I was looking at Twitter login system and saw this error message when trying to enter a username

Your username can only contain letters, numbers and '_'.

Twitter offer the possibility to login either by email, phone or username. So when you fill out the login form you can either input {email, password} or {username, password} for example.

I'm guessing that this error message is there to stop a user from choosing an email address as a username.

Would it be a problem if the username was an email address too?

Tip : What happens when someone use an address email they do not own as their username and then the legitimate user of this email try to create an account...

EDIT : I believe that this goes much further than simply user experience and can be abuse as an anti-competitive practice by malicious companies. See my answer below for details.

EDIT2 : Here is an example. You create an account with the following setting :

  • username : billgates@microsoft.com
  • email : my-email@gmail.com
  • password : strongpassword

You then receive a confirmation message only for my-email@gmail.com, which you own, and you have effectively block Bill Gates from using his address billgates@microsoft.com to create an account on the website.

Repeat that process 1000s of time and you will block plenty of users from using their favorite address. Users which might decide to don't use your service because of a poor experience and the company would lose a lot of money.

closed as off-topic by Dmitry Grigoryev, Mark Buffalo, Anti-weakpasswords, Matthew, Stephane Feb 17 '16 at 8:54

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Is there any basis to "guessing that this error message is there to stop a user from choosing an email address as a username"? – Matthew Feb 9 '16 at 21:11
  • @Matthew It's frequent enough that user will receive email about account they did not created that twitter created an help page for this. support.twitter.com/articles/110202?lang=en# Now I'm wondering if we could set an email as a username how they would handle this. Currently, they are sending confirmation email when you chose your email but not when your chose a username. – Gudradain Feb 9 '16 at 21:19
  • That would appear to be a user experience decision - they want people to be able to sign up and start using the service without waiting for verification, possibly as a result of mobile accounts (which they started off with). It would be entirely possible to verify email addresses without any changes to the usernames. However, if they did use email addresses as usernames, think about the number of email addresses that would be published on Twitter pages... – Matthew Feb 9 '16 at 21:23
  • 7
    I'm voting to close this question as off-topic because this seems to be a user experience question and not a security question. – Neil Smithline Feb 9 '16 at 23:21
  • @NeilSmithline You seem to underestimate the consequence of the problem. If you allow an address email as a username you could deny service to a company for a ton of users. For example, 2 companies provide a similar service. Company A doesn't want its users to switch to Company B. So, Company A, for every user they have, will create an account on company B using the email of their client as a username, Then when a user of A try to create an account for B, he will receive a message telling him that there is already an account even if he didn't created one. – Gudradain Feb 10 '16 at 14:15

There is slightly more reason to restrict the characters of a username than to restrict the characters of a password. Essentially, the username acts as a record identifier in a login system - you need to make use of the input to find the password hash in your login system. With prepared database statements, this isn't really an issue, but lots of systems don't use prepared statements - hence the sheer number of SQL injection attacks that are still possible.

If you're not using prepared statements, you have two options. First, you can pass through the unmodified input. This is a bad idea - consider a username like ' or 1=1 -- - it's valid, in theory, but if your login system uses a line like select * from users where username=$username and password=hash($password), you've just made an SQL injection point. This is more common than would be hoped.

Alternatively you can sanitise consistently across your application. If you pick this, you need to ensure that every possible way to log in (website, mobile application, API) uses the same sanitise process. You could (and this is a bad example - do not use in production) URL encode all characters in the username, so the same username would be stored as %27+or+1%3D1+--. This is slightly better than above, but might lead to unexpected issues if there are any problems with your sanitisation process. Can even hash them if you like, but then it gets very difficult to link reports from users with their records.

You also tend to print usernames within the application at various points. If you allowed any characters, you'd open your application to XSS vulnerabilities. This isn't avoided unless you output encode properly, but then you have the issue that what shows in the application might not actually work for logging in.

In terms of an email address as a username, in theory it's fine. But email addresses are perfectly capable of including pretty much all of the above issues too!

  • SQL Injection and XSS are a given but I'm interested in "stealing identity" too. For example, one benefit of requiring email verification on account creation is that someone cannot register your email address. Without verification of some sort, someone could create an account with your email and then when you decide to create an account you will receive an error message stating "this email is already taken". – Gudradain Feb 9 '16 at 21:04
  • Well, no, not unless the application knows that the username is also the email address. I could own matthew@example.com, and use the username matthew. You could have the username matthew@example.com and the email address user@example.com - no problem. Different fields. If you specifically use email addresses as usernames, that's different, but that has nothing to do with what characters are in the username. – Matthew Feb 9 '16 at 21:08
  • 1
    We're definitely missing a Bobby Tables XKCD here... – Deer Hunter Feb 9 '16 at 21:56
  • Your answer seems to rely on the fact that Twitter doesn't correctly handle SQLi or XSS. I strongly suspect that is a false statement as they handle random input in so many places besides username. – Neil Smithline Feb 9 '16 at 23:15
  • @NeilSmithline It doesn't reference Twitter at all. It answers the question on bold, in a generic case. – Matthew Feb 10 '16 at 6:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.