Screenshot of the Tor Project profile on Bluesky showing the username as @2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion.

Bluesky, originally spun off from Twitter to be a decentralised social networking protocol, is based on the AT (or Atmosphere) protocol where users are uniquely defined by decentralised identifiers (DIDs) which are then mapped to domain names. By default, the network gives you a subdomain of bsky.social but users can bring their own domain or some services offer the functionality to match the likes of their itch.io or bandcamp.com URLs for their Bluesky usernames.

This originally was touted as the network's innovative decentralised approach to verification - eg if you trust the website theguardian.com then you can trust the Bluesky user . This was somewhat undermined by the introduction of Bluesky independently and arbitrarily verifying accounts with an infamous blue tick - but nothing says trust quite like the 256-bit encryption of a random-looking 56-character .onion domain used by hidden services on the Tor network.

That's why Bluesky is now offering the option for users to truly verify themselves by setting their username to a .onion domain. One option is to upload a file called atproto containing your DID in a .well-known directory in the root of your hidden service and Bluesky will use a Tor connection from their side to fetch the contents. For normal domains, the easiest option is to add a TXT DNS record with your DID, but since this is not possible with .onion addresses, privacy-conscious users can instead just upload their private key to the Bluesky servers so they can verify their address:

Screenshot of the Change Handle modal from the Bluesky settings showing a .onion domain and the option to upload a private key.

Unsurprisingly, one of the first accounts to adopt this new option, is the official account for the Tor Project previously available at @torproject.org but now available at @2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion - which is much more verifiable and immune to ICANN meddling as a result of a Trump tantrum-initiated takedown.

Since the BBC don't currently run a hidden service, this change won't be relevant to them, but maybe it suggests there's a chance that Bluesky will add support for .eth usernames which could finally tempt the broadcaster to the network with their newly adopted bbc.eth domain.