Bluesky Launches Privacy-First ‘Find Friends’ Feature

Bluesky is rolling out a new “Find Friends” feature designed to help users locate acquaintances on the platform without resorting to the intrusive tactics common in social networking. The update, announced on Wednesday, prioritizes data security by requiring mutual opt-in from both parties before any connections are suggested.

The company explicitly moved away from traditional contact-import methods, which have historically been used to scrape data or generate viral growth through automated invite spam. “Contact import has always been the most effective way to find people you know on a social app, but it’s also been poorly implemented or abused by platforms,” Bluesky stated in its official announcement.

How the Security Model Works

To prevent bad actors from exploiting the system to fish for user information, Bluesky has implemented several safeguards:

• SMS Verification: Users must verify their phone number via a six-digit code before they can upload their contacts.
• Hashed Data Storage: Contact information is stored as hashed pairs—combining your number with the contact’s number—to make reverse engineering significantly more difficult.
• Hardware Keys: The encryption for this data is tied to a hardware key stored separately from the main Bluesky database.
• Manual Invitations: The platform will not automatically send text-message invites to your contacts. Any invitation must be a deliberate, manual action initiated by the user.

The company has been transparent about its technical implementation, having previously shared the details with the security community via an RFC (Request for Comments) to gather feedback prior to the launch.

Availability and User Control

The feature is currently being deployed to users across several major markets, including the United States, U.K., Japan, Brazil, Canada, Australia, France, Germany, Italy, the Netherlands, South Korea, Spain, and Sweden.

Bluesky emphasizes that the system relies on mutual presence in address books. If you prefer to keep your professional and personal lives separate, you can simply opt out of the feature. Furthermore, users retain full control over their data, with the ability to delete uploaded contacts and withdraw from the matching service at any time.

While the company acknowledges that contact matching is a common growth strategy, it maintains that its “fundamentally more secure approach” is necessary to avoid the risks of data leaks and spam that have plagued other platforms in the past.