Comment on Queer.af mastodon instance has been shut down by the Taliban
phx@lemmy.ca 9 months agoDoes federation involve some sort of key exchange? If not, would that mean that if one loses control of a domain somebody could spin up a new Lemmy instance to spoof the old one and potentially harvest data?
Natanael@slrpnk.net 9 months ago
Not in ActivityPub no.
The main privacy/security issue is mostly mitigated by the fact that there’s a sync behavior for accounts and follows and distribution of content where the host can push revocation messages, triggering other servers to delete follows and wipe cached account data from that hosting server, which means that somebody who takes over a domain after a wipe can’t imitate the exact same accounts. But old links can still be redirected because there’s no way to verify what they were supposed to point to, so some degree of impersonation remains possible unless other servers agree to preemptively defederate…