Hacker News Reader

To summarize as best as I can tell:

- Bluesky is trying to outsource identity verification to the domain name registration system

- A scammer figured out the blindingly obvious weakness in this strategy and is hoping for a big game payout in response to their blackmail

- Bluesky can’t distinguish between fake and real reports about the issue as that would require spending money on real-world identity verification processes

Did I miss anything?

View on HN

I suppose the extra context is that this entire situation was solved in less than a day, can (and does) happen on any other platform including X, and from what the author has shared this scam doesn't actually seem to have worked on anyone yet -- or that information would have been in the article.

What permanent mitigations were implemented by Bluesky to prevent future occurrences of this?

What platforms besides Twitter use this sort of ‘domain verification of identity’ scheme? Twitter is a lost cause, but there’s still an opportunity to warn less intransigent services.

Reply on news.ycombinator.com