I temporarily changed my handle to one which I know used to belong to someone else, which seems like it should not be possible

[venteto]

There is another user on Bluesky whose current handle is their personal domain name. I searched on a third-party lookup site for their ID and noticed they used to have a different handle using the basic .bsky.social domain.

On a test account, I temporarily switched my handle to their old handle, hoping this would not work, but it did.

Allowing this seems to invite impersonation. I think this is why some other sites retire previously used handles forever, once the originator account iis suspended or cancelled by the user.

I think the account which originated a handle should be able to switch back to it (for example, if they no longer wish to pay for their own personal domain name), but no user user should be allowed to use a previous handle of another user.

Moreover, on Bluesky specifically, on a user's profile, or at least on another page linked to from their profile, I think there should be a list of all their previous handles, along with their account ID, so that the public can see both bits of data.

[snarfed]

Agreed! This has been discussed a number of times before, eg #1704 . I think the team agreed and expects to eventually add a cooling off period before anyone else can register the original handle.

[bnewbold]

Yeah, we really need to improve this, it is a long-standing known problem. Federation may change the social dynamic (there are endless "suffix" domains that the same "prefix" name can be registered under, which may reduce attention/anxiety/authority of any one "suffix" like *.bsky.social), but we should still improve the situation.

I think the current plan is to let accounts hosted on the Bluesky PDS retain a single *.bsky.social domain when they enable a custom domain handle. Basically each account would get one name in the namespace regardless of what their current handle is.

I'm not sure if we will also implement a "cool down" period after changing handles within the *.bsky.social namespace. It will be up to each hosting service to come up with their own policies around that sort of thing. Other platforms and hosting services have differing policies for namespace management.

For did:plc identifiers, it is possible to query the plc.directory and get a reliable record of handle history. For did:web, there is no such historical record, though I suppose somebody could start archiving DID documents in to web.archive.org.