When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. When a legitimate user from a Pixelfed instance follows you on your locked fediverse account, anyone on that Pixelfed instance can read your private posts. You don’t need to be a Pixelfed user to be affected.

Pixelfed admins should update to v1.12.5 ASAP, but upgrading can be a major hurdle.

Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server. Now that server is allowed to fetch all your private posts. And when it knows the posts, it has to decide who to show them. When you accept a follower, you not only place your trust to keep a secret on them, but also on their admin and the software they are running.

Edited to add the last block quote.

you are viewing a single comment's thread
view the rest of the comments

[–] troed@fedia.io 2 points 1 week ago (2 children)

The private account would still need to accept a follower from that rogue instance.

[–] LambdaRX@sh.itjust.works 3 points 1 week ago (1 children)

Yes, but account/instance would need to actively research which instances are rogue, and beware of them. It could be solved by creating tool which would automatically detect this ~~vulnerability~~ feature.

[–] TORFdot0@lemmy.world 2 points 1 week ago

If you have a private account, why would you accept a follow from a user on a rogue instance?

I guess you would need to trust your friend to vet whatever instance they join. And you’d have to vet that you aren’t getting catfished by a threat actor using a friends identity but those are all problems regardless of whether that’s fixed since a malicious admin would have access to your posts so your friend can subscribe to them in the first place, whether this is fixed or not

[–] haverholm@kbin.earth 2 points 1 week ago (2 children)

Edited to add: I got this around the wrong foot, see the reply to this. /edit

Not necessarily, as clearly stated in the linked article:

But sure enough, the toot was followers only and the person that had liked it was not following her Mastodon account. When I took a look at the other persons profile on pixelfed.social, I noticed that the instance was nevertheless claiming the account was following her.

When pixelfed assumes that an account is not locked, it immediately treats a follow attempt as completed. For the server on the other end it looks like a normal follow request. It could be rejected, and pixelfed would still be convinced that a follow relation exists.

[–] troed@fedia.io 8 points 1 week ago (1 children)

Yes, necessarily.

Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server

[–] haverholm@kbin.earth 4 points 1 week ago

Ah, good catch. Thanks!

[–] SkaveRat@discuss.tchncs.de 8 points 1 week ago* (last edited 1 week ago)

Abolutely necessarily.

it works like this:

@privateuser@mastodon.example.com has a "followers only account".
@someuser@pixelfed.example.com is a friend of above account, requested access and was granted. This now causes mastodon.example.com to push all messages of @privateuser to pixelfed.example.com.
@anotheruser@pixelfed.example.com requests access, but gets ignored. But the pixelfed instance marks the user as "follows @privateuser"
In the interface of @someuser, the messages are shown as expected.
In the interface of @anotheruser, they are also shown. Because PF basically does a database "select messages of users that the user follows", without checking if the access was ever granted.

Important to note, that this would not happen, if the messages weren't already pushed to the server due to the "allowed" user