Post

This would work if we could verify the domains themselves in the app. It's too easy to buy a look alike phishing domain and most are not going to tell the difference between nytimes.com and some punycode look alike.

It's possible if you create your account using did:web instead of did:plc But: 1. I don't know if it's possible via the current UI (only via API) 2. You'll never be able to change your domain

For writers, have you considered using ISNI as part of the verification process?

Then don't change it. Stay with the identity you already use if you are well known and trusted by that identity. This is how freelancers have been doing it forever on social media. You don't need to be tied to an organization if you already have a reputation independently.

SOMEONE TRIED TO CALL INTO QUESTION MY IDENTITY BY SAYING I WAS NOT THE REAL REP MTG WHICH SHOWS HOW MUCH DISINFORMATION THE LIBS AND THEIR UNDERSEA GREY ALIEN ROBOTS HAVE BEEN SPREADING #GREYALIENS #ILLEGALALIENS #ELONMUSKISARUSSIANROBOT #SLEEPERAGENT -MGT

Plenty of prominent figures liable to impersonation won't always have obviously genuine website URLs or consistent employers—especially journalists (who change employers frequently or are freelance) and politicians (who don't necessarily stay politicians forever but remain important figures).

Verification exists because a child molester impersonated a supporting actor on a teen sitcom to lure abuse victims. It has been used to identify independent activists and journalists so people can't defraud the vulnerable. The people who need it are often not people you've heard of.

If you're saying most people shouldn't be allowed on the Internet, I agree

Can't agree more, it only takes looking at my colleagues complaining about the lack of verification to realise how much you have to lower the bar to entry bsky.app/profile/tk.g...

When you change your username any mentions to the old username will still link to your account, even if someone else claims your previous username. Links and mentions from other websites to your old username would still be a problem, of course.

🤣🤣 facts

Anyone can buy any domain name that isn't taken. Most people in the public eye don't own their own domain name.

Domain names as verification is still something I think it super cool 😎 it really gives my collection of domains something to feel useful about.

I assume this will be announced rhythmically, with a round on the tomtoms

coincidentally i heard that some unnamed government agencies are looking into shutting your labeler down

Welcome!

It should be revoked like how your email access is revoked. Then there will be an invalid handle error and the person would need to fix it.

Just poked repeatedly at bsky.app/profile/cory... on the app but can't figure out if there is a place I could click to go to the linked domain and there doesn't seem to be, which makes it extra difficult to use it to verify.

Every word of this!! Publishing an account's DID in a place independently known to be controlled by the correct person/group establishes veracity much better than some central authority that can be gamed or weaponized.

So there's two parts. Part one is that the handle applies to be verified by a third party that does verifications. Part two is a user subscribes to this third party to gather info on handles, and that's when the badge is presented.

Labelers exists already and can do that

@pfrazee.com a nytimes.social server would be much cooler. you know, so that social media can actually function like email. not google search. I don't understand building a future of social media where your corporate relay determines whether journalism by the nytimes (that might criticize […]

I'm just going to link this again. We could do journalist.ft.com tomorrow but it wouldn't have takeup because people change jobs and squatting your old name as a hack is something you have to teach bsky.app/profile/tk.g... (Might also fix your link issue if we could forward old domains)

unfortunately DNS does not provide any kind of authentication at the user level. The challenges that you need a registry that you can verify against real company domains. You could actually probably charge for this.

This could be gamified and or exploited in so many ways. Someone on the thread brought up the Bluesky user getting fired…if a TTL doesn’t exist already on the domain verification as a handle, it should be introduced. And another avenue but worth bringing up is domain compromise

I think that works well for your personal website that you own but comes with a bunch of issues when it's a domain from your employer. And if you're e.g. a NYT journalist, you probably need to verify that you're the NYT guy even when you don't post on their behalf

What if there was a way with the UI to emphasize prominent/trusted TLDs like .gov and .edu? It could be a blue check like some people are asking for, or something completely different (i’m not imaginative) but this would not make Bluesky the sole authority since it’s still DNS

Domain verification can be subverted through. For example, someone in Will Stancil’s large coterie of trolls owns his name dot com. The troll has verified that domain on Bluesky and it’s almost impossible to know it’s not Will.

That would be true if you wanted to build a professional reputation on Twitter or BlueSky or anywhere else as well the common denominator is the desire of the user, not the verification method used. There just isn't any reason to fuck around on LinkedIn, but you certainly could if you want to.

If anyone is interested I think my OK Cupid profile from DC is still up, but a decade out of date. I’ve mostly gotten doughier around the middle and lost a bit of hair.

Preventing people from impersonating public individuals or institutional actors is absolutely critical, that’s totally different than demanding all accounts use their own names.

FB is a hellscape nearly as bad as Twitter, and LinkedIn is social media the way a middle school formal is a dance club.

Legal name account requirements also prevent privacy and its layer of protection for pseudonymous communication, allowing outing, stalking, and worse. Vulnerable segments of the population *need* to be able to communicate without their legal names attached. Full stop.

> On linked in you take care what you write We must use very different LinkedIn sites.

A unique email address linked to a verified domain is how we authenticate into so many secure systems. So, it’s maybe 3/4s of the way there - using data enrichment similar to what Hubspot does (with some AI verification thrown into the mix) and we should be there…

I think its bad, its like the old blue checks. There will be a bunch of "authorities" speaking to "followers" pretty much like old media.

what if it was a lesser known entity and we (most users) didn’t necessarily know what domain name was real?

There's room for doing similar things the the DID document, but it requires support from each site/service.

If only I gave a shit about reading any of the slop on that rag.

There are industries (like mine) who essentially prohibit employees from tying workplace to social media without strict firm supervision + compliance oversight. So…fuhgeddaboutit.

Any expectation on this works with GitHub subdomains?

it can be two things

Ah, great...!

Is the thinking that Bluesky will handle verification directly, or might it be left to third parties through the current domain system? Curious if there would be appetite for the bsky app throwing a badge onto accounts with handles vended from a "trusted" domain.

It is not the hardest thing in the world to remove a DNS record and can likely be automated while removing access to enterprise emails and services when an employee leaves.

You can just switch back to a bsky.social handle. I had to do that once with another account when I lapsed the domain it was using before switching it to a subdomain of the one I'm currently using. It doesn't require technical knowledge to do that.

They don’t need to already have one, they can buy one now. It takes 5 minutes.

you can actually expect working professionals who’ve cultivated an online audience for many years to own a domain

I think maybe I’d just give up. 😀

LOL Sounds like a you problem and maybe you should do some deep introspection on your life choices.

The handle will show as invalid if it gets pulled before he updates his account, but the account will work otherwise

I think the solution is to let users subscribe to verification services like a labeler. Bsky adds their own as a default. Interface adds a badge with mouseover/click text describing identity/notability. Simple, effective, distributed, user controlled. Allow anyone for a small fee.

It's really handy too bc anybody with a NYT handle is an instablock.

Maybe I should relinquish my hold on the flanneljetpack domain to give someone else a crack at being me, and see if they’re able to do a better job

I like that domain verification doesn't end up with the platform gatekeeping verification from smaller creators like Twitter's effectively did years ago.

Well in the case of NYTimes, generally it's lawyers that prevent that.

Well, that would certainly be cool if the NYT wasn't currently really invested in platforming a bunch of people who keep saying that I deserve fewer rights and more discrimination.

bsky.app/profile/xxwi...

Love it!

Clearly, having a company's domain and being followed by known ppl are similar ideas in principle. I'm curious how this could be extended further to match this social-media context.

What uhh happens if Dylan gets fired? Or becomes CEO of Washington Post? Or even worse, is a freelance photojournalist like Peter Parker a.k.a. Spider-Man?

It never occurred to me to create a subdomain like that. Hmmmmmmmmmm 🤔

I think there should be a verification method for physicians, attorneys, scientists, etc. Could be a good way to help reduce misinformation, especially when discussing content relating to their profession.

Please consider collaborate with World ID

This. Readers should at a glance be sure an account is genuine w/o additional knowledge or having to check external sources. A checkmark achieves that, as it means the platform asserts authenticity. Domain usernames require users recognise domains as genuine, or check externally (which they won't).

That's not the flex Dylan seems to think it is.

Verifying identity is one thing - and a good thing to do. But the issue driving people nuts are impersonations - such as paulfrazeee, paulfrazee1, etc....

I clocked the link and the profile inter server issue

Yeah there's a huge amount of space in what #atproto allows to have even multiple third parties doing different verifications. This is ripe for market solutions, plural. The missing middle is a way to show a "badge" that people easily trust in-app or on the web experience.

that's as great idea!

people with proven identities ruined all other social media with marketing, advertising, general capitalist interest. it's inevitable that the liberal/conservative monopoly will do it here too but it's sad to see any celebrating its advance. anonymity should be the primary concern

If that use is relevant to you, you can easily obtain a domain. It’s cheap and doesn’t take long. You don’t need to make a website, you can just buy a domain and use it exclusively for Bluesky.

Can't wait for this to become so commonplace that websites putting a "real person" sticker on your profile seems dumb.

It's a part of the protocol (see "alsoKnownAs" here github.com/did-method-p...) the app @smokesignal.events talks about it on their blog specifically as a measure to take against impersonation docs.smokesignal.events/blog/extendi...

still think this is it personally bsky.app/profile/suss...

Yep it's a funny way of verification. I created this account to see how it works

You can verify multiple handles & then they'll all point to you if used in a post, iirc. The identifier for verification is unique to you, not unique to the domain, so just reuse it 😊