A few thoughts on domain verification for social media

Both Mastodon and BlueSky have the concept of "self-verification". Rather than trust a central authority to assess your notability and then bless your account (as Twitter used to do), they let anyone self-attest using Domain Verification⁰.

What does that mean?

• You tell the service what your website is.
• The service gives you a secret code¹.
• You upload that secret code onto your website.
• The service checks the secret code is on the website.
• If it is, the service says your domain is verified.

On Mastodon, that gives you a green tick next to your link. On BlueSky, it gives you the ability to change your username to your website's name.

This is reasonably strong proof that you are the owner of that website. I don't have the ability to add the secret file I've been given to bbc.co.uk, so I cannot impersonate them.

But it isn't all sunshine and roses. There are some important issues with this process.

Revocation and Revalidation

Let's say an employee has validated alice.big_company.com - what happens when Alice leaves²?

Well, you just delete the secret code from your website, right?

In theory yes. But in practice, no.

From BlueSky:

We're working on adding the ability to revalidate these handles periodically.

And Mastodon:

Verified links are currently verified at each time the profile is updated, but they will only be verified once, when initially entered.

So, at the moment, there is a risk that revalidation isn't completed and revocation never happens³. Accounts which were once trusted may stay trusted, even when they're no longer trustworthy.

Copy Cat Domains

You're chatting with your credit card company's social media account. You see that they've verified the domain.

Wait?! Are they really mastercrrd.info ✅?

There are several practical attacks against humans trying to validate a domain name. A simple misspelling is easy to overlook. There are thousands of top level domains, and you may not be sure if your bank uses .com, .uk, .tech, or something else. It only costs a few quid for an attacker to buy a domain which contains a politician's name.

International domain names mean that homograph attacks are possible.

Humans aren't very clever

Recently, several prominent journalists on BlueSky embarrassed themselves by pronouncing fake accounts to be real. The journalists - with all their resources and contacts - didn't bother to actually verify if the person who registered @KemiBadenoch was really the Leader of the Opposition.

They could have checked her website to see if it linked to the new account. They could have rung up the Tory press office. They could have checked to see if she have verified her account. Or they could have done a dozen other things to verify the facts before posting. They didn't.

These aren't random users blindly reposting. These are highly educated, thoroughly trained fact-finders. Their mission is accuracy and their livelihood depends on being able to report the truth. And yet they just assumed that no one would lie on the Internet.

Would a journalist be able to spot that tailer-swift.fartotron.xyz was an impersonator? I highly doubt it⁴.

Hacks Happen

Even when Twitter was validating celebrities correctly, it didn't stop the accounts getting hacked.

An attacker might compromise your social media account or your domain name registrar.

Just because an account and domain appear verified, it doesn't mean they're legitimate. Is that politician you follow really posting about dietary supplements?

It might be too difficult for large organisation

I've written An Easy Guide To BlueSky Verification. It can be as simple as uploading a single file to your website. Although I have some sympathy for claims that managing the process for hundreds of employees might be difficult.

Based on my calculations around 5% of active BlueSky users have verified their domain.

The alternative isn't much better

Verification is hard. Can an over-worked verification team spot that I've photoshopped a passport so that it looks like someone else's?

There are hundred of famous people called John Williams - which one do you verify?

Also, what are you verifying? In my post on Rethinking Twitter Verification, I pointed out that the ambiguity of verification leads to some weird and non-obvious outcomes.

Final thoughts

There are no simple technological fixes to complex social issues.

But I'm naïve enough to believe that, with time, we can train people to be better at assessing the information they are given.