End-to-end Encryption (E2EE) over ActivityPub

[sozialwelten@ifwo.eu]

End-to-end Encryption (E2EE) over ActivityPub

Encrypted direct messages supply the confidence that people need to connect with family, friends and colleagues privately over a social network. As part of the Summer of Protocols 2024, we explore the integration of end-to-end encryption (E2EE) into the ActivityPub protocol.

https://socialwebfoundation.org/program-protocol-e2ee/

#ActivityPub #E2EE #SocialWeb #Foundation #SocialWebFoundation #Encryption #Verschlüsselung #Sicherheit #Privatnachricht

[raucao@kosmos.social]

@sozialwelten It's 2025 now, and there are no tangible results.

[sozialwelten@ifwo.eu]

@raucao It is also not a part of the official Mastodon Roadmap even though there are some open issues in the GitHub repository concerning E2EE.

I personally hope that it will get integrated into ActivityPub and/or Mastodon but for 2026 and 2027 I do not see any signs that there is anything remotely close to being published.

#E2EE #Issue​s #Github: https://github.com/mastodon/mastodon/issues?q=is%3Aissue%20state%3Aopen%20e2ee
#Mastodon #Public #Roadmap: https://joinmastodon.org/roadmap

[koteisaev@mastodon.online]

@sozialwelten @raucao
I searched for some progress information, and found this: https://www.w3.org/2024/09/25-e2ee-minutes.html

[raucao@kosmos.social]

@koteisaev @sozialwelten There is zero progress in that, just a few people discussing what anyone interested in E2EE already knows.

[raucao@kosmos.social]

@koteisaev @sozialwelten FWIW, since Nostr identities are based on key pairs by design, and its developers care a bit more about privacy, E2EE DMs are already being tested via an MLS-based protocol there:

https://github.com/marmot-protocol/marmot

I think it's a shame that none of the large AP implementers are prioritizing this, because without user-owned keys, not just are DMs unencrypted, but there can be no true user sovereignty and account portability on the fediverse.

[lain@lain.com]

@raucao @koteisaev @sozialwelten the problem is, as always, key management. nostr has the advantage that people are already comfortable with handling cryptographic keys. e2ee on AP doesn't make much sense if people don't own their keys.

[raucao@kosmos.social]

@lain @sozialwelten @koteisaev Yes.

[silverpill@mitra.social]

@raucao @lain @sozialwelten @koteisaev FWIW, encryption with user-owned keys is on my roadmap. I don't want to start with MLS, though, it's too complex. The first prototype will likely encrypt messages with user's identity key, as described in https://codeberg.org/silverpill/feps/src/branch/main/0806/fep-0806.md

[informapirata@activitypub.space]

sozialwelten@ifwo.eu I apologize if my point of view may seem conservative and narrow-minded... but in my opinion, pushing for the integration of encrypted messaging into the Fediverse is not advisable. I believe the best solution is that of the Lemmy developers, who have created a button that allows two users with a Matrix account to communicate via software designed for secure communications.