Just a random thought experiment. Let’s say I have my account on a lemmy instance: userA@mylemmy.com. One day I decide to stop paying for the domain and move to userA@mynewlemmy.com, and someone else gains it and also starts up a lemmy instance.

If they make their own userA@mylemmy.com, how do federated instances distinguish who’s who?

Have I misunderstood the role of domain names in this?

  • 𝘋𝘪𝘳𝘬@lemmy.mlEnglish
    1·
    1 year ago

    That is a vulnerability, albeit a small one.

    “Small one” is very wrong here. This is by far the largest gaping security hole in the whole specification.