Timeline for Is it good or bad practice to allow a user to change their username?
Current License: CC BY-SA 3.0
4 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Jan 2, 2018 at 21:04 | comment | added | Kat | Don't you have to check for duplicates when the account is created, period? You can reduce user enumeration (if that's even a worry) with forced delays, but there's a reason most sites treat usernames as public information. I'm not sure I understand how it's easier to do social engineering attacks if you can change usernames. I assume you're thinking of people taking someone's old name? That should be entirely preventable, though, by treating that name as taken (can be either an alias or treated like a deleted account). | |
Dec 20, 2017 at 18:45 | comment | added | Dan Landberg | It was just an example. The point I was trying to make is that the more complex your processes/code are, the more likely you are to make mistakes. It could just as easily be a SQL injection vulnerability in the duplicate check, or a target for CSRF, or any other bug. | |
Dec 19, 2017 at 21:47 | comment | added | ste-fu | Curious how enumeration is a problem if it is a user chosen username as opposed to an email address. Guess users choosing to use their email addresses could count... | |
Dec 19, 2017 at 21:35 | history | answered | Dan Landberg | CC BY-SA 3.0 |