ActivityPub: what stops a malicious actor to post from domains they don't own?

@Wander · edit-2 1 year ago

ActivityPub: what stops a malicious actor to post from domains they don't own?

terribleplan · 1 year ago

To do the signature validation you need to know/trust the public key signing the incoming request (which will use the keyId in the signature to specify the key of the actor, usually a Person, that made the thing, when your server gets this comment the keyId will be https://lemmy.nrd.li/u/terribleplan#main-key). A good server will check that the keyId only differs from the actor of the object by having a fragment appended.

Your server needs to fetch my Person object, of https://lemmy.nrd.li/u/terribleplan. If you load that with an Accept header of application/activity+json you get:

{
    "@context": [
        "https://www.w3.org/ns/activitystreams",
        "https://w3id.org/security/v1",
        {
            "lemmy": "https://join-lemmy.org/ns#",
            "litepub": "http://litepub.social/ns#",
            "pt": "https://joinpeertube.org/ns#",
            "sc": "http://schema.org/",
            "ChatMessage": "litepub:ChatMessage",
            "commentsEnabled": "pt:commentsEnabled",
            "sensitive": "as:sensitive",
            "matrixUserId": "lemmy:matrixUserId",
            "postingRestrictedToMods": "lemmy:postingRestrictedToMods",
            "removeData": "lemmy:removeData",
            "stickied": "lemmy:stickied",
            "moderators": {
                "@type": "@id",
                "@id": "lemmy:moderators"
            },
            "expires": "as:endTime",
            "distinguished": "lemmy:distinguished",
            "language": "sc:inLanguage",
            "identifier": "sc:identifier"
        }
    ],
    "type": "Person",
    "id": "https://lemmy.nrd.li/u/terribleplan",
    "preferredUsername": "terribleplan",
    "inbox": "https://lemmy.nrd.li/u/terribleplan/inbox",
    "outbox": "https://lemmy.nrd.li/u/terribleplan/outbox",
    "publicKey": {
        "id": "https://lemmy.nrd.li/u/terribleplan#main-key",
        "owner": "https://lemmy.nrd.li/u/terribleplan",
        "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzX8XfO3F/nBKgST+Rqu8\noBxyE1GdvdXpYUYXq9OqwYEVIsE4Jth+aRzx4rSnotnMYyxbhBst3t77dSZAf7ir\nHjpdSoRYdZ0Ce3qJc4mpnctPtDSIjWl+fYwG9oPF51D8cwJewUejHcj6v6ud44Q5\nHbuiYqrMQo2YtWGKMAmjErE8cFinuNcpoNDCCzopCXWfpks48II6f4/aT/Kd66zo\niUYvBMrEmqWATZVbTwnh2MSwu7XTh8O5SlUeceb3LpC7dyCCpkVJU+DYDVqOfPBA\nSb+KmxqOVnewZor6zVDtfelXXx7Zikbff+IcUGbuiJRUlNsyqaq2kxJMZjO/UYCc\newIDAQAB\n-----END PUBLIC KEY-----\n"
    },
    "name": "terribleplan",
    "summary": "<p>DevOps as a profession and software development for fun. Admin of lemmy.nrd.li.</p>\n",
    "source": {
        "content": "DevOps as a profession and software development for fun. Admin of lemmy.nrd.li.",
        "mediaType": "text/markdown"
    },
    "icon": {
        "type": "Image",
        "url": "https://lemmy.nrd.li/pictrs/image/680ced6c-b461-4d7c-906a-9091268f6e7e.jpeg"
    },
    "endpoints": {
        "sharedInbox": "https://lemmy.nrd.li/inbox"
    },
    "published": "2023-06-10T16:10:13.859768+00:00"
}

You can see my Person object contains .publicKey.publicKeyPem, that is what your server will use (and store after fetching it once) to validate the incoming payload/header.

@Wander · 1 year ago

Ah, that makes sense. The server tries to retrieve the actor object from the actual url and would notice a discrepancy. That makes sense and is an easy way to implement validations.

I was wondering if I could ask you something else related to activity pub since you seen knowledgeable in the matter. I’ve been going over these all day and haven’t been able to find a good answer:

My understanding is that a create activity doesn’t need to have the content itself in the message since JSON-LD exposes the permanent uri in the id property and the receiving server can then make a subsequent request for the content.

Is there a consensus on which approach is better and what would happen if the content field in a note is different from the content that would be fetched by a url?

I’ve seen that groups are implemented by doing announces. In theory announces could be private based on the view permissions of the original activity. Does that mean that we could potentially have private Lemmy communities at some point?

In that regard, I was wondering if it’s possible for an organization or group type actor to forward the activity not with announces but by simply delivering the content to the user’s inbox in a transparent manner, similar to an email distribution list.

Thank you <3

terribleplan · 1 year ago

I think implementations often embed the the content into the activity to prevent the need for the receiving instance to immediately connect back to you to fetch the activity in the case of something like create or update. I think it is a bit more unclear whether that makes sense in the case of something done that doesn’t modify the object like such as Like, Announce, etc. (possibly even Delete) and probably makes sense to only include it by reference. AFAIK it is entirely up to implementation and I don;t know of a consensus.
I am unsure on that one… You can certainly target a Delivery. I am honestly a bit confused as to the choice to use Announce at all for Lemmy, as I was expecting “communities” to work through some sort of Collection shenanigans. You can target a Collection of Actors via a Delivery, such as the followers collection. You could manage the collection Using an Offer (request to join a community) and Accept pattern. Certainly seems possible with AP, unsure how easy/hard it would be in Lemmy.

terribleplan · 1 year ago

Oh, there’s also ~~Linked Data Signatures~~ Verifiable Credential Data Integrity that puts signatures right in the JSON itself. This is a real neat option that would allow for all sorts of great things like super easy and forwarding of messages with verifiable integrity, and the ability to store things in a verifiable/trusted way forever. Nobody really implemented it because:

It was pretty under-baked and not standardized at all when AP started getting implemented (as evidenced by it changing names and basically being entirely rewritten). Mastodon, for example, is still on the old LD spec and would not be able to interop if your AP server did not also send the HTTP header signatures.
IIRC there were some privacy concerns about always signing every action, thus not being able to deny that you did the thing you did. Not sure how real these concerns were, but I remember seeing this argument in the past and thinking it was unconvincing

Syboxez · 1 year ago

On the point of 2, it could be made optional, so that the user could choose.