Live data from Hacker News

Creative usernames and Spotify account hijacking

labs.spotify.com

81–83 of 83 posts

Re: Creative usernames and Spotify account hijacking

#81

Earlier quoted context omitted.

Not necessarily. It their canonicalization function were idempotent (e.g., the identity), then this database scheme would work well. How else do you map username to user id?

Well generally it makes sense to use that userid as a primary key everywhere rather than the username. You only need the mapping of username to userid in one place. Their current scheme also makes it sound hard to change your username.

Ah I fully agree. I misunderstood your post to say you should never use a user name as a key.

Re: Creative usernames and Spotify account hijacking

#82
post #78

> it is probably good to... treat “BigBird” and “bigbird” as the same username. Erm...

How about "building" and "buiIding"? or "nodata" and "nodata"? You probably don't want people running around claiming to be admins because their name looks the same.

Similarly, do you really want to do tech support when someone forgets that their username is "nodata" instead of "Nodata", since their phone auto-capitalized things when they signed up? It happens. And how do you know they're "Nodata" and not "nOdata" or "nOdAtA"?

Post reply on HN