Comment on Angry, disappointed users react to Bluesky's upcoming blue check mark verification system

joel_feila@lemmy.world ⁨4⁩ ⁨days⁩ ago

• emeralddawn45@discuss.tchncs.de ⁨4⁩ ⁨days⁩ ago

  People use usernames like they always have, and rely on reputation to distinguish themselves from the fakes? Senator ted ceuz makes an account called ‘senatortedcruz’ or if thats taken ‘therealsenatortedcruz’, and the mechanic makes one called ‘tedcruzcars’ or whatever. I dont see how your example is even relevant, because under a checkmark verification system both the mechanic ted cruz, and the senator ted cruz would be valid and deserving of a check mark, so there has to be some other way of distinguishing them anyway.

  source

  • joel_feila@lemmy.world ⁨4⁩ ⁨days⁩ ago

    Its whay the original lawsuit that created checkmarks was about.

    source

    • emeralddawn45@discuss.tchncs.de ⁨4⁩ ⁨days⁩ ago

      What is? How does a checkmark help distinguish between two people that have the same name? The checkmark just shows that the person is who they say they are.

      source

      • joel_feila@lemmy.world ⁨3⁩ ⁨days⁩ ago

        Well the original point was to verify famous people and groups.

        source
• sugar_in_your_tea@sh.itjust.works ⁨3⁩ ⁨days⁩ ago

  It’s easy: cryptographic signatures. If you want to prove your identify, post a public key on something that you need to prove identity for (personal website or something) and sign your posts with the same key. That way everyone can tell the that the same key listed on the website is used for SM posts. Clients can check this automatically and flag anything on your “official” account that’s signed with a different key.

  This is much better than a checkmark system, because accounts get hacked and whatnot. It’s really easy to check a cryptographic signature, and it’s really hard to fake. If the website gets hacked, the signature won’t match previous posts.

  The main concern here is losing the key. If someone steals your key, generate a new one, and sign it with the old key and the new one. Boom, now everyone can tell you control both keys, while the attacker only controls the old one.

  source

  • FourWaveforms@lemm.ee ⁨3⁩ ⁨days⁩ ago

    That’s only easy for nerds, and it doesn’t help if the private key is on a device that gets compromised.

    source

    • sugar_in_your_tea@sh.itjust.works ⁨3⁩ ⁨days⁩ ago

      Regular people wouldn’t need identity verification, and the keys can be something the user never sees, just like with Signal. The UX can be pretty good here.

      source
  • joel_feila@lemmy.world ⁨3⁩ ⁨days⁩ ago

    But how would a user see that this poat was made with the right crypto key. Maybe some check mark on the Post or some sign.

    source

    • sugar_in_your_tea@sh.itjust.works ⁨3⁩ ⁨days⁩ ago

      Ideally, they wouldn’t see anything if everything is good. If there’s an anomaly, flag it with a warning.

      But yeah, you could put a checkmark on it, but then it actually means something more than “this person spent money.” Ideally, the checkmark would only show if it’s a publicly verifiable key outside the platform.

      source

      • joel_feila@lemmy.world ⁨3⁩ ⁨days⁩ ago

        Yeah that’s a better system then. We need something that shows the user then post or user is verified. How it works doesn’t matrer to them. Amd the key system would be betterment

        source