So an idea that has been floating around for some time is that you can verify that a link a person puts in their profile belongs to them, by checking if the linked site links back to the profile (with a special attribute that signifies intention), and that it can be used to, indirectly, verify that a profile is "real"
I wonder what the UX for that would look like. I doubt this can or even should be something displayed in-stream like the Twitter verified badge, because with custom emojis, the display name area is absolutely untrustworthy. More than that, the presence of a verified link is meaningless unless you trust the linked site (such as someone's official personal homepage)
So it would probably be something only displayed next to those links.
Okay I didn't mention what the "special attribute" was because I didn't want to alienate the non-dev audience, but I'm getting a lot of suggestions for complicated things, so yeah, I meant microformats rel="me", it's the simplest thing, why would you even bother with TXT records or public keys
@Gargron Perhaps a title attribute or some other hovery thing? That should be distinguishable from emoji stuff.
@Gargron verify sweet max
@Gargron What google did was just ask for a meta html tag on the site with some "random" hash :P
@gargron I think highlighting links on the profile page that link back with rel=me would definitely be valuable. Note sure it translates in to something you can decorate their username with elsewhere in the UI though.
@Gargron hey, I actually understand what you're talking about here!
@Gargron Keybase UI shows each verified identity like this. https://jenkins.cc/media/maMEOdxXHgdsme2hxGw
@jamie The bio supports displaying custom emojis, and you could make that into a custom emoji and put it next to links to fake it. So the looks must be succinctly impossible to recreate with text or emojis.
@zensaiyuki @jamie You have to understand people have been fooled by in people's display names. That's not even a custom emoji, it's a standard unicode one. Don't underestimate how imperceptive people are to minor differences.
@zensaiyuki @Gargron I was thinking more like the existing profile metadata but a way to verify what is put there. Even if it is only website urls using rel=me to check it is valid. A separate output field could show the result.
@Gargron @zensaiyuki @jamie how about a coloured backdrop to the link - something like what Gmail/apple mail do turning an address into a pill-shaped thing?
@Gargron Birdsite has started to put one line of context below the display name for politicians, could do a "owner of stevestreza.com" down there
@stevestreza I have never seen it, got a screenshot of what that looks like?
@Gargron @stevestreza that's basically what app.net did.
@Gargron It sounds like you could build support for a dedicated "also me" field, where users can paste links to any web page that contains a parseable `rel="me"` microformatted link... or perhaps otherwise links to your mastodon profile in plaintext? i don't think you can e.g. insert rel-me links into Twitter or Facebook; at the same time, this could still easily be emulated by custom profile fields already right now if you expect users to manually check the "proof" linked.
@Gargron Tweetbot puts the verified badge over the user’s icon in a way that can’t be spoofed, rather than relying on the display name area. It would probably require framing icons with an outline so it’d be more obvious if someone were trying to get cute. Combine with making the badge link to the authenticating page, and making it a separate field in the profile with its own format (maybe a plain link that spans both columns of the custom labels area)?
@Gargron we discussed this a LOT last week; the general idea is that the links in the profile would be marked as verified.
Start here: https://toot.cafe/web/statuses/100703101215266293
and:
https://toot.cafe/web/statuses/100703599916244412
https://toot.cafe/web/statuses/100704056552533972
http://www.kevinmarks.com/distributed-verify.html
https://toot.cafe/web/statuses/100704056552533972
https://toot.cafe/web/statuses/100704824134207663
https://toot.cafe/web/statuses/100707251932580281
Should give you some reading...
@gargron On the profile page you could split the list in to 2 lists of links—first a list of rel=me reciprocating links (so "also me") the second other profile links (so "related to me"). No special icons or emoji to spoof and possibly easier to understand?
@Gargron this sounds a lot like keybase's proof system. It might be worth looking into seeing if there's a way to do generate and log arbitrary proofs through it. It has the advantage of the robustness of public key/private key signing but abstracts the creation and management of keys away so the average user would be able to use.