Timeline for How bad is exposing valid user names?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 27, 2016 at 11:25 | comment | added | Blacklight Shining | @PhilLello Making me wait for snailmail to get my username and not letting me pick my own username would both greatly annoy me as a user. Besides, snailmail is hardly secure. | |
| Mar 23, 2016 at 15:29 | comment | added | Phil Lello | @BlacklightShining A good use case could be registering for internet banking. I would expect in this case the bank would follow up with snailmail or better to provide the username. | |
| Jan 18, 2016 at 13:01 | comment | added | Cybergibbons | I have seen them, several times. Wish I could recall where. | |
| Jan 17, 2016 at 20:39 | comment | added | Blacklight Shining | @Cybergibbons Ratelimiting registrations and requiring captchas for them are good ideas, but I've never seen a service that validated my email address, and then prompted me to pick a username (just ones that used email addresses as usernames). I wonder why? | |
| Jan 16, 2016 at 10:49 | comment | added | Cybergibbons | If you allow the public to register, require the email address first, and then allow a username to be created after it has been validated. It's all about adding layers of security. | |
| Jan 16, 2016 at 10:48 | comment | added | Cybergibbons | I don't agree with this. Firstly, login and registration have different levels of complexity and frequency of use. Protecting each registration using a captcha or severally rate limiting them is fine, as people will only use them once. Login will be used frequently, and a captcha for each login will generally annoy people. | |
| Jan 16, 2016 at 5:07 | review | First posts | |||
| Jan 16, 2016 at 6:29 | |||||
| Jan 16, 2016 at 4:57 | history | answered | Blacklight Shining | CC BY-SA 3.0 |