fediverse

<p>Ever wonder how your site proves it’s really you talking to the rest of the Fediverse? It’s not magic—it’s HTTP signatures, the digital equivalent of a secret handshake. With our next release, we’re making that handshake a lot more universal (and a little less awkward).</p><p>Why HTTP Signatures Matter</p><p>When you interact with the Fediverse, you want to know that the messages you send and receive are genuine. <a href="https://swicg.github.io/activitypub-http-signature/" rel="nofollow">HTTP signatures</a> are the technology that makes this possible. Every time your site sends a message, it includes a digital signature—like sealing an envelope with your personal stamp. This signature proves that your content really came from your account and that no one has tampered with it along the way. As a result, you can trust that your interactions across the network are authentic.</p><p>A Bit of Background: draft-cavage and RFC 9421</p><p>If you’ve heard about HTTP signatures, you might have come across terms like “draft-cavage” and “RFC 9421.” These are just different versions of the rules for how those digital signatures are created and checked.</p><p>For a long time, most of the Fediverse has used what’s called <a href="https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12" rel="nofollow">the draft-cavage-12 specification</a>. Think of this as a set of instructions that people agreed to try out, but that hadn’t been officially finalized. It worked well enough to let sites talk to each other securely, but because it was just a draft, there were sometimes small differences in how different software used it.</p><p>Recently, the community agreed on a final, official version of these rules, called <a href="https://www.rfc-editor.org/rfc/rfc9421.html" rel="nofollow">RFC 9421</a>. This is now the standard way to create and verify HTTP signatures. This makes it easier for sites and servers to understand each other and work together, since everyone is following the same process.</p><p>Incoming Support for the New Standard, Out of the Box</p><p>With this update, the plugin will support incoming HTTP signatures that use the new standard right away. There’s nothing extra you need to do. This means that when other servers use the new, official approach for signatures, your site will recognize and accept them. By making support for the new standard easy and automatic, the plugin helps move the Fediverse forward, encouraging more sites to adopt this approach and making connections across the network more reliable.</p><p>Outgoing Requests and the Double Knock Approach</p><p>There’s a new setting for outgoing requests, but for most people, there’s no need to touch it. This option is really for the folks who like to be on the cutting edge and want to start using the new standard for outgoing messages right away. If that sounds like you, here’s how to find it: head to the ActivityPub settings in your dashboard, open “Screen Options” at the top right, and enable “Advanced Settings.” Then, click on the Advanced Settings tab and turn on “Use modern signature format for Fediverse communications.”</p><p>But don’t feel any pressure—leaving this setting off is perfectly fine. The plugin already handles incoming messages with the new standard out of the box, and we’ll automatically enable outgoing support for everyone once the wider Fediverse is ready. For now, this is just an option for early adopters.</p><p>If you do turn it on, the plugin uses what we call the “double knock” approach. It’ll try the new standard first, and if the other server isn’t ready for it, it’ll automatically fall back to the older method. So, you can experiment without worrying about breaking communication with anyone.</p><p>Improved Verification for Existing Signatures</p><p>The plugin also brings improvements to how it handles signatures that use the older method, especially those using the hs2019 algorithm. Now, when a signed message arrives, the plugin fetches the sender’s public key and uses it to determine the correct way to verify the signature, following the specification more closely. This means more reliable verification and fewer errors, making your experience smoother and more predictable.</p><p>Looking Forward</p><p>With this update, the plugin helps move the Fediverse toward a shared standard for signing and verifying messages. By supporting both the new standard and the older method, you’re making it easier for everyone to communicate using the same agreed-upon approach. There’s no change in security, but you’re part of making the network more consistent and helping the community take the next step forward.</p><p>We hope this explanation helps clarify these technical changes. If you have any questions about HTTP signatures or how our plugin interacts with the Fediverse, please don’t hesitate to reach out in the comments below.</p> <small class="notice" x-post-type-data="type=&#x27;Article&#x27; attributed_to=None"> Takahe has limited support for this type: <a href="https://activitypub.blog/2025/07/03/http-signature-upgrades-coming-soon/">See Original Article</a> </small>

<p>Found this via <a href="https://cloudisland.nz/@aurynn/114224782583822300" rel="nofollow">Aurynn Shaw</a>:</p><p><p>When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. When a legitimate user from a Pixelfed instance follows you on your locked fediverse account, anyone on that Pixelfed instance can read your private posts. You don’t need to be a Pixelfed user to be affected.</p><p>Pixelfed admins should update to v1.12.5 ASAP, but upgrading can be a major hurdle.</p></p><p><p>Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server. Now that server is allowed to fetch all your private posts. And when it knows the posts, it has to decide who to show them. When you accept a follower, you not only place your trust to keep a secret on them, but also on their admin and the software they are running.</p></p><p>Edited to add the last block quote.</p> <small class="notice" x-post-type-data="None"> Takahe has limited support for this type: <a href="https://fokus.cool/2025/03/25/pixelfed-vulnerability.html">See Original Page</a> </small>