Great way to end a busy week!

I guess I can see why. 🤷‍♂️

Not necessary. It’s an internet 101 risk, which has been taken advantage of for decades. I’m confident in my risk assessment that domain-based verification is still susceptible to easy spoofing with mis-spelled domains and alternate TLDs. No need to look at the protocol.

That’s fine, but you haven’t stated one technical fact to dispute mine. You just came in with vague insults implying we don’t know what we’re talking about. I gave a very specific attack vector where domain names are susceptible to attacks by using misspellings.

With all due respect, I think I very clearly called out why the Bluesky domain-based verification system does not solve the problem that the old blue check system did, and why it won’t solve the author’s issue. Obviously it works differently, so I don’t understand the point of the submarine comment.

even if that’s true for this one instance, my comment was about domain verification in general. It doesn’t really solve the problem any more than the new blue checks on twitter. In fact, disposable domains are far cheaper per year than blue checks.

Not only that, but the same issues arise. This imposter added an S to the username. They could just as easily buy a domain name with the same extra S and ‘verify’ with that domain, unless I’m overlooking something.

Same here.

I know you weren’t asking me, but I’ve been a big fan of the Logitech Keys, and now Keys Mechanical, along with the Mx Master 3 mouse. I prefer a good mouse over a trackpad, and the keyboard feels much better to me than the multiple apple externals I own.

Damn. That’s unfortunate, but thanks for the reply.