Edit: obligatory explanation (thanks mods for squaring me away)…

What you see via the UI isn’t “all that exists”. Unlike Reddit, where everything is a black box, there are a lot more eyeballs who can see “under the hood”. Any instance admin, proper or rogue, gets a ton of information that users won’t normally see. The attached example demonstrates that while users will only see upvote/downvote tallies, admins can see who actually performed those actions.

Edit: To clarify, not just YOUR instance admin gets this info. This is ANY instance admin across the Fediverse.

  • @[email protected]
    link
    fedilink
    English
    697
    edit-2
    1 year ago

    To anyone surprised at this: welcome to the fediverse, please treat everyhing you do or say as public.

    The way to achieve privacy around here is by following the long forgotten arts of the old internet before Facebook was a thing: use a Nick name and don't tell strangers on the internet your real identity.

    Your home instance will act as a proxy and only they have access to your email and IP address. That does stay private.

    So, as long as you trust your home instance to not leak or disclose your connection or sign up data (which would be illegal in EU countries), just sign up with an alias.

    A very positive aspects of this is that it should allow us to detect voting manipulation by correlating the activity of certain potentially malicious actors. If Lemmy instances take vote manipulation seriously and do their best to block bots this has the chance to make Lemmy / Kbin much more transparent and credible than Reddit ever was.

    • @[email protected]
      link
      fedilink
      English
      209
      edit-2
      1 year ago

      Lol. kids these days would post their bank info online if the banks didn’t prevent them from doing so.

      • @T156
        link
        English
        1651 year ago

        You say that like A/S/L wasn’t a thing back in the day.

      • @[email protected]
        link
        fedilink
        English
        341 year ago

        I don’t want to shame anyone, but I’ve had people sign up give me their full DoB and offering to show me their ID. I know of people who disclose their id to get access to nsfw discord communities.

        • @RivenRise
          link
          61 year ago

          DUDE MY GIRLFRIEND FUCKING DID THAT AND I JUST LOOKED AT HER AND ASKED HER IF SHE THOUGHT THAT WAS A GOOD IDEA. In hindsight no, thankfully she’s gonna be moving soonish. This was from before we were together, otherwise I would have warned her not to do that. It was the same discord she got a cyberstalker from, thankfully the stalker wasn’t a friend of the owner because otherwise he totally could have gotten her address and irl info.

      • @[email protected]
        link
        fedilink
        English
        151 year ago

        Wasn’t there a twitter account that retweeted people posting photos of their credit cards?

    • BitOneZero @ .world
      link
      English
      241 year ago

      Your home instance will act as a proxy and only they have access to your email and IP address.

      Your home image typically doesn’t proxy image loading, those are hotlinked to the Lemmy server that the image was uploaded to. So your IP address and browser string are going to other Lemmy servers.

      • @azuth
        link
        English
        41 year ago

        The posts just contain a URL which doesn’t include the uploader’s ip address or their browser string.

        • BitOneZero @ .world
          link
          English
          71 year ago

          When the browser loads that URL, hotlinked image, that server has to have your IP address to return the results. Just browsing posts those images are being loaded.

          • @azuth
            link
            English
            51 year ago

            Of course. They dont get any info to associate your IP with your lemmy account. You could even not have a lemmy account at all.

          • @azuth
            link
            English
            21 year ago

            Of course. They dont get any info to associate your IP with your lemmy account. You could even not have a lemmy account at all.

          • @azuth
            link
            English
            11 year ago

            deleted by creator

          • @azuth
            link
            English
            11 year ago

            deleted by creator

          • @azuth
            link
            English
            11 year ago

            deleted by creator

          • @azuth
            link
            English
            11 year ago

            deleted by creator

          • @azuth
            link
            English
            11 year ago

            deleted by creator

    • @[email protected]
      link
      fedilink
      English
      191 year ago

      I whole heartedly agree with this perspective.

      Additionally, and this is an unpopular opinion, but trying to maintain a Nick or online identity over many years is folly. You end up with a huge repository of personal information, increasing the risk that it can be connected to you personally.

      • @[email protected]
        link
        fedilink
        English
        51 year ago

        This has come up as part of those requests to migrate accounts between instances. “I want a persona that stays with me for years”… Is that actually a good idea though!?

    • @TerraNova
      link
      English
      121 year ago

      What about post views? Are those also stored?

      • @[email protected]
        link
        fedilink
        English
        291 year ago

        No, Lemmy currently doesn’t do authorized fetch and thus there’s no way for users to request access to a certain post, which would sort of require to disclose a user wanting to get access to something. So no, they are not stored as part of activitypub.

        They could be logged on your instance’s server and/or the server where are an image is hosted as part of typical logs for web requests. These would contain your ip address and other browser metadata such as the user Agent, but these are typical logs that happen every time you load anything on the internet on any website that exists.

    • @[email protected]
      link
      fedilink
      English
      81 year ago

      No, an alias will only give you pseudo-anonymity. Even trivial analysis like counting which words occur together frequently in your writings can reveal with very good accuracy any other alt of you, so the available information of you is basically everything you have shared online with enough accompanying self-written text.

      • deweydecibel
        link
        English
        11 year ago

        Also, it’s not just about privacy, it’s about retaliation. It will be the easiest thing in the world for people to put together bots that will track the downvotes on every post they make and automate adding those people to block lists. Suddenly a whole fleet of alts is invisible to the people that would disagree with them.

    • Sterben
      link
      English
      51 year ago

      Me, using an mail alias + VPN, should be safe privacy wise. :)

    • @Yaxoi
      link
      English
      21 year ago

      The thing is, there is really no way to know is trustworthy as a home instance…?