2

There are some usernames that shouldn't be allowed to register on online services, for example:

administrator, admin, root, system, owner, hostmaster, webmaster, sitename or sitenameadmin

As far as I know, those shouldn't be allowed because they might cause a security risk, due to users registering those usernames might be able to impersonate a website official, and some users might be fooled by this.

http://example.com/administrator
[email protected]

Where can I find a list of all those usernames that shouldn't be allowed to register by anonymous users?

Improve this question
3
  • This would be bad practice to have a static (admin) account encoded in the application, but not already used/created so that it may be used by the first non-admin user. Either don't have such accounts or create those accounts at bootstrap phase. Then you can let your database handle those cases by setting a unique/primary key column or something like that. If you don't have such static accounts, then what is the harm in letting users register with those usernames or email addresses?
    – Artjom B.
    Commented Aug 17, 2014 at 0:19
  • @ArtjomB. the reason is posted in my question, some users, if they received a message from [email protected] they might be fooled into thinking it is a real administrator at that website, .. , specially users that are not cautious. .. and regardless of the method of blocking future users to register, I am only looking for this list in my question, .. adding them to database as pre-set users is not a bad option.
    – sharp12345
    Commented Aug 17, 2014 at 0:30
  • 1
    Given that it's fairly easy to forge email From address, you always need to be careful when receiving emails from unknown senders, whether or not it has official titles in name that they introduced themselves as. You need to identify admins by special symbols or statuses, for example on stack exchange community moderators are given the diamond symbol. Then you only need to prohibit the diamonds symbol from being used by regular username and teach your users how to identify admins correctly rather than relying on name itself.
    – Lie Ryan
    Commented Aug 17, 2014 at 0:48

3 Answers 3

Reset to default
6

This is really the wrong solution to the problem: trying to prohibit "administrator"-like names will become a constant game of whack-a-mole with increasingly creative impersonators.

A blacklist of official-sounding names can be a starting point, but you should also provide an easy way to positively identify admins, such as a unique naming pattern (only admins can register a username ending in "(admin)"), or displaying their names or messages in a unique color.

Improve this answer
1

You can start with a bad words list, such as:

http://www.noswearing.com/dictionary

then tack on any other strings you feel are unsafe or undesirable user names.

I suggest you use substring matching, otherwise it's very easy for users to manipulate the results, such as registering account "Administrator01" instead of "Administrator".

If you want to be extremely thorough, you could also use a spell check to score how close the user name is to any of the bad words. That way, you can catch even mispelt attempts like "Administater".

Improve this answer
1

Here is a list of reserved usernames

Improve this answer
1
  • First link is broken.
    – Goose
    Commented Nov 3, 2017 at 13:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .