A new form of verification on Bluesky

I got verified in the initial round of verification.<p>On a technical level, this sort of works like a Root CA: anyone can verify anyone by publishing a `app.bsky.graph.verification` record to their PDS. Bluesky then chooses to turn those from trusted accounts into the blue check, similar to browsers bundling root CAs into the browser.<p>* <a href="https:&#x2F;&#x2F;pdsls.dev&#x2F;at:&#x2F;&#x2F;did:plc:z72i7hdynmk6r22z27h6tvur&#x2F;app.bsky.graph.verification&#x2F;3lndpy3ngb62l" rel="nofollow">https:&#x2F;&#x2F;pdsls.dev&#x2F;at:&#x2F;&#x2F;did:plc:z72i7hdynmk6r22z27h6tvur&#x2F;app....</a> &lt;- bluesky verifying me. it&#x27;s coming from at:&#x2F;&#x2F;bsky.app, and therefore, blue check<p>* <a href="https:&#x2F;&#x2F;pdsls.dev&#x2F;at:&#x2F;&#x2F;did:plc:3danwc67lo7obz2fmdg6jxcr&#x2F;app.bsky.graph.verification" rel="nofollow">https:&#x2F;&#x2F;pdsls.dev&#x2F;at:&#x2F;&#x2F;did:plc:3danwc67lo7obz2fmdg6jxcr&#x2F;app....</a> &lt;- me verifiying people I know. it&#x27;s coming from at:&#x2F;&#x2F;steveklabnik.com, and therefore, no blue check.<p>I am not 100% sure how I feel about this feature overall, but it is something that a lot of users are clamoring for, and I&#x27;m glad it&#x27;s at least &quot;on-protcol&quot; instead of tacked on the side somehow. We&#x27;ll see how it goes.

&gt; Bluesky’s moderation team reviews each verification to ensure authenticity.<p>How is this compatible with Bluesky&#x27;s internal cultural vision of &quot;The company is a future adversary&quot;[1][2][3]? With Twitter, we&#x27;ve seen what happens with the bluecheck feature when there&#x27;s a corporate power struggle.<p>[1]: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=35012757">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=35012757</a> [2]: <a href="https:&#x2F;&#x2F;bsky.app&#x2F;profile&#x2F;pfrazee.com&#x2F;post&#x2F;3jypidwokmu2m" rel="nofollow">https:&#x2F;&#x2F;bsky.app&#x2F;profile&#x2F;pfrazee.com&#x2F;post&#x2F;3jypidwokmu2m</a> [3]: <a href="https:&#x2F;&#x2F;www.newyorker.com&#x2F;magazine&#x2F;2025&#x2F;04&#x2F;14&#x2F;blueskys-quest-to-build-nontoxic-social-media" rel="nofollow">https:&#x2F;&#x2F;www.newyorker.com&#x2F;magazine&#x2F;2025&#x2F;04&#x2F;14&#x2F;blueskys-quest...</a>

Not convinced by this.<p>We need a way to reflect that human &quot;social trust&quot; is born distributed, and centralising trust subverts it. But here, while they introduce third party verifiers, rather than individuals deciding which verifiers to trust, bsky is going to bless some. So this is just centralised trust with delegation.

I built handles.net[1] to make it easy for organisations to manage their member&#x27;s handles, I think that using domain names for identity is neat and valuable, I have a vested interest in its success as a paradigm but... domain name &quot;verification&quot; is not the right solution today for non-technical people. I shared this sentiment a few months ago[2] and I have only become more confident in that assessment since.<p>The approach they&#x27;ve taken (&quot;trusted verifiers&quot;) is an approach aligned with their values, as it is an extension of the labelling concept that is already well established in the ecosystem. As an idealist, it is a shame that they gave up, I think they could have had an impact on shifting how non-technical people view domain names and understand digital identity... but as a pragmatist, this is the right choice. Bluesky has to pick their battles, and this isn&#x27;t a hill to die on.<p>[1] <a href="https:&#x2F;&#x2F;handles.net" rel="nofollow">https:&#x2F;&#x2F;handles.net</a> [2] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=42749786">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=42749786</a>

It’s ironic that many comments are skeptical of strong centralized moderation, but they’re posting these comments on a forum with perhaps the strongest and most centralized moderation team of the entire internet.<p>All I’m saying is that if weak moderation has had a positive effect somewhere, it’s worth showcasing that. Otherwise the evidence is decisively in favor of strong moderation.<p>In terms of how to keep the moderation team from deteriorating, other platforms could learn a thing or two from HN: put someone competent in charge of the team, and give them lots of incentives to do well.

This is better than twitters nonsensical verification but still does not close the loop all the way. I think what is needed are a set of equivalency verification&#x27;s. Sort of like the domain verification used in getting a TLS certificate.<p>Something like<p><pre><code> bluesky user X is equivalent(has control) to domain A(domain verification) to youtube account B (youtube verification) to mastodon account C (mastodon verification) to D@nytimes.com (email verification) </code></pre> So logically I would expect a protocol that allows cross domain verification. Best I can come up with is something that works sort of like domain verification extended to user@domain verification. that is, a better engineered version of &quot;make a youtube video with the string &#x27;unique uuid code&#x27; in the comment&quot; so that we can verify you own that youtube account&quot;<p>The problem is that some domains would have no problem standing up this sort of verification. The Times only benefits from verifying it&#x27;s employees. However I can see fellow social media sites balking as this equivalency weakens their walls that keep people in.

&gt; Additionally, through our Trusted Verifiers feature, select independent organizations can verify accounts directly.<p>As someone who believes in equal access and privilege, this is just horrible. &quot;Trusted Verifiers&quot; - how does the bsky team decide which orgs can be trusted? One could argue that this is worse than Twitter. And of course, the echo chamber is going to get worse.

Hamartia: The tragic flaw that takes the hero to the top will lead its downfall.<p>It seems to me that BlueSky is trying to rewind the clock and be the pre-Elon Twitter. They had a decent chance to become what Signal is to messaging, but looks like they are trying to be just another Social Media company.<p>We’re truly in the post-social media age.

This seems like an anti-feature. The appeal of Bluesky is exactly the lack of a Twitter like central authority.

I like the idea of a trust hierarchy. Bluesky verifies NYT, then NYT verifies all their journalists. Makes the entire process a lot more scalable.

I think I&#x27;ve seen this movie before and it doesn’t end with meaningful community trust. It ends with people paying for status, accounts impersonating others with a wink and a checkmark, and eventually, trust being eroded by the very signal designed to uphold it.

I&#x27;m not a bluesky user yet but in reading through the post I discovered a problem with their implementation of the ID verification.<p>They describe it as a &quot;blue check&quot; when in fact it is a white check on a blue circular background.<p>Just nit-picking I guess but sometimes I read a passage that describes something and I conjure an image in my mind of what I would see should I open my eyes with it all laid out in front of me. This does not fit the image that is described in the post and makes we want to question the author&#x27;s observational skills.

The old blue checks were very useful as a way of knowing who was approved by the regime. So I sort of look forward to this, even if I still really struggle to even casually use bluesky.

It&#x27;s giving Twitter &quot;official teller of truth&quot; vibes

If I was in a less charitable mood, I would categorize it as a misguided attempt at re-implementing previously failed ecosystem. But I am in charitable mood so allow me to say instead &#x27;bold move. lets see if it pays off&#x27;.

Hey, I have this personal homepage. Available under a domain name. I trust myself, so I put a PNG of a blue check on it. If you don&#x27;t trust me, I also have a blue check on my website that is put there by my best friend. Now you have to trust me. I guess I&#x27;m verified now, authenticated even.<p>The web really was better with more pseudonyms. I don&#x27;t care if you are you, I can read your text, judge it on it&#x27;s merits (according to my yardstick) and I basically don&#x27;t care if you or other people consume information that is true or false.<p>Am I missing something?

I&#x27;ve always found those blue checks to be a ridiculous idea.<p>Internet was intended to be anonymous.

Why not let users pick their own Trusted Verifiers?

It seems like the main problem with verification is that everyone is conflating what verification is or is supposed to be.<p>It doesn&#x27;t mean &quot;this person is trustworthy&quot; it means &quot;this person is who they claim to be&quot;. But people desperately want it to be the former, or some sort of club.<p>But these are completely orthogonal concepts that demand different solutions.<p>Bluesky should do better here though, their definition of &quot;verified&quot; is buried in the blog post as &quot;authentic and notable&quot;. This is okay I guess, sort of matches old Twitter. But a bit wishy-washy.<p>One idea could be to link verification badges to Wikipedia (or Wikidata) entities so you understand who is confirming what about the account. &quot;This Mark Cuban Bluesky account is the same as the Mark Cuban in this Wikipedia article&quot; and let the Wikipedia editors fight over noteworthiness etc.

Pardon the naive question, but could verification not be accomplished by requiring to tie a form of payment to an account? Eg, a CC or equivalent? Outsource the identity validation to other institutions (eg banks), and benefit from their deep investment into identity verification. Would that not work?

I&#x27;m trying to remember a single moment in the last twenty years of desiring identity verification and I just can&#x27;t think of anything.<p>Maybe people trying to protect their &quot;brand&quot;? Is there really that much demand for branded content?

Good! I’ve been using a third-party labeller (which is a great hack), but making it more user friendly and official is a great thing.<p>I’m a proponent of verification only for “important people”. Yes, the definition of important is funny, and people may feel slighted by it: but I’ve yet to find a system that helps me identify high quality sources so immediately on a social media platform.

Bluesky remains the single best example of how decentralization works best as components of the architecture, not its raison d&#x27;etre.

Shouldn&#x27;t there be some kind of points-system to the verification?<p>If I am verified by 2 parties each of whom is verified by 10 parties each of whom is verified by 1 party then my verification score would be 20 (= 2 x 10 x 1).<p>Then people could trust me beinhg me 20 x more than somebody who is only verified by one party who is only verified by one party who is not verified by anybody?

I prefer the Nostr approach that also has domain based verification, but it opens up the door for anyone with domain to do it. <a href="https:&#x2F;&#x2F;github.com&#x2F;nostr-protocol&#x2F;nips&#x2F;blob&#x2F;master&#x2F;05.md">https:&#x2F;&#x2F;github.com&#x2F;nostr-protocol&#x2F;nips&#x2F;blob&#x2F;master&#x2F;05.md</a>

Bluesky is riddled with pornography, even with the strictest settings enabled. I genuinely don’t feel comfortable scrolling any of the curated feeds in a public place except for my direct “Following” only feed.<p>Not sure how big of a priority this is for the team that runs it, but I would probably use it 20x more if it was ran competently.

I&#x27;m not sure what is being verified here. Except that the someone has access to a bluesky handle and a DNS record.<p>And even that is not a guarantee as it needs to be validated by the bluesky team, for which it helps, in their own words – to have connections with them.<p>Otherwise I could buy dozens of domains and spin up bots to churn out AI slop as &quot;validated&quot; accounts. I could buy linustorvalds.com for 25k and impersonate him.<p>It&#x27;s still a two-tier system for clout-chasers. If you&#x27;re cool enough, you get a &quot;Officially Cool™&quot; badge from the bsky team. If you&#x27;re not, hope that a 3rd party provider decides to give you one. Or you&#x27;re a second-grade netizen.

We had this idea to use a page rank based algorithm to compute a influence score based on the score of the people who follow you.<p>A high score usually indicates a trusted account. Check it out here: <a href="https:&#x2F;&#x2F;bluefacts.app&#x2F;top" rel="nofollow">https:&#x2F;&#x2F;bluefacts.app&#x2F;top</a>

If you contextualize this as a form of limiting the power and reach of bots, and you avoid going down the rabbit hole of speech and censorship, then this move is actually a very clever way of scaling that out.<p>Trust is always going to be a game of cat and mouse, and this seems like just another move.

&gt; Trust doesn’t come only from the top down [...] So, we’re also enabling trusted verifiers: organizations that can directly issue blue checks.<p>Is this not still a top-down system, just with one level of indirection?<p>Something not-top-down might look more like the web-of-trust model.

For folks interested in a PKI certificate based approach to solving verification problems:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40298552#40298804">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40298552#40298804</a><p>Delegation similar to bluesky&#x27;s &quot;NYT org issues certs to journalist&quot; is also possible and done in a far more versatile manner.<p>If you have a domain and want the ability to issue certs to others, email me...this will just be for experimenting of course :)

I see a lot of resistance against the trusted verifier system and I am curious on why it is any different from CAs

<i>&lt;checks Twitter development timeline&gt;</i> Yep, right on schedule.<p>Fine with this albeit very &#x27;manual&#x27;...but not clear if any other choice. I do really like the domain username scheme and if anything this news just draws more attention to that because there&#x27;s sooo many organizations&#x2F;news outlets etc not taking advantage.

Can a country verify it&#x27;s president?<p>Can a country I don&#x27;t like verify it&#x27;s president that I don&#x27;t like neither?<p>Prime minister? Members of the Senate? All citizens? Their own bot farm?

Can anyone just make their own blue check now?

<i>&quot;yessss FINALLY we have a caste system for professionals who were too stupid to figure out how to use a domain!&quot;</i><p>haha

What’s the value in verification, exactly? Seems like a solution to a problem that doesn’t exist. Do non-idiots really get confused into thinking Jack Dorsey’s account is someone pretending to be Jack Dorsey?<p>Before Twitter did any sort of verification it was not difficult to determine whether an account claiming to be someone was actually that person for anyone who was actually interested.<p>I suspect a lot of people have this delusional fantasy where “verification” is going to shape political discourse in their favor.

It could be perfect to have a basic network of trust as feature.<p>Can&#x27;t be that hard to have this

Given usernames-as-domains, is there a reason to not just piggyback this on the X.509 web of trust?<p>After all, we already have an established and highly-monitored set of sibling &quot;trust roots&quot; — we call them Certificate Authorities.<p>And we already have an identity-validation system coupled onto X.509 FQDN-as-CN (i.e. TLS) certificates — certificate validation levels.<p>BlueSky could just:<p>1. require a domain username for verification;<p>2. require that the domain presents an Organization Validated (OV) cert for verification as a &quot;public individual&quot; (i.e. the kind with a &quot;personal brand&quot; — which usually implies &quot;worth registering as an LLC&quot;);<p>3. require that the domain presents an Extended Validation (EV) cert for verification as a corporation.<p>...and the whole problem of identity validation becomes outsourced, <i>and federated, and decentralized</i>. (Federated because multiple sibling CAs; decentralized because every computer administrator gets to decide for themselves which CAs their machine should trust.)<p>---<p>A rebuttal might be that &quot;EV certs can&#x27;t be used for this, because EV certs are too expensive, take too long to get, and don&#x27;t integrate well with automatic per-subdomain DV cert issuance via ACME.&quot;<p>But (IMHO) that&#x27;s not a problem to be worked around; that&#x27;s a problem to be fixed. Why leave a broken generalized web-of-trust infrastructure sitting there unused?<p>If an online casino can KYC&#x2F;AML you in two minutes with a passport scan and a 3D camera photo, it shouldn&#x27;t be impossible to do for OV+EV validation what we did for DV validation with ACME. (Ideally in such a way that you can do the interactive process once, receiving not a cert, but some kind of collateral; and then, later on, any ACME server should accept that collateral during an interactive domain ownership probe, to upgrade the DV cert it&#x27;s issuing you into an OV&#x2F;EV cert.)<p>---<p>The other neat thing about this approach is that, in a &quot;fat&quot; native BlueSky app (i.e. not just an Electron wrapper), the app wouldn&#x27;t have to trust <i>the BlueSky service</i> to say who&#x27;s verified. The app could TLS-validate each domain username <i>itself</i>, to compute the appropriate badge for that user — just as a web browser does when you visit a website. And it would presumably use <i>your machine&#x27;s</i> OS TLS CA store for that validation, just as (some) browsers do.

Kinda like Lobster.rs<p>Not a good look.

They can justify it however they want to all day long, but we&#x27;ve got enough real-world examples of verification to show that its core use isn&#x27;t about protecting users, but about authorizing acceptable speech on a platform and protecting advertisers.<p>Domain verification was genuinely all the verification needed. This checkmark system is just a copy-paste troublemaker from Twitter, and we <i>all</i> saw how well that turned out whenever a celebrity or billionaire&#x27;s account got hacked to shill grifto schemes. Training users to only look for a symbol just desensitizes them to the complexities of identity and sanctioned speech.