Paul H is a user on social.device5.co.uk. You can follow them or interact with them if you have an account anywhere in the fediverse.
Paul H @paul

Hey here's something about the Fediverse that some people don't take into account:

I see on "hacker" "news" that there is currently discussion about Scuttlebutt and the very clever opinion is that oh no, distributed social is worse than FB/Twitter because nothing is stopping BigScaryCorp from scooping up all your public posts.

Ignoring the fact that you can very easily have a locked account or even one that has public AND non-public posts... 1/

This also ignores the MASSIVE vulnerability from FB/Twitter apps.

Apps mean not only are you giving those companies your posts, but also your call logs, possibly SMS data, details of all the other apps on your phone, phone number, contact details, usage data, full social graph, detailed location data, ability to read phone storage, microphone access, access to your calendar, activity recognition (are you walking, driving etc), view network connections, etc etc

2/

That's a lot of data people never consider when thinking about this stuff and it's important.

Your posts are what you choose to share, the rest of that data is not and can give a very detailed overview of your life

3/3

Another piece of hugely valuable data that EvilCorp misses when you use federated social media is who you are.

They know your username which gives an idea of who you might be, but without your cookies, email address, browsing history (through web beacons etc), credit card purchases and so on they cannot link you to the existing huge profile that may exist for you.

This is a killer. Posts on their own are almost nothing.

@paul this! So very much this!

This is missing from these discussions all the time, perhaps because it's one of the less obvious (but more sinister) issues with the Microfacegoopple.

Everyone should at one point or another run Mozilla Lightbeam:
addons.mozilla.org/pl/firefox/

@rysiek Indeed. the data Lightbeam exposes is scary and that only shows you the 3rd party stuff your browser is doing. Companies like FB are buying up data from credit card companies, Experian etc and there's no way of seeing that at all.

@paul oh, I didn't know about Facebook buying credit data.

Link?

@rysiek @paul cc data has been standard data broker territory for decades?

@david_ross @rysiek Yep. As with most of this sort of thing people either don't know about it or don't realise exactly how the data can be used. I guess it's only in the last few years with all the other data sources that this has become a big threat

@rysiek Agreed. The worst bit is FB will have your purchase data, income bracket, social graph (from any FB using friends), phone and sms logs (again from friends), browsing history (unless you use uBlock or similar) and in the future your medical records even if you never sign up to Facebook.com!

@paul
Having seen how well Nationbuilder (and other tools) can match identities across networks, I'm not confident this is much defense.

It's something, I agree!

@xurizaemon oh this sounds interesting. But surely if I set up a new federated profile and use a different name, avatar and friends it can't tell it's me? Or can it?

@paul if you make efforts to remain anonymous, sure it'll have a hard time joining hte dots

(unless you want to get *really* freaky eg word analysis or something?)

but ... it's social media, I use my real name and you use "First L", if we don't use our real names it's a different kind of social

so for some values of linkable, it's possible to join the dots

(my username is pretty unique to me, intentionally)

@paul they have less of a corpus to work with yes, but joining the dots is a specific industry and Nationbuilder are pretty good at it

tbf their target audience have "followers" so it's more about de-anonymising / linking their donors with same accounts on facebook, twitter

but that's just a target audience, it works for other values of target

@paul avatar is definitely a good one to connect the dots!

@xurizaemon thanks for the info, I've had a quick look at nationbuilder now. So it looks like they get email addresses from campaign signups on websites.

Do the socials provide email lists to match with accounts? Then they use username/avatar matching to find other accounts belonging to the user on different services?

Also, do you know if they source email lists from elsewhere? Such as where people have provided emails for a different purpose?

@paul they don't share their magic juju for matching

Some services permit matching in some way, eg FB once did share emails but forbade you to store them, I think? Twitter have never "shared" emails, but did let you match a supplied addressbook against accounts.

NB magic is probably a combination of many means of matching, but we prob won't know. Maybe it just matches firstname-lastname-avatar, maybe it's fancier than that. (I think it's fancier than that.)

@paul in some countries voter lists are available, thankfully not one I live in.

"offline" (eg electoral roll in NZ) and hidden or not generally available sources available too.

Anyway, it's nicer over here on Mastodon, but we're still in the open. Like sitting in a cafe is in the open.

Speaking of which, nice to meet you :D

@paul it's nicer here, but I wouldn't mind if there were more local users!

hey #dunedin, say hi

@xurizaemon and you!

Thanks for the info. I would imagine user info could be poisoned easily on the fediverse though. I could set up an account on an instance with matching avi/name to someone on Twitter or FB and Nationbuilder would see it as the same person as they can't get at the account emails on Mastodon/Pleroma etc to verify.

Another takeaway is that using unique email addresses for different services will go at least some way to preventing matching.

@paul
Yes! Someone mentioned a project to inject bad data into all the social data gobblers. I wouldn't mind finding this!

@paul
Maybe we should just do a red team exercise to see how much data can be scraped from the fediverse.
To be honest, I wouldn't be surprised if it was much more most people are aware of.
The insights can be used to think of better protection schemes.

Either way, "I just trust all my data to this big company" isn't the only option to go about privacy.

@peter this is probably a good idea. There could be more metadata and other info that could be extracted from an account or instance than we realise

@paul @rysiek I haven't seen the HN thread, but the fact that we rely on each admin to properly obey the implied security of instance-instance communication means that there really isn't any privacy in the fediverse. Is there a type of toot that I can send to a different instance that can't be seen by the owner of the instance? That isn't stored in a database? That can't be leaked out in the event of a breach or sold to a company by the instance admin?

@ratamacue @rysiek Well if everyone runs their own instance then there's no need to worry about the admin because it is you.

But even with trusting admins of instances that's still better than trusting FB or Twitter IMO. We already know those co's exist to exploit this stuff for money, whereas most instances are in it for the love rather than to sell user data.

This isn't my main point though, which was these companies don't just have your posts

@paul
@sireebob@cyber.space found something. Makes a lot of sense, plus that data could probably be found publicly on proprietary social media too anyways
>because nothing is stopping BigScaryCorp from scooping up all your public posts.
The only thing stooping corps from sniffing PUBLIC posts is the license that the users add on them, I suggest a copyleft license like the CC-BY-SA if any company use it they have to Put the same license on their results and that breaks their economical model.
>Ignoring the fact that you can very easily have a locked account or even one that has public AND non-public posts
Non public post are private, having that function on a Public network is not only giving a false sense of security but it is also not the function of a public micro blogging federation.