Probably a poor decision to be creating accounts on government operated instances. Since they own the server, they’re in a position to:
Siphon credentials and attempt reuse to gain access to distinct services
Ban individual accounts
Censor based on post content
I’m all for government support and adoption of open-source software so long as they’re not in the position to disrupt how it’s used by the public at large.
Edit (my perspective is relevant, but doesn’t apply in this case): My nerd impulses outran my willingness to read the link’s content. Seems it’s not for public registration.
Edit 2: Like my cornbread eating American ass can read Dutch anyway 🤣
And this is how all Governmental instances have to be, private. Mastodon is a great way to communicate for Government as they control it. They don’t rely on a company and can manage the servers.
From the post of the account linked here (in Dutch): it is going to be a place for official government communication, not for individual government employees (and I presume, by extension, public registration in general)
Agreed, but we have to trust the instances we keep accounts on. Trust is subjective, but I certainly wouldn’t trust a government ran instance for anything other than an outlet for information originating from the owning government.
If I run a private instance or know the maintainer of another, then I can have greater confidence in the security/privacy implementations.
I would trust most government instances more than most of the private instances. Would I trust them not to harvest all of that info? Absolutely not. Would I trust them to not masquerade as me? Way more. Governments have way more to lose by being caught.
I’ve spent quite a bit of time as a penetration tester and one of the first things we do once we recover credentials is check for validity against online accounts known to be good for a given user. We do that because it simulates attackers and government operators alike. It’s a guarantee that free credentials will be abused in one manner or another when they’re available to government entities.
The obvious control for this is to maintain a unique password for each account but that’s not always feasible for users due to myriad conditions.
Probably a poor decision to be creating accounts on government operated instances. Since they own the server, they’re in a position to:
I’m all for government support and adoption of open-source software so long as they’re not in the position to disrupt how it’s used by the public at large.
Edit (my perspective is relevant, but doesn’t apply in this case): My nerd impulses outran my willingness to read the link’s content. Seems it’s not for public registration.
Edit 2: Like my cornbread eating American ass can read Dutch anyway 🤣
This is going to be a private instance. No normal citizens can create an account.
It’s a response to Twitter shielding access to unregistered users. A lot of public services used Twitter to spread information.
And this is how all Governmental instances have to be, private. Mastodon is a great way to communicate for Government as they control it. They don’t rely on a company and can manage the servers.
My mistake.
From the post of the account linked here (in Dutch): it is going to be a place for official government communication, not for individual government employees (and I presume, by extension, public registration in general)
My mistake.
This is literally all instances… Nothing you do here should be considered private or be linked to your real information.
Agreed, but we have to trust the instances we keep accounts on. Trust is subjective, but I certainly wouldn’t trust a government ran instance for anything other than an outlet for information originating from the owning government.
If I run a private instance or know the maintainer of another, then I can have greater confidence in the security/privacy implementations.
I would trust most government instances more than most of the private instances. Would I trust them not to harvest all of that info? Absolutely not. Would I trust them to not masquerade as me? Way more. Governments have way more to lose by being caught.
I’ve spent quite a bit of time as a penetration tester and one of the first things we do once we recover credentials is check for validity against online accounts known to be good for a given user. We do that because it simulates attackers and government operators alike. It’s a guarantee that free credentials will be abused in one manner or another when they’re available to government entities.
The obvious control for this is to maintain a unique password for each account but that’s not always feasible for users due to myriad conditions.
I didn’t say they wouldn’t be abused. I said they wouldn’t be impersonated.
Masquerading is literally the term used for this.
Exactly? I’m confused. Did you not understand my position?
deleted by creator
deleted by creator