I’ve been thinking a lot about how different platforms handle identity, and I’m realizing that many of the problems users run into come from the same underlying issue: most major platforms were built on an older model of identity that assumes everything should be permanent and tied to a single unchangeable account.
I’m not talking only about usernames, but the whole system:
• Reddit accounts that can’t be meaningfully reset • Facebook accounts that can’t be recreated once deleted • Steam accounts tied to old payment methods or old emails • Recovery systems that depend on information people no longer have • Usernames and emails that become permanently locked • Deletion systems that don’t actually delete anything • No way to “start fresh” without losing everything
It feels like the entire landscape is built on assumptions from 10–20 years ago, and users are stuck dealing with the consequences.
So I’m wondering:
• Is there a better model for identity that platforms could adopt? • Should identity be modular instead of monolithic? • Should usernames be changeable or detachable? • Should accounts be more portable or resettable? • Should deletion be more thorough and user‑controlled? • Are federated platforms like Lemmy closer to this future, or do they have their own limitations? • And realistically, do platforms like Reddit, Facebook, or Steam have any path to upgrading their identity systems, or are they locked into their current designs?
I’m not trying to rant — I’m trying to understand the design side of this. If anyone here has insight into how identity is handled on lemmy.ca specifically, or how Lemmy’s architecture approaches these issues, I’d appreciate the perspective.
I think a lot of this will come down to which specific issues someone would want to address. Even if we take away the for-profit / power hungry aspects of old social media platforms, sometimes there are legitimate use cases for having some permeance.
On Lemmy, and the few other interconnected platforms that follow this format, usernames are unique and are the core “identity” of the account. This is important to how the system works, since the content needs to be tied to something. User’s can easily change their email address and display name, but the main username is the core “identity” that stays constant.
Meanwhile, users are also free to make multiple accounts, across multiple instances, if they prefer. Generally, admins (our team included) only care if someone is abusing the multiple accounts to evade bans/blocks, manipulate votes, or harass people, etc.
I personally find that this is a nice balance between user choice and chaos 😄
As for federated platforms:
Better:
- There are very few malicious trackers / algorithms (if any) that use dark patterns to dictate who can / can’t make an account
- Many platforms are implementing ways to move most of the contents from an account to a new account when people want to
- With smaller independent teams, you can get personal attention from a human if you need help with recovering something. This may change over time as platforms grow/scale
Same/Worse:
- Most things on the internet can’t be ‘deleted’ once shared. The federated internet can make this even more obvious because the content is actively shared around to multiple servers. It’s like trying to hide the contents of an email. However, private content CAN be deleted. If an admin or user purges something from an account on Lemmy, that content is pretty much gone for good.
If you want to see what info is visible to whom on Lemmy: https://fedecan.ca/en/guide/lemmy/for-users/privacy-security
If you want to see the Lemmy code: https://github.com/LemmyNet/lemmy
IDK if I would really call this “older”. On a traditional forum, many of these restrictions wouldn’t apply (do keep your email safe, though).
The modern model that commercial platforms want is tying everything to government ID. No resetting that.
Why would tech companies whose business model is selling targeted advertising give up the most common data point?
The other option is like 4chan, no usernames every post has a password so you can delete it later.
