activitypub/
@by_caballero @mallory @katzenberger Thanks for the intro!
@katzenberger Fair enough, I'm not arguing against that. It's just that encryption isn't easy and will take a long time. I'm using this as a 'research foil' to understand why people use Signal vs encrypted Mastodon PMs.
I totally get that people just want safety baked into everything, I'm not against that in any way. But it is very hard to do well.
I understand that, and if there is a roadmap that leads to having it, I'm happy with that.
It may also be worth considering a collaboration with those who have the expertise and are working on related ideas for the Fediverse already, like @soatok
@scottjenson Encryption would be very good for private mentions. The point of “private” is that it is private. If someone is notifying of a security related issue for example - no one else should see it. Not only is it against the description of the feature; it’s an actual problem because the feature implies a trust that should not be given.
@mattwilcox all fair points!
@mattwilcox My issue is simple: Should Mastodon replace Signal? Given how good it is, I'm trying to understand it's place in the world vs ours?
@scottjenson No. But if you offer “DMs” or “private mentions” you have to fulfil on that. You can not palm it off to other services. Nor do you need to replace other services. You just have to deliver on the implicit promise.
I think it’s unfair to assume users will know or find out that “here” DM/private acts differently to every other service using those terms.
@scottjenson it's great that you've shared this question. It's a good example of feature prioritization tradeoffs.
For me, encrypted DMs wouldn't matter in Mastodon. As a rule, I don't share things here privately that I wouldn't want to be made public.
... and that's mainly because (as you point out) DMs appear in the public timeline. It's such a confusing UI choice that I'm VERY careful about what I write in DMs here. 😜
@jarango exactly! For me PMs are a convenience. I don't personally need it. But there are folks working on it in a FEP but my understanding is that it is fediverse wide not just Mastodon (as it should be!)
Given how hard it'll be to do this I'll like to clean things up and not wait for the more secure option (especially if most use cases don't require it)
@scottjenson here's another way to put it: for me, unless DMs are shown separately from the public timeline, then the fact they're encrypted wouldn't make a difference. The dedicated DM space is the critical feature, encryption can follow.
@jarango My thinking exactly. My concern is that there are some peolple that really want it and I'm trying to suss out how important it is to them (and why) What I'm getting so far from this thread is quite the opposite.
@scottjenson I can imagine encryption would be a very important feature for lots of folks drawn to the Fediverse.
@jarango bingo, now you know what I'm kind of making a strong point to get a feeling about how strongly people actually feel about this.
My point is that encrypted communication is very valuable, but it's usage is quite distinct from microblogging. I'm trying to understand who needs it WITHIN Mastodon (vs just switching to an app that specializes in and likely will do a better job if I'm honest)
@scottjenson @jarango it feels like there is an overlap between microblogging and private messages.
Sometimes the microblog topic opens up a conversation that you would like to follow up in private.
At the moment you need to switch service which adds friction.
But I get your point in not wanting to build another messaging app when there are good ones like Jami.net, Signal, XMPP, etc.
Have you thought about linking messaging accounts to reduce friction?
@themipper @scottjenson we've been through this before. In the early days, Twitter DMs were specified by typing `d username` and then the text. As you may imagine, this led to several spectacular privacy fails.
IMO we know enough at this point to say private messages should be completely separate from the public timeline. They are different contexts that should be kept separate because the consequences of a mix up could be disastrous.
@jarango @themipper Now you know why I want to make these changes sooner rather than later!
@scottjenson as often happens in UX, it comes down to ontology.
Is this a place for publishing or communicating? Are DMs in service primarily to facilitating the former or exclusively for the latter?
Someone has to decide. I can't imagine that's easy in a volunteer-driven org.
@jarango 😄 Now you know what we're moving towards this more pubic way of discussing things. It's not enough to make a decision, we have to bring the community along with us.
@scottjenson it probably should, lord knows what people would send; passwords, identity materials, tokens, etc
@scottjenson I think it would be fine, but I guess you'd still need to solve some design and architectural questions up front if you *know* you're going to do encryption in the end.
@neal yes! Good point. We already do PMs however so we'd start with fixing these
@scottjenson One thing that probably needs to go away is the ability to accidentally drag someone into a conversation by mentioning them. That flexibility is *dangerous* for private messages.
@neal OOOOOh, that's a cool point! Thank you. What are you suggesting, that PMs are ONLY 1:1?
As a related issue: replies to "followers only posts" being "my followers only" is a strange behavior.
I think if there was a "replies can only restrict the audience compared to the audience of the replied post, not expand it" constraint, that would solve both issues
@scottjenson I think that PMs should lock to who they are initiated with. That means the people tagged for that conversation when the PM is initialized are the only people who can be in the conversation. Further mentions *must not* expand the group.
I don't know if that means you should break the ability to do a private reply to a public message, but UX wise it might make sense to do so.
@neal I will be thinking ALOT about this comment. Thank you for explaining it. Very much appreciated.
@scottjenson I'm a fan of prioritizing the DM experience first.
wrt encryption, part of the challenge is how to interpret "private." Instead of the, "Who can see this?" default posture of Mastodon, this starts to ask something like, "Who cannot see this (beyond the addressed person/people)?"
@earth2marsh I'm not sure I follow, can you explain this default posture a bit more and what you'd like to see a bit more?
Deliver UX improvements first, technical improvements later. The law of low-hanging fruit.
Encrypted messaging would be nice to make this a place for social organising as the US and other countries become more authoritarian.
@scottjenson If messages were encrypted, I think it would be really important that there is a very clear distinction between encrypted and unencrypted posts. Using the same part of the UI for both encrypted and unencrypted messages with the only distinction being a hard to understand setting behind a button I think invites confusion as to what the precise security guarantees are.
@scottjenson I was actually just thinking about why private mentions are even needed when there are other options like email for private and sensitive discussions between folks. I guess I never truly understand why they are needed in a public social network in the first place? Just leftover from Twitter precedent?
@scottjenson
As critical as encrypted email.
(I realize this doesn't answer your question, but it's a very similar thing)
