Asklemmy

43995 readers

1339 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

Open-ended question
Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
Not ad nauseam inducing: please make sure it is a question that would be new to most members
An actual topic of discussion

Looking for support?

Looking for a community?

Lemmyverse: community search
sub.rehab: maps old subreddits to fediverse options, marks official as such
[email protected]: a community for finding communities

~Icon~ ~by~ ~@Double_[email protected]~

founded 5 years ago

MODERATORS

[email protected]

Can you steal a user's identity if you gain their old domain name? (self.asklemmy)

submitted 1 year ago by maggoats to c/[email protected]

28 comments fedilink hide all child comments

Just a random thought experiment. Let's say I have my account on a lemmy instance: [email protected]. One day I decide to stop paying for the domain and move to [email protected], and someone else gains it and also starts up a lemmy instance.

If they make their own [email protected], how do federated instances distinguish who's who?

Have I misunderstood the role of domain names in this?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 1 year ago* (last edited 1 year ago) (1 children)

You would be surprised: https://money.cnn.com/2016/01/29/technology/google-domain-purchase/index.html

Google.com, one of the most valuable domains on the Internet, was mistakenly sold for $12 last fall.

Google paid $12,000 to get it back.

But you are right about email, it is about the same.

But with time we could be more careful in federation to keep track of domains expiration dates and owners.

Maybe just instances need to be verified with public/private keys and not all accounts on them.

[–] [email protected] 2 points 1 year ago (1 children)

It absolutely makes sense to secure content and especially moderator positions in other communities by public/private keys.

But look at my replies to /u/Dirk below. If someone actually takes over a domain, sets up a new Lemmy instance and creates the same user again (but without matching keys), how should other instances treat that user? Like a new one? Or block all federation? Do you get warnings interacting with that user (as they could just write another community moderator to invite them "again")?

[–] [email protected] 1 points 1 year ago

All valid arguments, code needs to be checked abou what is possible to implement. Even if we start with one way of dealing with those instances, it will be possible to chamge in the future.

Thank you for good discussion in this thread.