Bluesky has a verification problem

Engadget 27.11.2024 22:42 Bluesky is bigger than ever. But as the upstart social media service surges, the platform is facing some growing pains. Among them: The influx of new users has opened up new opportunities for scammers and impersonators hoping to capitalize on the attention — and Bluesky’s lack of a conventional verification system. A recent analysis by Alexios Mantzarlis, director of the Security Trust and Safety Initiative at Cornell Tech found that 44 percent of the top 100 most-followed accounts on Bluesky had at least one “doppelganger,” with most looking like “cheap knock-offs of the bigger account, down to the same bio and profile picture,” Mantzarlis wrote in his newsletter Faked Up. Unlike many of its counterparts, which offer checkmarks and official badges to government officials, celebrities and other high profile accounts, Bluesky has a more hands-off approach to verification. Instead of proactively verifying notable accounts itself, the company encourages users to use a custom domain name as their handle in order to “self-verify.” For example, my employer Engadget currently has the Bluesky handle engadget.bsky.social. But if we wanted to “verify” our account, we could opt to change it to Engadget.com. Some media organizations, like The New York Times, Bloomberg and The Onion have done this for their official accounts. Individuals are also able to verify by using a personal website. But, the process is more complicated than simply changing your handle. It also requires entities to add a string of text to the DNS record associated with their domain. While in some ways it’s a clever solution to verification — only the actual owner of a website would be able to access the DNS record for a domain — it also has a number of drawbacks. It’s a manual process that’s not readily accessible to everyone who might wish to be verified. Verification is even more complex for those wishing to verify multiple accounts associated with the same domain, which may explain why some outlets, like The New York Times and NPR have custom handles, but don’t extend that verification to their reporters on Bluesky. Even Bluesky’s own tutorial suggests organizations seek assistance from their IT departments. There are other issues. Once you change your handle to match a domain you own, your old alias becomes available again. So you’ll either need to set up a new account to “squat” on your old handle, or risk an impersonator scooping it up. And even if you add a custom domain, it doesn’t offer foolproof protection against impersonation. A dedicated scammer could use a lookalike domain and “verify” an imposter account. Both accounts belong to AOC, but only the top one is "verified" under Bluesky's current system. Screenshot via Bluesky To make things more confusing, Bluesky itself gives no indication, other than the handle name, that an account has been “verified.” Verified accounts don’t have a visual indicator — like a check or a badge — that differentiates them from unverified ones, To combat this, some Bluesky users are coming up with their own makeshift workarounds. Hunter Walker, an investigative reporter for Talking Points Memo and early Bluesky user, has been proactively verifying journalists, celebrities and other high-profile accounts himself. So far, he’s verified more than 330 people, including New York Representative Alexandria Ocasio-Cortez, Flavor Flav, Mark Cuban and Barbra Streisand. “I have a pretty high standard for journalism and reporting, and everything I say, I like to triple check the sources,” Walker tells Engadget. “I like to make sure it's confirmed. And it became apparent to me, participating in Bluesky, that on a basic level, nothing was confirmed.” Walker estimates he’s spent about 16 hours over the last couple weeks verifying accounts. He has different methods depending on the user, but it often involves communicating with someone from another account officially linked to them, like a company email address. For celebrities, their representatives are often able to confirm their official Bluesky handles. “I’ve caught so many scammers and imposters, and it's not always who you would expect,” Walker says. “Regular journalists sometimes have three or four imposters.” He says he’s been inundated with requests for his unofficial verification, and notes that a number of people he’s verified also use a custom domain. “They want something else … because a domain is not verification of identity.” Walker maintains “starter packs” of journalists and other prominent accounts he’s verified. Recently, he took it a step further, working with another user to create a custom labeling service that will append different emojis to accounts he’s verified to make his “verification” more prominent. Users who subscribe to the service will see a

Číst celý článek >>