Domain Names as Handles in Bluesky
blueskyweb.xyz
blueskyweb.xyz
I hope this idea catches on. I think a more decentralized approach to identity combined with 3rd party attestations or filters could change the way the internet works.
Imagine what could be built if everyone used domains as handles / identities. Social networks could go hands off for moderation and allow plugable moderation engines that rely on domains for identity, trust, reputation, etc..
I'm convinced that domain validated identities and attestation could usher in a revolution for reputation and trust. Are there any more projects doing similar things?
Every time this has been tried, it's failed miserably, as it should. People need to be able to post anonymously. Otherwise it's too easy to target the messenger, rather than the message. Think journalists, hackers, abuse victims, political dissidents, whistleblowers. Yes, this makes moderation harder. Sorry but that's life.
The vast vast majority of people are not those things. Even if you wanted to be anonymous to other people you could still prove your identity to a service and the service could keep that identity hidden.
Part of the strength of your anonymity is based on the cost for anyone trying to figure you out. Centralizing your trust in a service that promises to keep your identity hidden is begging for trouble.
The service doesn't have to be malicious and can genuinely make every effort to keep your identity hidden. Trusting services like that creates choke points where it may not have been viable to attack the service for one identity but for hundreds its worth it.
Theres no such thing as flawless anonymity and you can't escape having some number of trusted parties, but you want to keep that list as low as possible.
Just imagine the bubbles. Bubbles everywhere.
on a tangentially related note: Go "package management" is based on domain identity (although most people just use github.com), yet for some reason people seem to prefer to defer to a centralized registry and praise "good package managers" like cargo.
[1] https://www.hostinger.com/free-domain one example
[2] Any regular domain purchased from a registrar. You simply pay and get the domain with no further identity validation required.
The value is in the way the domain owner participates online and what kind of reputation they build. There are many old-school communities where I recognize the handles of extremely knowledgeable, friendly, helpful people and I have no idea what their real names are.
Imagine if the well earned reputations of high quality participants were transferable across online communities by using a domain as global handle.
2. Don't utilize a domain that is shared by lots of people. There is also lots of DNS tricks (TXT records) to "pin" a user to a domain or whatever. If the domain is shared (for example a company website), you just add a TXT record denoting what private key is allowed to do things. Heck you could setup fine grained permissions per key via txt records.
2. Yes they can expire and that situation is detectable. How is this any different than twitter or another service allowing re-use of a deleted username?
Twitter allowing reuse of deleted usernames is completely different than an existing domain that is used as a identity credential to represent different people over time.
This thread is not about whether domains can represent properties on the Internet but whether domains are valid for identification purposes of people as login credentials. They aren't valid, because a domain doesn't uniquely represent a person.
The resource records would live underneath registry.arpa, which has delegations that correspond to delegations at the DNS root; so to find out if example.com has changed, you can query:
$ delv example.com.registry.arpa OWNER
example.com.registry.arpa. 3660 IN OWNER "MEpnFkIk4sKW_oLPEl-R7WxFSAnWvgZnLYmRtn-3BkY"
An interesting related thing is the approach adopted by iSCSI, which constructs iSCSI Qualified Name (IQN)s by qualifying the domain name with the dates of registration.
So iqn.2003-05.com.example is a different identity to iqn.2021-01.com.example.
I think we should make some new TLDs that come with some validation guarantees. Ie john-doe.nation.citizen is always a person who has an Id with the same “John Doe” issued by some government. The registrar is responsible for validating that. Once issues the domain is never revoked- it’s yours forever, even after death. Maybe you subscribe to something for extra features, but the core identity can’t be recycled.
People don’t always want really strong ID like that though. So make other TLDs for other categories and give them different validation rules. Like .human could have some kind of biometric ID but no name. .blob could be a free for all, whatever.
All government agencies would have a verified .gov domain.
States have access to .gov domains
hell, My local town has a .gov domain.
States have access to domains like ca.us, schools in states have access to k12.ca.us domains.
I guess States could offer domains like, person.county.town.state.us but what a mouthful. Or maybe person.citizen.state.us but doesn't seem ideal either.
I guess you could have a verified TLD so you can have individual domains like johndoe.verified... but it takes away from the domain being linked back to my website. Sure I could set up a redirect but boy that's starting to get complicated.
I think domains are a fine barrier for entry for vanity handles. Current domain registers could offer their own verification services where they can include the verification in the whois information.
If Joerogan.biz doesn't come back with some kind of verification string inside then it's not Joe's domain. That string could be a pubkey and services could allow for either encrypted posting or including an encrypted string that verifys against the domains whois information.
Or that pubkey could be stored as a txt record in the domain.
That kind of thing is sometimes suggested as a solution to reduce online disagreements, but in fact just escalate spitballings to murders and gang wars. Not great, in my opinion.
What do you mean rust isn’t the best thing since sliced bread? <calls hitman>
It takes less than 5 minutes to get one.
> Your example happens to be "free domain, when you pay us money", which is stretching the definition of free.
That was just one example, which is what I wrote. There are many others that don't require website hosting. [1][2]
[1] https://www.getfreedomain.name/
[2] https://www.pcmag.com/how-to/how-to-get-a-free-domain-name-f...
However, here is a free subdomain I've done for you. I created http://hnretroid.mooo.com/, added an A record, and pointed it at 209.216.230.240, which is news.ycombinator.com.
There will be another free domain service. There always has and always will be, unfortunately. There always will be something to fill that void. In the same way that legitimate actors write legitimate apps, criminals have their own ecosystems on which they rely for their income.
[1] https://krebsonsecurity.com/2023/03/sued-by-meta-freenom-hal...
Domain registration happens through an established registrar who collects fees. There are no free-as-in-beer top level domains that I’m aware of.
I would love to be wrong, because I own more than a couple domains myself.
You need to be careful, because they are enticing with free and then trying to charge. Free subdomains are easier to obtain, but there are some domains in "off-TLDs" that can be obtained. The list of those changes over time.
Honestly, though, I wouldn't use those for an actual business. The conversation was about how to subvert using domains as identification.
> USD $10 per year might sound like a lot, but how about USD $1 per top-level domain for the first year?! If you manage to gain any sort of traffic in that year, the domain will practically pay for itself!
> Since mid-January 2023, all Freenom-based domains (.tk, .ml, .ga, .cf, .gq) are down and not available
> .free launch dates will be forthcoming.
That’s one weird website with possibly some free subdomains.
Enjoy number domains on .xyz for dirt cheap
That article describes Facebook having brought suit against freenom for giving out free domains, because they were primarily used by criminals. There will be another free domain provider. There always is. But, this also makes the point that the number and impact of these free domains is huge. Spammers use them to spam, and this is one reason why domains should not be considered to have any gravitas as an auth mechanism for identity.
From that article:
Freenom is the domain name registry service provider for
five so-called “country code top level domains”
(ccTLDs), including .cf for the Central African
Republic; .ga for Gabon; .gq for Equatorial Guinea;
.ml for Mali; and .tk for Tokelau.
Freenom has always waived the registration fees for
domains in these country-code domains, presumably as a
way to encourage users to pay for related services, such
as registering a .com or .net domain, for which Freenom
does charge a fee.
On March 3, 2023, social media giant Meta sued Freenom
in a Northern California court, alleging cybersquatting
violations and trademark infringement. The lawsuit also
seeks information about the identities of 20 different
“John Does” — Freenom customers that Meta says have been
particularly active in phishing attacks against
Facebook, Instagram, and WhatsApp users.
“The five ccTLDs to which Freenom provides its services
are the TLDs of choice for cybercriminals because
Freenom provides free domain name registration services
and shields its customers’ identity, even after being
presented with evidence that the domain names are being
used for illegal purposes,” the complaint charges. “Even
after receiving notices of infringement or phishing by
its customers, Freenom continues to license new
infringing domain names to those same customers.”
isn't that what it's about? What else do you think of?
The "identity metadata" bit had already been pushed by multiple registrars for years at that point, as it doesn't require the cooperation of a registry to allow it, and largely gotten abandoned because of lack of user interest.
Public/private keys have or enable all those properties.
While there a many problems with how domains work today as a public goods system, domain names as identities is infinitely better than what we have now, but I think we can have it much better and domain names are one step in that self-sovereign ownership.
The problem with pub/priv keys as user identities is discoverability and validation. How do I find your key? How do I prove this key is actually yours? Sure they are anonymous, but that isn't a desirable property if you are an established public figure.
With keys, validation can happen in several ways: attestation by reputable orgs, reputation systems, off-band, 2FA, “Hi, I’m John”, etc etc. Discovery is also highly context dependent in that it can and should happen “in the app/system” (=whatever the context of the use case is, eg. you know me by pubkey 123, the tax office knows me by pubkey xyz).
“anonymous registration services” from the perspective of self-sovereign identity is by definition not anonymous :)
Things like briar exist, and for you use cases, existing tools might be enough. Briar is fantastic for communicating with people you know and willing to jump through some hoops be part of a community that is anonymous, secure, and provides lots of ways of making introductions and posts.
But there are reasons why Meta, Twitter, Linkedin and the like are well above any anonymous solution in terms of users.
- Identity (including pseudo identity of anonymous users) is established.
- Spam. There is ungodly amount of spammers out there, as email has shown. If you have played with nostr or scuttlebutt you would also see just how horrible the spam is.
- Account recovery, people are bad with passwords and storing secrets. Very bad. And even the most secure people can get exploited.
- Hosting your data is problematic. Who hosts data which may be illegal? When illegal data is flagged, how does it get purged? Merely being the transit for data is protected in the US, but physically hosting that data is not.
- The vast majority of people are unable to run a persistent service for their identity and content. Even if they are willing, they lack the means. You end up targeting a very small subset of people who are willing, able, and capable of running a service. And that service requires care and feeding. You might end up with millions of vulnerable instances.
- Scalability. No one has come remotely close to solving how one of these solutions would scale to billions of users. Or even tens of millions. DHTs become painfully slow and bloated. Even if a solution did start catching on, it would quickly then fail because the user experience would crater as it gains popularity.
I have become convinced that making an ergonomic briar is impossible without making some concessions.
Complaining that a new and unproven tool's chosen concessions are bad inhibits experimentation.
I can’t say there’s a simple solution to all of these, today, but my intuition and optimism says there’s a solution for all of these :)
If there isn't some type of cost or friction to creating identities, you will have a lot of bad behavior, full stop. This has been shown time and time again, so it's basically a non-starter. I don't want to be part of any social network that has this feature (infinite identities), its going to eventually turn to shit or require intense moderation (or both!)
So I disagree this is a non-starter, because we didn’t find a solution in the past, but rather an ideal place to start and a great space to discover new Sybil resistance mechanisms (which we have over the recent years).
There are also protective mechanisms to prevent your domain from expiring. You can pay a balance in advance. Pay for "renewal insurance", etc. As more people use the system, it will grow even more safety rails.
Replace 'domain' with 'identity' and you have a very scary proposition. This is just another form of 'code is law' and doomed for all the same reasons. Bugs and exploits become severe threats to your wealth and well being. As much as we hate to depend on institutions and 'other people', depending on computers program is inherently worse.
This problem isn't new at all.
Would you rather have a situation of ownership with responsibility or no ownership at all?
The "free" alternative is a crypto like identity, and there's zero restitution if you lose your key. People will struggle even more with this. At least with domains there is a legal framework if you're paid up.
You're in trouble if you forget to renew your domain.
And you're in much bigger trouble if your identity is tied to ownership of that domain.
Where I live domain contracts auto-renew. And have reclaim processes.
The Doctor's advice I don't get the reference¹, but for deprecating a device this could be a concern if your phone or similar device suddenly stops working² and that is required to prove who you are.
--
[1] perhaps searching for some officially, erm, unsupported medication resulting in getting blocked by a service that list closely enough linked to an identity provider that the ID account is locked also? — seems a stretch
[2] or is lost/stolen – a potential problem with any physical security token or virtual token if you only have it associated with a single device
Or there is this munich company whose employee visited it's parents and immediately the company github account got locked. Parents happened to live in Iran.
The tip of the iceberg, however.
It’s not like ICANN is guaranteed to not kick you out for “hosting illegal child pornography and advocating organized violence”. It will happen once enough individuals starts relying on DNS.
ICANN also cannot boot your domain directly - they only control the root zone and delegate responsibilities. Maybe for gTLDs they have some say but if you get a ccTLD then the only one who can kick you off is the corresponding country - and if it is your country then that greatly improves your chances of pursuing legal action if your domain is taken away without due process.
If anything, I think having a domain tied to multiple services that break when the domain expires will help people notice so they can redeem within the grace period.
Impersonation via an expired domain might be an issue, but that's already a problem we have to deal with and I don't see how it could get significantly worse, especially since services could put up warnings when domains move between accounts.
How many Gmail accounts expire and then get held hostage with higher renewal fees before going to auction? Oh yeah, zero
However after a period of being used and growing it suddenly disappeared from most of the places I used to see it.
A large problem to encourage and retain a truly decentralised nature is usability. It must be as simple as allowing a site to authenticate you with Google or Facebook, as most users don't care enough to be willing to do more than that, including finding somewhere they trust to register something new.
agency requires a least bit of activity.
I think the kind of approach used here is a bit better than OpenID in terms of separating authentication and identity. You have a permanent account on the service for authentication and the identity (your domain) is more of a pointer / shortcut. That strikes a good balance in terms of letting the service provider dictate authentication policies without usurping your identity people recognize.
Unfortunately I don't think any of the big tech companies would get onboard with an idea like this. They're all racing / competing to control identity right now. Although I've always thought the idea would fit well with Twitter.
I don't having users maintain this domain bit will work very well unless it's integrated with a service provider you're already using, so you'll depend on users relying on decentralised providers already for it to work.
But note that OpenID also allows this. While I used OpenID directly on my own site for a short while, for most of the time that I used OpenID I just added a record to my site that pointed to a third party provider.
The same ability to point somewhere else also exists just fine today with WebFinger, and the Fediverse. E.g. my galaxybound.com/.well-known/webfinger endpoint [1] redirects to m.galaxybound.com, which is my Mastodon install. I could've also put in place a custom webfinger response at my main domain to point somewhere entirely different or add additional resources if I wanted. Similarly, there's nothing stopping e.g. registrars from offering custom webfinger resolution as an extra service.
Personally I'd much prefer that wins, since webfinger provides a single lookup mechanism that can return any number of different types of records for different services without each of them having to invent their own mechanism. This includes using it to discover the OpenID Connect provider for a given user (request /.well-known/webfinger with the "rel" url parameter set to url encoded "http://openid.net/specs/connect/1.0/issuer", and "resource" set to the relevant account URI; setting the "rel" parameter is optional - including it is just a hint that's the only setting you need/want) so you an use it both to indicate authentication preference and to provide arbitrary pointers about your identity.
[1] https://m.galaxybound.com/.well-known/webfinger?resource=vid...
Imagine we let people build communities that self moderate instead of imposing a way to moderate and censor.
https://cs.gmu.edu/~eoster/talks/2022-04-27%20Obj%20Sec%20Co...
You probably also want to read up on anything DANE and DNSSEC related if you want to have reliable information storage in the DNS.
Also somewhat intersecting with that space is https://keyoxide.org/ which can provide proofs of that identity across different services.
I imagine Namecheap and GoDaddy getting involved before long.
> Social networks could go hands off for moderation and allow plugable moderation engines that rely on domains for identity, trust, reputation, etc..
How is this materially different from Facebook handing off moderation tasks to Accenture?
This already exists with Ethereum Name Service (ENS) https://ens.domains and Sign-in With Ethereum.
The ENS stuff is cool, but I hope it doesn’t catch on unless they come up with a way to coexist with ICANN. I think multiple DNS roots would be a net negative no matter what.
I believe, the ENS registry only contains "eth" as an rogue node (also "[0-9a-f]{40}.addr.reverse" is used for wallet names). Recently, ".art" started offering tokenized names, where you get both DNS and ENS.
I'm less convinced by DIDs[1], which is what Bluesky seems to run on: I've yet to see an explanation for why the DID standard exists, given that it effectively punts all semantics (including basic things like cryptographic verification) onto unstandardized "methods" in an uncontrolled global namespace.
Have you looked at DID-SIOP?[0] It's based on the "Self-Issued OpenID Provider" extension[1] to OpenID Connect, to make it easier for existing OIDC relying parties to support those identities.
[1] https://openid.net/specs/openid-connect-self-issued-v2-1_0.h...
I followed this tutorial to set up my own "well-known-webfinger" for my domain, which works: https://philna.sh/blog/2022/11/23/alias-your-mastodon-userna...
There's also a verification feature in a Mastodon user's profile, where you can put a custom html anchor (involving something like 'a rel="me"') in the footer of your website. Then you earn a checkmark, with green highlighting for your website when people look at your Mastodon profile.
I've done this, as well.
Mastodon was around for years with no attn and only got handed this miraculous situation and mass migration opportunity but it just got lucky basically. And it's not even it. This isn't happening again for Bluesky any time soon.
Breaking the walled garden would cost them. E.g wouldnt it mean allowing people to interact with twitter without using the official apps, meaning losing ad revenue? (Obviously why third-party apps were banned)
I wouldn't think Twitter was ever likely to adopt something that will allow it's users to move away and easily keep their followers.
This assumes that
- people know that domains are read from right to left, so that they know that president.whitehouse.gov.usofa.com is not a domain in the whitehouse.gov range (this example is bloated, but domain.com vs. $DOMAIN.com.$DOMAIN-social.net is a common pattern for fraud attempts I get)
- people outside the US know it's .gov, not .com (rarely true?)
But, better than nothing I guess.
Although I agree, it's not perfect. Is there a better approach they should do instead?
The again, people bought a probably mafia owned companies stock because it looked like the software Zoom was the same as the name of that stock, which was an error.
So there is no alternative except for trusting in the word of someone, that identity is what you think it is. But no, i do not think that GNUnet or how ever the HTTPS alternative for trust is called would be a better alternative to prevent fraudulent accounts.
Another random idea: Social media could be kind of a reversed "obligatory imprint", i.e, having a natural person's or company's name as your acccount should mean that they should have a postbox for inquiries. Normally, pseudonymous content is required in germany to have an imprint refering to a legal entity. Reverse, because you claimed to be a legal entity, so be liable for that here. Enforcement could be done via ".well-known" addresses on hosts that serve the actual imprint sites? Or with more effort, by sending codes to physical postboxes, that need to be matched for every company or organisation.
Tl;DR: Further research into UX and thread models is in order, IMHO.
e.g president.whitehouse.gov.us[hover to reveal the rest]
But if it's always fully displayed then it's not really an issue. People could make fake accounts anyway under the current system. If you can't tell @elonmusklet93902398098 isn't really elon musk then I don't know what you expect to fix that.
The important point of this feature is that you know tim.wang.com is really an employee of wang.com and not just a rando. You know he really comes from that address so you could follow all the wang subdomains and know only real wangers will be followed.
You just add a json file
https://whitehouse.gov/.well-known/nostr.json
{
"_": "some-pub-key-goes-here",
"potus":"potus-pub-key-goes-here",
"vp": "vp-pub-key-goes-here"
}
potus@whitehouse.gov
vp@whitehouse.gov
@whitehouse.gov (points to whatever was assigned to "_")
> Sign up for the Bluesky private beta.
Welp this just seems counterintuitive.
Invite-only just backfires ime
It’s not a new problem, but it definitely feels like an endless battle of specifications and implementations.
Most recently I’ve settled on using https://micro.blog/ but I wouldn’t be surprised if I change my mind again within the year as new competitors crop up.
Alternately if they want to stick to the domain structure: user.domain.tld (I've not checked to see if that is already supported).
The problem with both of those though is that you are then less in control of your identity – the domain owner has the power to stuff you over if you are just a user of it. Because of this issue for you as the user, it means that the identity is not as trustworthy to the service because the domain owner can take control of it themselves or reassign it.
I don't think this is true. When you control the domain then you control email and subdomain address spaces. In the context of the given example, there's no difference in control between dholms.xyz and dan@dholms.xyz or dan.dholms.xyz when the same person registered or created all of them.
Exactly. How does the service trusting that the address or subdomain as identity know that they refer to the person that created them?
I have surname.tld, I create dave@surname.tld for me and wayne@surname.tld for my brother. If Wayne annoyed me and I was a dick about it I could revoke the name or reconfigure it in order to act in his name maliciously. The same for sub-domains. How does a service wanting to trust the address as ID know which of us has that control? My identity is more strongly linked to my token (address/sub-domain) than Wayne's but there is no way to infer this from the identifying tokens themselves.
Of course a hack at domain registrar level could stiff it all over, so even only using top-level domains isn't perfect, but there is definitely a difference in the level of identity stability guarantee between domain and sub-domain or email address. (So the is a difference between dholms.xyz, and dan@dholms.xyz or dan.dholms.xyz)
> Daniel was previously @dan.bluesky.social. Now his handle is @dholms.xyz
If you're gonna tie your identity to it. PKI is very important. EV pki cert gives me more confidence in the authenticity of your account.
How many people do you think I can fool with trump-white-house.trust (or many other cheaper/easier TLDs)?
It got acquired and promptly nosedived.... with users leaving faster than rats from a sinking ship.
Obviously the account would still have standard credentials but once the new domain owner proves ownership does the old handle get reverted to something else so the handle can be used by the new owner or is that account name forever squatted?
That's interesting!
And you're actually following the DID. I wonder how you present this to folks so it's understandable.
1. You're setting your own domain handle, in which case you're putting it in your dns record. In this case, it'll just be that string you're sticking in the TXT record.
2. You're migrating hosts. We haven't implemented this flow yet, and since the DID will be referenced in your data export you may not even be aware of it in this case.
3. You're a developer
Maybe BlueSky could offer a registrar that would do steps 1 & 2 for you transparently upon domain purchase.
example.com <--> ryan29-abcdef
(You’d also probably better make sure your DNS resolver uses DNSSEC validation, and that your DNS resolving code path requests it by default.)
But I definitely think that the protocol itself must be open for it to be viable.
Does this mean that either homograph attacks or punycode are going to make it into Bluesky? Or is this another protocol that's built around English and nothing else?
Bluesky is the classic solution looking for a problem.
> These posts from this and other servers in the decentralized network are gaining traction on this server right now.
I mean, what the hell does that even mean to a layperson?