• Barack Obama@sh.itjust.works
    59·
    1 year ago

    As the former U.S. president, I am proud to be a fellow member of this community. Despite evidence pointing to the alternative, I am confident impersonation will not be an issue.

    • Signed

      • Barack Obama, former U.S. president
  • fiasco@possumpat.io
    32·
    1 year ago

    While there are technical solutions to that problem, realistically it’s only a problem if people start thinking they’re celebrities. Personally I prefer a platform that lets people dunk on celebrities.

    • bionicjoey@lemmy.ca
      153·
      1 year ago

      There’s value in knowing if a response is from a specific person, even if they aren’t a celebrity.

      • jayknight@lemmy.ml
        7·
        1 year ago

        As a long time reddit moderator, people creating similar usernames to impersonate another user is definitely a problem. That was instantly bannable in all the subs I’ve moderated.

        Having color coded usernames calculated based on their full user/ host could help. Something like https://gustu.github.io/string-to-color/. That would make it more obvious that two users aren’t the same user.

        • milkisklim@lemm.ee
          1·
          1 year ago

          In the subreddits dedicated to the Cosmere multiverse created by Brandon Sanderson, who is an active redditors, we had a meme of pinging something close to but not actually his username. Especially when it wasn’t something worth wasting his time.

          But yeah, completely agree. I am sure it was frustrating.

      • RickRussell_CA@lemmy.world
        6·
        1 year ago

        But if you want to confirm which instance a username is from, you can do that. Even if reader apps hide it, you can always check the web page.

      • jayknight@lemmy.ml
        1·
        1 year ago

        As a long time reddit moderator, people creating similar usernames to impersonate another user is definitely a problem. That was instantly bannable in all the subs I’ve moderated.

        Having color coded usernames calculated based on their full user/ host could help. Something like https://gustu.github.io/string-to-color/. That would make it more obvious that two users aren’t the same user.

  • CoderKat@lemm.ee
    28·
    1 year ago

    I’m strongly of the opinion that we should never be hiding the domain for either communities nor users. The domain is an important part of both of those. Technology@beehaw.org and Technology@lemmy.world are entirely separate communities and may have very different rules, so it’s important to know which one you’re on.

    And for users, impersonation aside (because let’s be honest, impersonation could just as easily utilize display names or look-a-like characters), there’s also just plain confusion from legitimate users. Common usernames are totally going to be used across multiple servers. If you’re seeing comments from john@smith.name and also john@lemmy.world, you’re gonna wanna be able to tell them apart (display names kinda run counter to this and I’m not certain they’re a good idea).

    • b3nsn0w@pricefield.org
      2·
      1 year ago

      display names kinda run counter to this and I’m not certain they’re a good idea

      i think they would be a good idea if they worked like they do on mastodon: you get the display name and profile pic displayed prominently, but you still have the full username displayed below, with the domain included.

  • ramplay@lemmy.ca
    13·
    1 year ago

    Funnily enough seems everyone is coming at this from the wrong angle personally. I don’t give af who I’m talking to sure, and I can confirm the instance if I must by clicking into their profile.

    That said, I more so care about someone pretending to be me in an active thread. Like an active discussion or argument and someone decides to recreate your user on a different instanceand start inserting comments that confuse the discussion.

    Or maybe you’ve stopped commenting, then someone else continues the conversation unbeknownst to you in your name.

    • helo@lemm.ee
      5·
      1 year ago

      you’re right, it’s a security issue!

      client UIs must make it easy to keep track of who is who.

      • b3nsn0w@pricefield.org
        6·
        1 year ago

        i think this could be resolved by assigning a color to each user based on a hash. maybe people would try to find collisions there (i.e. specifically find usernames that get the same color as you), but if you do something like color_index = hmac(user_address, client_nonce) % color_count where client_nonce is unique to each client, it would be impossible to manipulate usernames to get a collision or even a higher chance at it.

        • hyazinthe@feddit.de
          2·
          1 year ago

          The full user adress should suffice for the hash, because there is only one hyacinth@feddit.de, for example.

          Also, do you really need a hash? Isn’t there a simpler alternative, developing an app?

          • b3nsn0w@pricefield.org
            1·
            1 year ago

            yeah, the point is that if hyazinthe@feddit.de hashes to, say, blue, they can try to find a similar-looking username that also hashes to blue, therefore helping with the impersonation. if you hash a client nonce that’s different for everyone, you may hash to blue on my screen but green on yours, and there will be no relation between who hashes to which color on your screen or mine. the impersonator will have no way to guess if their name would match colors on either of our screens, and if we have, say, 25, colors, it will be a static 4% chance no matter what they do.

            • hyazinthe@feddit.de
              1·
              1 year ago

              Ah, I understand. But couldn’t you just implement the unpredictable colors, you are trying to achive client-side, without hashing, say random order of colors?

  • mojo@lemm.ee
    11·
    1 year ago

    I’ve never even slightly gave a shit to whoever I’m talking to on Reddit/Lemmy. That’s why I like these platforms, they revolve around the content, not the user. On platforms like Mastodon it’d be a bigger issue, but not so much here because there aren’t noteworthy commenters or posters or whatever.

    • FierroGamer@vlemmy.net
      2·
      1 year ago

      Yeah, it’s a forum, it should be more like a cafe in terms of anyone talking to anyone, regardless of who that person is.

      For big personalities and stuff every time it mattered in reddit, I saw proof that they’re them (ama’s usually)

  • pistachio@lemmy.ml
    10·
    1 year ago

    No. The way Reddit works is that you care about the content, not the people posting it.

    Mastodon must have a bigger problem with that (impersonation), but I don’t know if/how they solved it

    • Erk@cdda.social
      1·
      1 year ago

      Eh. I use this for a videogame development community, and the sort of trolling we’ve had on Reddit would absolutely fit with someone trying to impersonate one of the developers to cause shit.

      In fact that actually happened once on one forum.

    • scubbo@lemmy.ml
      1·
      1 year ago

      The way Reddit works is that you care about the content, not the people posting it.

      That’s mostly true, but not entirely. The OP of a thread should be a distinguished role, since their updates have significance in things like AMAs. It would also be good to highlight situations where a different person has joined a reply chain - if you have been having a 1:1 back-and-forth, and you see a new reply in that context, it’s easy to assume it’s coming from the same - an assumption that might make you incorrectly reference prior claims in the conversation as if they were made by that person.

      RIF did the former, but not the latter (AFAIK).

      • b3nsn0w@pricefield.org
        1·
        1 year ago

        it already is though. you get stuff like “creator”, “mod”, or “admin” appended next to usernames, at least on the web ui (“creator” means op, idk why they worded it this way)

    • m-p{3}@lemmy.ca
      1·
      1 year ago

      Mastodon allows you to verify an account by adding a link to your Mastodon profile on a website you control, which will make the website marked as verified in the profile. It’s only worth as much as the trustworthiness of the website itself though.

  • CeruleanRuin@lemmy.one
    9·
    1 year ago

    Do people generally pay much attention to usernames anyway? One of the things that attracted me to old-school forums, then reddit, and now the feddiverse is the decentralized anonymity. It’s all just voices, and they’re all treated as equal, though you can still look at their histories or profiles and get more context if you want. I like that it’s not front-facing. The ideas come first, and personality is secondary.

    • theksepyro@lemmy.ml
      3·
      1 year ago

      On Reddit, it depends on the subreddit. Some of them I don’t care about usernames at all, but on smaller or more specialty/niche subreddits there actually can be a “community” of people who learn about each other

      I imagine it can be similar here

    • NightOwl@lemmy.one
      2·
      1 year ago

      Yeah, I don’t remember usernames. Everyone might as well be anon. I remember comments more than the username that posted it.

    • loutr@sh.itjust.works
      2·
      1 year ago

      Usually not, but I saw a poppinKREAM on here and based on their post history, they’re not the same person as on Reddit.

  • justineie_bobeanie@lemmy.world
    8·
    1 year ago

    I think it would be nice to expect to see user’s full addresses in ui. You can tap around and find it in the options but that takes an active input. If someone is trying to spoof a well known user it should be readily apparent by their @instance registration.

  • MentalEdge@sopuli.xyz
    6·
    1 year ago

    Lemmy has display names.

    Two users can have the same name on the same instance, even.

    If you need to confirm someone is who they seem to be, the full handle is the only unique aspect.

  • yuri@lemm.ee
    6·
    1 year ago

    I’m on liftoff and it displays the domain for everyone unless it matches the domain the post is on. I think this is a good solution. It cuts down some superfluous text while still fully identifying each commenter.

  • lurker@lemmy.zone
    5·
    1 year ago

    Social engineering seems like it could be a bigger problem in the fediverse than on traditional social media platforms.

    I feel that phishing becomes easier when there’s no single authoritative site to log into, as people may not check the URL as thoroughly. Impersonation also seems problematic.

    Like much of the early internet, this new tech seems reliant on trusting the goodwill of others. I’m sure in time we will see the platform evolve to counteract the bad actors.

  • Joe @lemmy.knocknet.net
    5·
    1 year ago

    As far as I can tell the full username is only hidden on the same instance. So for instance, I see your full user name, but I only see the shortname for mine.

  • Gatsby@lemm.ee
    51·
    1 year ago

    Tons of people share the same name in real life.

    I’m not gonna flip my shit if the David I’m talking to walks off and another David says hello to me

    • SMT42@lemmy.world
      4·
      1 year ago

      The only problem would be if two users with the same name are in one thread and you can’t tell them apart