Asklemmy

That's why instance is part of the username. It's no different than email addresses.

It's a bit of a problem, indeed. Check my current display name as an example - I'm writing from a lemmy.ml account, but the display name impersonates another account in another instance (beehaw.org). Granted, both accs are owned by the same user, but nothing prevents me from doing it towards someone else's account.

Based on that, I think that:

• the Lemmy software should not allow you to use "@" as part of your display name. Ever.
• clients should always show which instance you're from, even with a display name. (A simple icon would be fine, as long as instance admins set up unique and identifiable instance icons.)
• two accounts in the same instance should never be allowed to use the same display name.

And for us, users: never rely on the display name. If the identity of someone is contextually relevant, always check the actual username, not the display name.

Some other projects in the fediverse have a verification mechanism in place.

I personally like Mastodon's: if you add on your profile a link to a webpage that itself links to your profile, Mastodon will show a green checkmark next to the link: https://joinmastodon.org/verification

So you can verify your profile by linking to a webpage you own or testifies your account's authenticity (ie. your blog, your author page of the publication your write for, etc.)

Hopefully other projects (including Lemmy) will take inspiration from this process to limit impersonations.

To me, this just seems like a variation of the age-old issue of online impersonation. In the early days of social media, there were people squatting on famous people's name/registering variations.

On my instance, admins are tagged as such which seems like a good solution. I wouldn't be surprised if we start seeing verification like on Mastodon, though I couldn't find any issues for this on their github.

This was discussed deeply a few days back.

It's something we should be worried about everywhere we go online.

So try having at least 3 different passwords for personal accounts/websites and also contact moderators or support if you suspect your account has been compromised.