Using GDPR to Circumvent BlueSky's Adult Content Blocks

I also think the private DMs might be hosted externally to ATProto because that is all meant to be public information or something.

I would assume that the age verification is built at the app layer, so you could use an alternative app (I think they call them AppViews?) to get around the age verification thing. Don't know if alternatives really exist today though, there are probably some.

Bluesky's apps have the verification, but everything else using the protocol can just not implement it.

The smarter thing is the thing we already have with email (and that Mastodon can do) -- you have to place trust somewhere, so do it with whatever decentralized server you choose. I get that it's not robust -- or more specifically you DO have to trust whoever's running the server -- but that's better that the now obvious goofy centralization that Bluesky is now subject to.

I don't think that matters in this context where the rules apply regardless of decentralization. However, I believe that you can in fact just use the protocol without any of the "age verification" nonsense the UK government has imposed on us.

From their privacy policy page:

    Data Protection Officer: Bluesky has appointed a Data Protection Officer (DPO). You may contact our DPO at Ametros Group Ltd, Lakeside Offices, Thorn Business Park, Rotherwas Industrial Estate, Hereford, Herefordshire, HR2 6JT, dpo@ametrosgroup.com.

    Data Protection Representative: Bluesky has appointed a Data Protection Representative (DPR) for both the UK and EU. You may contact Bluesky's EU Representative at Ametros Ltd, Unit 3D, North Point House, North Point Business Park, New Mallow Road, Cork, Ireland, gdpr@ametrosgroup.com. You may contact Bluesky's UK Representative at Ametros Group Ltd, Lakeside Offices, Thorn Business Park, Rotherwas Industrial Estate, Hereford, Herefordshire, England, HR2 6JT, gdpr@ametrosgroup.com.

They seem to have outsourced their compliance to https://ametrosgroup.com/ which would probably explain why it takes forever to get them to comply; the people dealing with the legal paperwork don't have access to the API to run a data export because they're a completely different company.

You send a message to the email address listed on the account. You don't reply to the initial email.

To clarify what happened to me. I emailed them from an account which was not the same as the one used to sign up. (I emailed from admin@example, but the BSky address was 1234@example.com)

They replied saying that they required me to email from the address associated with the account.

I logged into BSky, changed the email address (to admin@), then replied to their message.

They then replied to the account's email. I had successfully demonstrated that I was the person in control of the account.

> Is it legal to assume that the controller of an email address is the same as the person who created the account using the email address?

The law is about proportionality. Would a reasonable person / process assume that only the user controls their email? For a social network, probably. If this were a medical service, it might require passing 2FA.

> If a users inbox has been compromised, can somebody just use GDPR to get all the DMs and data from every other service despite not having passwords to those services?

Yes. But they could also do a password reset. Having MFA helps here.

You can only use what you know of the client, to verify their request.

Proof of control of the only identity you have, tends to be "fair and reasonable".

By the time someone has access to an email account, they could just reset the password and access the data anyway, no loss of trust.

> Is the email "From" field safe to trust? Can it be spoofed?

If it matches the account email address, send the response to that email. A simple spoof will only lead to the user getting a "your gdpr export is ready" but the attacker can't get to the data.

Isn’t that the general practice?

Maybe with extra steps, but most services allow the “I just forgot my password -> I get a recovery email” flow, which trusts that the email from which the account was created is proof of identity. Then you get access to everything else with the password.

The reason OSA puts DMs in scope is because they are out of view of the public. If you start creeping on someone where it is viewable, people will call you out.

If you do it in private it becomes "our little secret".

That's how groomers work. Go talk to any kid blackmailed into doing something they didn't want to do. It often starts with private messages.

Definitely not true.

Public messages risk a wide audience seeing the message and recognizing it’s inappropriate, then taking action against the person, reporting them, or highlighting the inappropriate messages for mob reprisals.

This is why predators overwhelmingly prefer private messaging where they can control visibility of their actions to a single vulnerable target.

You should definitely talk to some women. They generally have a drastically different, dick filled, experience with DMs. Multiply that by the felonies involved with interacting with a minor, the legal requirements of COPPA, and the PR problems of things like "grooming groups found on <platform>", and the problems become more clear.

Of course, the real issue is parents giving their children unrestricted access to the internet.

Now, of course, I'm not naive -- I understand that this idea is extremely unlikely to catch on and we're probably well past it. But still going to put it out there because I think it makes the most sense.

Others devices are not public property.

I would argue that one could be MORE of a creep and lewd in DMs than in public.

In the context of public-broadcast social media, the service's ability to moderate abusive uses of a DM system is probably more important to me than the ability to have absolute control over who reads my messages.

Also, "private DMs" would more accurately be called PMs.