»Tags are embedded in HTTP URIs in a well-defined manner so that the tag embedded in an HTTP URI can be mechanically extracted from that URI. Specifically, the last segment of the path portion of the URI (after the final "/" character) contains the tag value.» - http://microformats.org/wiki/rel-tag
There you go. !ostatus doesn't require it, but HTML generated by !gnusocial aims to honour #microformats2 since it's great and makes us part of the !indieweb community.
@herrabre That's exactly the idea of the spec methinks ;) (and even possibly email server configuratiom discovery though that's best solved with SRV records.
Google were, as you probably know, on the webfinger train when it started out. But bailed on it, as with everything else open and good.
webfinger -> profile page -> rel=me works pretty good today à la !indieweb with !GNUsocial at least.
* You assume that [any !OStatus instance] has the responsibility to verify its users.
The fact is that each user has their own responsibility to verify their accounts. Say, for example, that you are you. Then you have a personal website or work account. At this profile, you place a link to your social account (just as with your Twitter account). Noone else can fake that (assuming you're not hacked, but that's a different story).
Furthermore, there's something called !indieweb which makes this verficiation seamless and integrates into browsers etc, where if someone claims to be someone else - so called rel="me" links can be used in a sort of "callback verification" scheme. Fully automated with green checkmarks and whatnot.
All other issues you raise are also issues on the web in general.
@eileenb Then let them have social.cocacola or something and avoid being a subdomain to their corporate network ;) Verification for users is easily done with rel=me and other !indieweb techs (to see whether social.cocacola is actually an official cocacola domain)
Either way I eagerly await the day I can block Justin Bieber, Coca Cola, Nestlé and other brands .)