If they are, and there isn’t anything to display it, how are were to know what’s been vetted and what’s slipped through the cracks? Especially on a new account?
Comment on Angry, disappointed users react to Bluesky's upcoming blue check mark verification system
cyrano@lemmy.dbzer0.com 3 weeks agoBut isn’t the domain already doing that?
spongebue@lemmy.world 3 weeks ago
MangoPenguin@lemmy.blahaj.zone 3 weeks ago
It was the username so already quite visible.
For example someone at say, NPR, could use a name like @bob.npr.org which is only possible by verifying ownership of the npr.org domain name, so there is no need to vet anything.
spongebue@lemmy.world 3 weeks ago
That’s great for an organization like NPR which may have the resources to tie its own domain name into Bluesky. For some freelance reporter or otherwise verifiable person, I’m not sure it’s quite so practical.
thekerker@lemmy.world 3 weeks ago
I saw some small talk about it, and it really just boiled down to domain verification is great for more tech savvy folks, but trying to get larger accounts (think politicians, celebrities, etc) is a lot harder. Having a visual check, using tools within the app or site, is a lot easier.
And personally I like the idea of verification checks as long as it remains a simple means to do just that: verify the owner of the account. Morons like Musk and his ilk always thought it was a clout thing, and for a small minority that was probably the case, but by and large before he ruined it, it was great.
BackwardsUntoDawn@lemm.ee 3 weeks ago
I feel like domain usernames are still inherently susceptible to phishing, you can get a typo or similar character to try and trick someone that your username is an official one
Natanael@infosec.pub 3 weeks ago
Domains only help you verify organizations and individuals you recognize directly.
This verification system also allows 3rd parties (it’s NOT just bluesky themselves!) to issue attestations that s given account belongs to who they say they are, which would help people like independent journalists, etc.
Saleh@feddit.org 3 weeks ago
Idk. Celebrities and Politicians usually have other vetted channels such as their own website or a website of their ogranization representing them. It should be basic journalistic work to see if their social media links link to the account in question or not.
BeardedGingerWonder@feddit.uk 3 weeks ago
I’m not seeing the advantage of everyone having to do the same vetting process repeatedly.
Saleh@feddit.org 3 weeks ago
So it is not given to a centralized authority, that is guided by for profit motives and also does the moderation of its plattform.
Where this can lead was shown with twiiter. The moment the central organization is captured, the central authority will abuse the authentification for its own goals. Then instead of just having to check for the authentification to be reliable you need to question everything that is on that plattform as a whole, which is infinetly more consuming, but also simply impossible.
nekusoul@lemmy.nekusoul.de 3 weeks ago
The problem with domains is that regular people would need to know what a domain is and what verified ownership says about the account in question.
Even then, reading domains is quite difficult, even for people who know about the topic: Humans are Bad at URLs and Fonts Don’t Matter
01189998819991197253@infosec.pub 3 weeks ago
That link was a super interesting read!
lagoon8622@sh.itjust.works 3 weeks ago
Excellent post as usual from Troy, but use Bitwarden, not 1Password
nekusoul@lemmy.nekusoul.de 3 weeks ago
Personally I use KeePassXC + Syncthing, but Bitwarden/Vaultwarden is also a great.
What’s somewhat amusing, for lack of a better word, is that even that advice doesn’t fully resolve the issue, as Troy himself recently was the victim of a phising attack, where one part of the issue was that even legitimate sites changes their sign-in domains frequently enough that you kind of become numb to when the auto-fill stops working and just “correct” the issue.