this post was submitted on 30 Dec 2024
0 points (NaN% liked)

ActivityPub

0 readers
4 users here now

Focused discussion related to ActivityPub integration in NodeBB

This is a forum category containing topical discussion. You can start new discussions by mentioning this category.

founded 8 months ago
0
Question re: PeerTube's pubkey IDs (community.nodebb.org)
submitted 2 months ago by julian@community.nodebb.org to c/activitypub@community.nodebb.org
6 comments fedilink hide all child comments
 

As part of security checking for incoming events, we check that the keyId sent in the HTTP signature is actually owned by the actor that the activity came from. This is to guard against activity spoofing from separate users at the same server (e.g. user B@server pretends to send a Create(Note) from user A@server).

Our check is pretty simple, the keyId matched against the public key id as retrieved from the actor.

Except it fails for PeerTube because:

  • PeerTube's actors all have the #main-key suffix on their public key IDs (e.g. https://tilvids.com/accounts/thelinuxexperiment#main-key)
  • The HTTP Signature's keyId does not include the #main-key suffix (e.g. https://tilvids.com/accounts/thelinuxexperiment)

So the key ownership cross-check fails.

I could adjust the logic to strip out the URL's hash, but I was wondering if that was actually secure. I assume this is what is already done since PeerTube successfully federates with other softwares.

you are viewing a single comment's thread
view the rest of the comments
[โ€“] silverpill@mitra.social 1 points 1 month ago (1 children)

@julian I am affected by it as well, which is strange because previously federation with PeerTube worked fine. Perhaps they broke it in a recent release