That's why instance is part of the username. It's no different than email addresses.

Yes, for sure. While the identity of a user can be checked, nobody is going to do this every time. IMO the simplest solution would be to just always show the instance even if a display name is set.

Some other projects in the fediverse have a verification mechanism in place.

I personally like Mastodon's: if you add on your profile a link to a webpage that itself links to your profile, Mastodon will show a green checkmark next to the link: https://joinmastodon.org/verification

So you can verify your profile by linking to a webpage you own or testifies your account's authenticity (ie. your blog, your author page of the publication your write for, etc.)

It's a bit of a problem, indeed. Here's a practical example of that:

In this example, I'm writing from a lemmy.ml account, but the display name impersonates another account in another instance (beehaw.org). Anyone could do this with someone else's account.

Based on that, I think that:

• the Lemmy software should not allow you to use "@" as part of your display name. Ever. Reserve it as a special character.
• clients should always show which instance you're from, even with a display name. A simple icon would be enough as long as instance admins set up uniquely identifiable ones.
• two accounts in the same instance should never be allowed to use the same display name.

And for us, users: never rely on the display name. If the identity of someone is contextually relevant, always check the actual username, not the display name.

To me, this just seems like a variation of the age-old issue of online impersonation. In the early days of social media, there were people squatting on famous people's name/registering variations.

On my instance, admins are tagged as such which seems like a good solution. I wouldn't be surprised if we start seeing verification like on Mastodon, though I couldn't find any issues for this on their github.

This was discussed deeply a few days back.