For starters datamining my voting patterns for building a deeper interest profile. It should be pretty obvious how this works in terms of user fingerprinting, and the ultimate monetization of Lemmy data. It would be super naive to think that Lemmy will be the one web space immune to this kind of thing. I guarantee you meta already has an army of silent instances doing this.
Worst case scenario, legit state actors use it to target deanonymization attacks at dissidents. I would not be shocked if the ...usual suspects... Are engaged in this kind of thing.
And that is still possible with pseudonymous tokens votes. You just end up banning tokens for malicious voting activity, and users for malicious posting activity. It's at best a very mild adjustment to moderation workflows.
The current trust model already relies on a user's home instance accurately reporting user activity and not injecting fake activity. Hiding real user votes behind pseudonymous tokens doesn't change that at all.
As far as I can tell, the activity ranking algorithms don't actually differentiate between up and down votes anyway. All votes are considered engagement.
Even for delusional tech bro bullshit, the idea that public voting on an anonymous forum will do anything other than create drama is pretty fucking detached from reality.
On Lemmy the concern isn't even mod abuse - it's just how much user telemetry is pushed around in plaintext which makes me uncomfortable. I'm sure there are already instances which do nothing but listen to AP traffic actively building activity and interest profiles on Lemmy users. Say what you will, but at least on reddit they have to buy that shit. And if such a rogue admin is even a little bit enterprising, there are a bunch of potential IP deanonymization attacks possible by serving up content targeted to specific users during specific times of day. And probably a bunch of other shady shit I haven't thought of.
Honestly it's more than a bit suspicious to me that AP and Lemmy has put seemingly zero effort into mitigating this sort of thing.
It honestly just opens up a whole shitty can of worms. Are admins ready to weigh in every time someone fakes a vote history screenshot showing that so and so up voted a bomb threat before the post got removed?
And you don't even need real crypto here to start. The home instance can just send vote actions as fixed unique tokens. The way the trust framework currently works, this is literally a drop-in replacement and introduces no new spam/brigade vulns which don't already exist from a rogue instance. It would be imperfect, and may still make it possible to correlate and infer vote patterns for a sufficiently motivated adve, but it would raise the bar for protecting user telemetry by a huge factor with very minimal effort. I'm honestly a bit surprised it hasn't been done already.
It isn't true. As far as I can tell there is nothing right now which prevents me from sending a fixed, unique token for any give action from my test instance instead of the user string itself. Only comments would require the real user string, for obvious reasons.
Likewise, another instance could ban that token, or the user or both. This actually does nothing to change the trust model, but would significantly enhance privacy and reduce the propagation of user telemetry.
Yes, and this would be fairly easy to make them at least pseudonymous without even needing to modify activitypub itself.
That said, I still don't support anything which lowers the friction of vote stalking like exposing votes in even more places. Technically people can look up my address from my license plate number if they really care to, but that doesn't mean I want to list it in bold letters on my windshield.
Right now votes really don't matter in terms of post sorting so I'm not sure if there's really a point to this. As far as I understand it, any vote is engagement in terms of making a post active/hot/whatever
The simplest form of this is literally just a token which replaces the universal identity. So you ban the token, you ban the user. This only applies for voting anyway, since commenting and posting follows the plaintext user agent.
A more robust trust model with rotating tokens would fully move ban enforcement to the home instance, which I actually believe is already the case in some situations. Eg, when I am banned from a specific community on another instance it seems as if my host instance knows not to even display a vote on the UI, which suggests that it has knowledge of my federated ban. With this trust model it would be possible to fully enforce cryptographically secure forward security as well.
It would at least provide a means for obfuscating identity for users who care to make an effort. All you'd have to do is not vote when you comment and vice versa.
Because it is giving in to the already problematic functionality of AP, which is the fact that way too much user telemetry is exposed to way too may people as it stands. Work should focus on making AP more private, not less.
There is nothing in the AP spec which states that user strings need to be plaintext. Lemmy should be building out tools which allow AP participants to optionally participate via tokenized user strings.
Pseudonymous voting doesn't mean a unique ID for every vote. It just means the user string itself is tokenized. You can still ban participation for that token without revealing the actual user. Literally the only thing this stops is easily seeing users who use the same name across several instances.
You don't even need to upstream the protocol changes imo. An instance could decide to participate with tokenized user IDs. Other instances could decide to defederate because this is out of spec behavior, but as far as I am concerned it is perfectly aligned with the core spec. Nothing says user activity cannot be anonymized.
But not my votes.