Discussion
Like most social networks, Mastodon is not end-to-end encrypted. If you're sending sensitive info it's better to use a separate end-to-end encrypted messaging app.
Mastodon itself warns you about this if you are sending a DM through the web interface (see the screenshot).
More info about the risks and how to mitigate them in the guide at:
➡️ https://fedi.tips/is-mastodon-end-to-end-encrypted
TL:DR - Main risk is your server admin reading your DMs, but they would need techy skills to do this.
@FediTips so, as a user, this message can be intercepted by literally anyone/thing that sticks their foot in the door?
If you need an E2EE messaging but with a UI that even your toddler can work with, you can try #DeltaChat https://delta.chat
Other than that, you can also try #Matrix, and #XMPP. They are all #decentralized and #opensource
@FediTips as a server admin I think it's worth mentioning that the techy skills required to read users' DMs are pretty trivial. I could do it very easily if I wanted.
Of course I don't, and won't, but I assume there are circumstances where I could be compelled to hand them over to law enforcement or something and I don't think I or the users would want to be in that position!
If you're a techy person they're trivial, but if you're e.g. running it on managed hosting the admin doesn't even get database access (though of course the hosting company staff do).
There's also the complication of moderating DMs, if someone reports it it becomes visible to the admin through Mastodon itself.
@FediTips oh good point. I forget about the hosted services.
@FediTips yes, this is important to know! It's also worth mentioning that the ActivityPub folks are working to add end-to-end encryption to the protocols, so hopefully we'll get that at some point.
Install bonfire.cafe
Get the full app experience
![Farooq [Master Patata]](https://media.bsd.cafe/bsdmmedia01/accounts/avatars/116/916/392/971/982/972/original/7d940acb1047b6c5.png "Farooq [Master Patata]")
@FediTips
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
I wonder how many Fedi users are using PGP or similar schemes.
-----BEGIN PGP SIGNATURE-----
wnUEARYIAB0FgmqkjgsWIQRfwYaAQ1bC5Ge/wrr1vjwiBlASJgAKCRD1vjwiBlAS
Jg9MAP0cmpbIXKHTzb0o03C2lr0sjzcoMWLAfUUo0F3ISnWMhgD8DXU6kXQvdO4o
E8/iOwxyomYsiZHDhdK836Nh4x/IjwI=
=4sok
-----END PGP SIGNATURE-----