EDIT: Initial self-votes don’t federate, so it seems this specific way doesn’t work.
Am I missing something, or is Piefed’s private voting kinda trivial to reverse engineer as long as every user by default upvotes every post and comment they make?
If you have a username and want to find the matching private voting ID, search through that user’s posts and comments for an entry that only has one upvote. The vote cast on that entry will be the private voting ID.
If you have a private voting ID and want to find the matching username, search through all votes cast by the private voting ID to find a post/comment that only has one upvote. The user that posted that entry will be the original user.
If it really is this easy, it seems like it’s sort of a false sense of security. On the other hand, if automatic upvoting of your own content could be disabled by default, that would prevent this from working.
The upvote of one’s own post/comment does not federate. The only effect that upvote has is on the local instance and remote instances that receive the content are free to initialize the score of that new content however they wish.