Privacy concerns about ability to look at DMs

[Saraistupid]

Problem

As an instance owner, it is possible to look at the DMs of a specific user and their chat logs and such, having that as a feature is a huge privacy concern, on the contrary, it is not possible to check guilds chat logs as easily, which would make sense instead to have ability to read as an instance owner

Letting the instance owner be able to see DMs logs of users opens the door for a lot of potential for targeted harassment, blackmailing, etc... by getting private information about the user from private conversations

Proposal

Remove ability for the instance owner to check DMs of users completely, make it easier for guilds instead, and keep this functionality for reports only.

Notes

No response

Checks

• I searched existing discussions.

[SteveLinkNoah]

In my opinion this isn't really a big concern. You could read the Database directly anyway, so it would only prevent people that don't know what they are doing (and if they don't know what they are doing there is a good chance they couldn't setup the instance in the first place). Besides that you need to trust your instance owner anyway to keep your stuff safe. The only other option is to wait for E2EE for DMs at which point the instance owner can't see anything.

[WarLordElite]

This also falls under a compliance issue. Those hosting the instance are liable and responsible for the content and data hosted on their server.

[Kamalaja]

We cannot meaningfully remove access to DM content for instance operators but expose it for community moderators.

We can encrypt DM content, and only make it to instance admins available via reports - something we have long term plans to do:
https://github.com/fluxerapp/fluxer-meta/issues/7