This is how the new Loops app Notifications screen looks like.

[dansup@mastodon.social]

This is how the new Loops app Notifications screen looks like.

Notice the lack of webfinger addresses, and the instant action buttons like Reply and Like?

All of these notifications are from remote accounts, but we hide the complexity of federation and only show the relevant details.

Pretty cool eh?

#loops #tiktok #activityPub #loopsDev

[manum@masto.es]

@dansup I'm not sure if hiding the instance is a good idea. I mean, in the fediverse our usernames are both the handle and the instance, and if we start losing the notion of instance…

[dansup@mastodon.social]

@manum we actually never show the full username unless you view the account, we use the display name, like TikTok

[rra@post.lurk.org]

@dansup @manum It does not seem that the TikTok design carries well to a federated situation. You can use a display name to trivially impersonate someone else. User names+instance are used to verify an account.

"BBC News liked your post"

"BBC News (troll@randominstance) liked your post. "

"BBC News (news@bbc.co.uk) liked your post"

[dansup@mastodon.social]

@rra @manum Yeah thats correct, but even including a domain won't prevent abuse by someone using a domain that is similar to an official entity.

You assume that everyone will be able to determine authenticity by the domain, but most people don't keep a mental list of official domains.

[rra@post.lurk.org]

@dansup @manum No it is not a water proof approach. But there is a lot of space between not offering the tools to understand and people not understanding the tools offered.

[dansup@mastodon.social]

@rra @manum That's a great point, I will add a (default) setting to show the full webfinger address across our app (and later the webUI).

I appreciate your feedback and helping me understand why I need to make this change.

[dansup@mastodon.social]

@rra @manum I just created an issue to track this!

Use webfinger/username instead of display name by default · Issue #1 · joinloops/loops-expo

After sharing an update about notifications, it was brought to my attention that we should use webfinger/username references instead of display names to prevent impersonation. We should add a new setting that defaults to webfinger/userna...

GitHub (github.com)