The 200+ Sites an ICE Surveillance Contractor is Monitoring

[arotrios@lemmy.world]

They would have to hack the individual servers to get at the DMs, because they’re encrypted in transit. All the public stuff is trivial to scrape.

Nope, ActivityPub DMs are not encrypted between servers - if it's on the feed, it's public- or at least it was as of six months ago. I found this out when I attached a Wordpress site to a Mastodon instance and suddenly found i could read anyone's DMs to users on other servers. Totally unencrypted. I actually paused development and working with ActivityPub because of it.

This doesn't mean that messages to users on the same server are necessarily exposed, but the potential is there if you don't have a filter for local publishing only engaged on your Mastodon instance.

[dubyakay@lemmy.ca]

Reddit is right there in your list.

Also:

Gaia Online

Thanks. Brings back memories.

[davel@lemmy.ml]

ActivityPub DMs are not encrypted between servers

It is insofar as TLS/SSL/HTTPS encryption is used in transit. That’s what I mean by encrypted in transit.

i could read anyone’s DMs to users on other servers

If you’re an administrator for (WordPress) ActivityPub server A, you can see all the DMs coming to and leaving from your server, yes. And they’re not encrypted at rest, so you can read them any time. But how would you see DMs going between server B and server C, when your server isn’t involved in the transaction?

[everymuffinisnowencrypted@lemmy.blahaj.zone]

Aww man seriously DuckDuckGo is on the list? Fuckin' traitors...

[everymuffinisnowencrypted@lemmy.blahaj.zone]

Proton

Signal

What are they gonna do? Download gibberish?! Lol, it's all end-to-end encrypted with the decryption keys stored locally.

[tuxenthusiast@sopuli.xyz]

Maybe they got a backdoor

[everymuffinisnowencrypted@lemmy.blahaj.zone]

.............If that is the case, I...am concerned. o_o

[tuxenthusiast@sopuli.xyz]

I mean Sweden asked for a backdoor recently, maybe they're jealous of the US lol

[arotrios@lemmy.world]

It apparently scrapes everything on the public feed. So when I subscribed to users on Mastodon server A from Wordpress, DMs from Mastodon server A going to Mastodon server B became visible.

I had a separate account on Mastodon server A to confirm that I couldn't see these DMs as Mastodon user on server A, and that the Wordpress scrape was grabbing messages normally not meant for public view.

This was using the ActivityPub plugin for Wordpress about six months ago.

[drascus@sh.itjust.works]

Probably just whatever the public metadata is.

[drascus@sh.itjust.works]

Duckduckgo is not the problem. They are using publicly scrapable information. So for instance if they have fingerprinted your device they see you go to duckduckgo, then they see you access a site about buying guns, it becomes trivial to determine what you searched for. They would not have direct access to what you search on duckduckgo and duckduckgo is not giving them access. They are using various methods to collect data based on habits. You can use literally any service you want and they could do the same thing.

[everymuffinisnowencrypted@lemmy.blahaj.zone]

Lol yeah I heard about that. Apparently they also preemptively made post-quantum encryption illegal? Yeah, I don't like the US, but I'm not sure I'd wanna live in Sweden, that's for sure.

[everymuffinisnowencrypted@lemmy.blahaj.zone]

Oof, yeah I forgot about the metadata... What you say is certainly true and is worrisome.

Plus, most people who use email don't use encrypted email so even if they can't get a transcript of a conversation from my account, they can certainly get everything from the other account if they also scrape that platform.

[everymuffinisnowencrypted@lemmy.blahaj.zone]

Oh shit.

Well that clears things up. Thanks for the explanation. thumbs-up

[captainautism@lemmy.dbzer0.com]

Reddit is there.

[rvtv95xbeo@sh.itjust.works]

If that's true, why bother "monitoring" a search engine? This whole list screams of somebody who knows nothing about tech put out a vague RFP and a contractor pulled a list of "top sites" and used it to justify an egregious proposal cost.

DOGE, if you're looking for waste and fraud, perhaps here's a good source.

[arotrios@lemmy.world]

Thank you sir - I've posted an edit with a credit to your astute eye.

[plz1@lemmy.world]

What are they monitoring on Amazon, the fake reviews?

[euphoma@lemmy.ml]

Why tf is PGP, tesseract ocr, and deepl on this list. Deepl is literally just a machine translation service, users don't post onto it. tesseract ocr is a downloadable software for ocr. PGP is encryption.

[drascus@sh.itjust.works]

They do it all to build up a huge web of interconnected data points. Duckduckgo itself they might take as evidence that someone is trying to hide something. Then the government goes to a FISA court and gets permission to have other tech companies hand over all your data. Its not any one site its the picture that can be gleamed from all the data available across all the sites.