11–18 of 18 posts
Scarce handles create urgency. People rush to sign up and claim their first name, etc. With domain-based handles, that lever disappears.
It’s one of the most common growth tactics I see by social networks launching on BetaList.
Why not take it a step further and get cryptographically proven handle? Instead of relying on global top-to-bottom DNS system?
How come ActivityPub gets shit for making people pick a server, but nobody complains about the mythical "average user" who is supposedly incapable of figuring anything out on their own when ATProto services ask them to understand DNS ? (It's because ATProto services targeted at average users are effectively centralized, which means everyone else has to put up with whatever Bluesky says or lose their access to the bul…
Bluesky doesn’t ask them to understand DNS, it just gives them a free subdomain to start with. This isn’t very different from how Gmail gives you a gmail.com address. But you can also move it to your own domain later and obviously it’s possible to build user-friendly interfaces for that.
To be clear, I actually think it's a good idea to let people associate their own domains with their accounts, but I find it frustrating that people act like ATProto is the only or first example of open social protocols, as this TFA does.
Why not take it a step further and get cryptographically proven handle? Instead of relying on global top-to-bottom DNS system?
Because people don't like it if they can't reclaim their handle when their house burns down.
Earlier quoted context omitted.
Because people don't like it if they can't reclaim their handle when their house burns down.
So just keep a passphrase encrypted backup offsite? Just because the tech doesn't do this contingency planning for you doesn't mean it's impossible.
Earlier quoted context omitted.
So just keep a passphrase encrypted backup offsite? Just because the tech doesn't do this contingency planning for you doesn't mean it's impossible.
Is this a real suggestion for social media users or just a fun remark on it being possible?
Earlier quoted context omitted.
Is this a real suggestion for social media users or just a fun remark on it being possible?
It was a more general remark about decentralized identity. I can't say if the average social media user wants or needs this kind of control over their identity, but I'd much rather have say my DNS tied to a cryptographic credential stored I manage than be delegated to a third party, able to say return a tampered OPENPGP entry to a specific IP without me ever knowing.
Or to put it another way: Not being able to recover access is not something most people will accept and if your technical security measures don't consider that they will be worked around. If people need to go through support to recover their DNS more often then support will be used to giving out access to people's account and that will also reduce YOUR actual security.
Earlier quoted context omitted.
It was a more general remark about decentralized identity. I can't say if the average social media user wants or needs this kind of control over their identity, but I'd much rather have say my DNS tied to a cryptographic credential stored I manage than be delegated to a third party, able to say return a tampered OPENPGP entry to a specific IP without me ever knowing.
I'm pretty sure most people would prefer to be able to recover their DNS in case of catastrophic failure over 100% cryptographic security. The technical aspects of security are never the whole picture. Or to put it another way: Not being able to recover access is not something most people will accept and if your technical security measures don't consider that they will be worked around. If people need to go through s…
Yes, it takes hard discipline--which may lapse no matter the level of experience--to setup offsite recovery with true cryptographic secrets, but it is possible. You can say backup a KeePass file to BackBlaze, protected by a 7-word passphrase. Now all you need for recovery is access to BackBlaze (so same as a centralized service) and your memory of the passphrase, with no one but you having access.
I don't know what the stakes are for most social media accounts or websites. But wouldn't it bring some peace of mind if say Graphene's registrar couldn't just press one button to serve malware on grapheneos.org, which you won't detect until you compare the hashes with say Twitter?