I mean, pretending to be someone in another instance, “stealing” the username, is trivial. I see the more likely targets being instance admins or high profile users. Should we worry somewhat about this?
I mean, pretending to be someone in another instance, “stealing” the username, is trivial. I see the more likely targets being instance admins or high profile users. Should we worry somewhat about this?
It’s a bit of a problem, indeed. Check my current display name as an example - I’m writing from a lemmy.ml account, but the display name impersonates another account in another instance (beehaw.org). Granted, both accs are owned by the same user, but nothing prevents me from doing it towards someone else’s account.
Based on that, I think that:
And for us, users: never rely on the display name. If the identity of someone is contextually relevant, always check the actual username, not the display name.
Twitter implementation seems good enough. Big display name with smaller unique handle below. Might be a bit bloat, but solves the problem.