this post was submitted on 26 Jun 2023
0 points (NaN% liked)

Fediverse

36076 readers
80 users here now

A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, KBin, etc).

If you wanted to get help with moderating your own community then head over to !moderators@lemmy.world!

Rules

Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)

founded 2 years ago
MODERATORS
ruud@lemmy.world
Xylinna@lemmy.world
MrCenny@lemmy.world
TragicNotCute@lemmy.world
automodbeta@lemmy.world
woelkchen@lemmy.world
0
ActivityPub: what stops a malicious actor to post from domains they don't own? (yiffit.net)
submitted 2 years ago* (last edited 2 years ago) by Wander@yiffit.net to c/fediverse@lemmy.world
4 comments fedilink hide all child comments
 

I'm trying to better understand Activitypub and I understand that there's a signature to avoid forgeries of known accounts.

However I'm having trouble understanding what prevents a malicious actor from sending a private spam message supposedly from a never before seen account name with valid generated key pair but for a domain they've never bought since there is no DNS lookup or test.

Thank you!

you are viewing a single comment's thread
view the rest of the comments
[–] Wander@yiffit.net 1 points 2 years ago

Ah, that makes sense. The server tries to retrieve the actor object from the actual url and would notice a discrepancy. That makes sense and is an easy way to implement validations.

I was wondering if I could ask you something else related to activity pub since you seen knowledgeable in the matter. I've been going over these all day and haven't been able to find a good answer:

  1. My understanding is that a create activity doesn't need to have the content itself in the message since JSON-LD exposes the permanent uri in the id property and the receiving server can then make a subsequent request for the content.

Is there a consensus on which approach is better and what would happen if the content field in a note is different from the content that would be fetched by a url?

  1. I've seen that groups are implemented by doing announces. In theory announces could be private based on the view permissions of the original activity. Does that mean that we could potentially have private Lemmy communities at some point?

In that regard, I was wondering if it's possible for an organization or group type actor to forward the activity not with announces but by simply delivering the content to the user's inbox in a transparent manner, similar to an email distribution list.

Thank you <3