#authorizedfetch — Public Fediverse posts

If you're running a Mastodon server, you might want to activate the "authorized fetch" option (also known as "secure mode").

Having this switched on makes your server-level blocks work much more effectively, and helps to protect your server's members from abuse.

It's extremely easy to activate, step-by-step instructions and lots of questions answered at:

🌱 https://fedi.tips/authorized-fetch

#MastoAdmin #AuthorizedFetch #SecureMode #UserSafety #Mastodon

If you're running a Mastodon server, you might want to activate the "authorized fetch" option (also known as "secure mode").

Having this switched on makes your server-level blocks work much more effectively, and helps to protect your server's members from abuse.

It's extremely easy to activate, step-by-step instructions and lots of questions answered at:

🌱 https://fedi.tips/authorized-fetch

#MastoAdmin #AuthorizedFetch #SecureMode #UserSafety #Mastodon

@[email protected] Signing fetches (different from #AuthorizedFetch) actually has been enabled by default for new #Misskey installations for a while, it was done in some 2023 version despite the performance impact due to compatibility with the rest of the #fediverse where AF is becoming more and more enabled (not helped by the fact that #GoToSocial which @[email protected] uses forces it to be on permanently).

@[email protected] Signing fetches (different from #AuthorizedFetch) actually has been enabled by default for new #Misskey installations for a while, it was done in some 2023 version despite the performance impact due to compatibility with the rest of the #fediverse where AF is becoming more and more enabled (not helped by the fact that #GoToSocial which @[email protected] uses forces it to be on permanently).

Welp I wrote all of this shit only to see it not get federated to the OP's instance. I think they're blocking us lol ​:TenshMelt:​

Well at least I have something to #quotepost if I need to explain (my understanding) of #AuthorizedFetch ​:economist_kasen:​

RE: https://makai.chaotic.ninja/notes/9rzkf0zr1s

Welp I wrote all of this shit only to see it not get federated to the OP's instance. I think they're blocking us lol ​:TenshMelt:​

Well at least I have something to #quotepost if I need to explain (my understanding) of #AuthorizedFetch ​:economist_kasen:​

RE: https://makai.chaotic.ninja/notes/9rzkf0zr1s

@[email protected] Uhh I think you've gotten it fundamentally wrong here ​:thinking_cirno:​

Whether your instance's posts appear on the blocked instance or not doesn't depend on the blocked having #AuthorizedFetch, but rather your instance having AF. That instance can still fetch your posts because your instance doesn't check if the request is signed (so an instance can sign all their fetching but still not enable AF, which is what vanilla #Misskey currently does) and from which instance the fetch request is coming from (hence the "authorized").

Threads already defederates from instances that don't sign their fetching (by design because they've enabled AF), but they don't care if an instance has enabled AF (it's that instance's problem to deal with posts still appearing in Threads).

The problem (I have) with AF is that it's pretty much just #securitytheater. The documentation doesn't seem to account for this possibility, but if your adversary has enough money for some cheap domains and is well-versed in how #ActivityPub works nowadays, then it's trivial for them to forge signatures to look like their fetches come from an innocent server, therefore effectively bypassing the check and allowing the blocked to get your posts into their instance. This is already being done in the wild (with the #Soapbox developer doing this to bypass Threads' fediblock being the most infamous recently).

It also complicates AP implementations because now you have to deal with more cryptography with all that signing and verifying of requests. And signing alone does have a significant impact on performance. It's impossible to create a 100% compatible AP implementation from the spec alone without looking at Mastodon's implementation. That's where the #EmbraceExtendExtinguish or #EEE comes to play.

So overall it's the overeagerness of #MastoAdmins in adopting AF or #SecureMode without understanding the compatibility and performance implications that brought us to this mess today.

@[email protected] Uhh I think you've gotten it fundamentally wrong here ​:thinking_cirno:​

Whether your instance's posts appear on the blocked instance or not doesn't depend on the blocked having #AuthorizedFetch, but rather your instance having AF. That instance can still fetch your posts because your instance doesn't check if the request is signed (so an instance can sign all their fetching but still not enable AF, which is what vanilla #Misskey currently does) and from which instance the fetch request is coming from (hence the "authorized").

Threads already defederates from instances that don't sign their fetching (by design because they've enabled AF), but they don't care if an instance has enabled AF (it's that instance's problem to deal with posts still appearing in Threads).

The problem (I have) with AF is that it's pretty much just #securitytheater. The documentation doesn't seem to account for this possibility, but if your adversary has enough money for some cheap domains and is well-versed in how #ActivityPub works nowadays, then it's trivial for them to forge signatures to look like their fetches come from an innocent server, therefore effectively bypassing the check and allowing the blocked to get your posts into their instance. This is already being done in the wild (with the #Soapbox developer doing this to bypass Threads' fediblock being the most infamous recently).

It also complicates AP implementations because now you have to deal with more cryptography with all that signing and verifying of requests. And signing alone does have a significant impact on performance. It's impossible to create a 100% compatible AP implementation from the spec alone without looking at Mastodon's implementation. That's where the #EmbraceExtendExtinguish or #EEE comes to play.

So overall it's the overeagerness of #MastoAdmins in adopting AF or #SecureMode without understanding the compatibility and performance implications that brought us to this mess today.

Now, the #Fediverse has attracted many users with a desire for safety and data sovereignty (i.e. they should decide what happens with their data). So they get understandably upset when their data gets siphoned without their consent or knowledge. It's not always clear how to protect against this, barring buy-in to codes of conduct and concepts like the still-evolving #AuthorizedFetch. So far, security has been best obtained through obscurity, but this is shaky & hampers ease of use. So what do? 😕

Now, the #Fediverse has attracted many users with a desire for safety and data sovereignty (i.e. they should decide what happens with their data). So they get understandably upset when their data gets siphoned without their consent or knowledge. It's not always clear how to protect against this, barring buy-in to codes of conduct and concepts like the still-evolving #AuthorizedFetch. So far, security has been best obtained through obscurity, but this is shaky & hampers ease of use. So what do? 😕

No, fuck you for making "Public" a gray area when it shouldn't be.

These kind of #privacy freaks and #security freaks (different from privacy-aware and privacy-conscious) who don't understand the definition of #Public.. You know, the types who will put every damn mitigation and flick on every security feature in their computer even though it adversely affects their usability and doesn't really apply to their threat model (this part is especially ignored!), and yet will do an epic #OPSEC fail elsewhere anyway... These kind of people can do a favor for the #fediverse and stay the fuck out of #socialmedia. They can come back once they understand fully the phrase "think before you click".

Don't want people using their #RSS reader against your instance? Fine, then disable it in your instance's settings. But don't expect that you can prevent everyone from still trying to use RSS against your account without your knowledge. Because that's impossible and all you're really doing here is #securitytheater. Just like what #authorizedfetch is.

RE: https://sfba.social/users/FinchHaven/statuses/111868391652688742

No, fuck you for making "Public" a gray area when it shouldn't be.

These kind of #privacy freaks and #security freaks (different from privacy-aware and privacy-conscious) who don't understand the definition of #Public.. You know, the types who will put every damn mitigation and flick on every security feature in their computer even though it adversely affects their usability and doesn't really apply to their threat model (this part is especially ignored!), and yet will do an epic #OPSEC fail elsewhere anyway... These kind of people can do a favor for the #fediverse and stay the fuck out of #socialmedia. They can come back once they understand fully the phrase "think before you click".

Don't want people using their #RSS reader against your instance? Fine, then disable it in your instance's settings. But don't expect that you can prevent everyone from still trying to use RSS against your account without your knowledge. Because that's impossible and all you're really doing here is #securitytheater. Just like what #authorizedfetch is.

RE: https://sfba.social/users/FinchHaven/statuses/111868391652688742

Tbh I really want to disable signing each #ActivityPub object in this #Misskey instance for a free performance boost, but it seems that every other #fediverse server is just enabling #AuthorizedFetch thinking it will protect them...

I curse #Mastodon for pushing this security theater without ensuring to put it into a published spec first ​:parsee_angy:​

RE: https://social.alemi.dev/objects/32e9936f-37d2-4762-8b9c-9b6bf319a748

A small update and expansion of Authorized Fetch: Drawbacks and Limitations

https://hub.sunny.garden/2023/06/28/what-does-authorized_fetch-actually-do/

#AuthorizedFetch

A small update and expansion of Authorized Fetch: Drawbacks and Limitations

https://hub.sunny.garden/2023/06/28/what-does-authorized_fetch-actually-do/

#AuthorizedFetch

the only way to truly solve this is whitelisting instances instead of blacklisting. what #Mastodon calls "limited federation mode".
there's many ways to do this, including stuff like federating allowlists or using a semi-centralised trust source.

but in the end, it still comes down to whitelists.
that's something the vast majority of the Fediverse just doesn't do at the moment, but it may have to change at some point. we'll have to wait and see.

#AuthorizedFetch #federation #FediBlockMeta

the only way to truly solve this is whitelisting instances instead of blacklisting. what #Mastodon calls "limited federation mode".
there's many ways to do this, including stuff like federating allowlists or using a semi-centralised trust source.

but in the end, it still comes down to whitelists.
that's something the vast majority of the Fediverse just doesn't do at the moment, but it may have to change at some point. we'll have to wait and see.

#AuthorizedFetch #federation #FediBlockMeta

okay but fr, I don't see why this is shocking news.
#mastodon, by default, works under the assumption that every instance is good unless proven otherwise. this is also true for many other Fediverse software.
the result is that anyone can get a new domain and mastodon will presume they're a new friendly neighborhood instance. most instances block both gab dot com and gabfed dot com for this exact reason.
(1/2)
https://wedistribute.org/2023/12/authorized-fetch-circumvented

#AuthorizedFetch #federation #ActivityPub #FediBlockMeta

okay but fr, I don't see why this is shocking news.
#mastodon, by default, works under the assumption that every instance is good unless proven otherwise. this is also true for many other Fediverse software.
the result is that anyone can get a new domain and mastodon will presume they're a new friendly neighborhood instance. most instances block both gab dot com and gabfed dot com for this exact reason.
(1/2)
https://wedistribute.org/2023/12/authorized-fetch-circumvented

#AuthorizedFetch #federation #ActivityPub #FediBlockMeta

A controversial developer circumvented one of Mastodon’s primary tools for blocking bad actors, all so that his servers could connect to Threads.

https://wedistribute.org/2023/12/authorized-fetch-circumvented/

@smallpatatas

Here's the best Authorized_Fetch backgrounder I've found

My executive summary:

dot Social will send anything to anyone who asks for it, and will accept anything from anyone who sends it, although the details are complicated

"If Authorized Fetch is not enabled, requests to access public posts and profile information are anonymous. This is due to the current design of ActivityPub, the common protocol that all fediverse servers use to communicate with each other"

Here: https://hub.sunny.garden/2023/06/28/what-does-authorized_fetch-actually-do/

Bet Zuck is happy about this...

#AuthorizedFetch #Threads

@smallpatatas

Here's the best Authorized_Fetch backgrounder I've found

My executive summary:

dot Social will send anything to anyone who asks for it, and will accept anything from anyone who sends it, although the details are complicated

"If Authorized Fetch is not enabled, requests to access public posts and profile information are anonymous. This is due to the current design of ActivityPub, the common protocol that all fediverse servers use to communicate with each other"

Here: https://hub.sunny.garden/2023/06/28/what-does-authorized_fetch-actually-do/

Bet Zuck is happy about this...

#AuthorizedFetch #Threads

@ex_06 @enverdemichelis Cioè dici un toot "privato"? Quelli hanno un URL ma richiedono autenticazione, quindi le persone non citate non dovrebbero mai ricevere il contenuto nemmeno se scoprono l'URL. Le altre istanze federate invece non dovrebbero mai riceverne una copia dalla tua istanza, dato che non ne hanno bisogno. Per ridurre il numero di "copie non autorizzate" aiuta attivare #AuthorizedFetch.
https://hub.sunny.garden/2023/06/28/what-does-authorized_fetch-actually-do/

#MastoDev

@ex_06 @enverdemichelis Cioè dici un toot "privato"? Quelli hanno un URL ma richiedono autenticazione, quindi le persone non citate non dovrebbero mai ricevere il contenuto nemmeno se scoprono l'URL. Le altre istanze federate invece non dovrebbero mai riceverne una copia dalla tua istanza, dato che non ne hanno bisogno. Per ridurre il numero di "copie non autorizzate" aiuta attivare #AuthorizedFetch.
https://hub.sunny.garden/2023/06/28/what-does-authorized_fetch-actually-do/

#MastoDev

Cambiando la configuración del nodo para habilitar AUTHORIZED_FETCH. No descarto que se rompan cosas en el proceso 😅
https://docs.joinmastodon.org/admin/config/#authorized_fetch
#mastoadmin #authorizedfetch

@admin Is `AUTHORIZED_FETCH` turned on for floss.social?

https://fedi.tips/authorized-fetch/
https://hub.sunny.garden/2023/06/28/what-does-authorized_fetch-actually-do/
#AuthorizedFetch

@admin Is `AUTHORIZED_FETCH` turned on for floss.social?

https://fedi.tips/authorized-fetch/
https://hub.sunny.garden/2023/06/28/what-does-authorized_fetch-actually-do/
#AuthorizedFetch