Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Creative usernames and Spotify account hijacking

labs.spotify.com

Post reply on HN
Print view View original

1–10 of 83 posts

Re: Creative usernames and Spotify account hijacking

#2

Post by johnvschmitt »

This seems odd. I mean, if their code was properly modular, they would have just one place where they "fetchUserIdByName(userName)", which returns one user ID or null if it's not used yet.

When a new user is created, it then gets assigned a unique user ID. The email address is assigned to that user ID.

Then, if they do a password reset on user = "bigbird", it should do the exact same lookup to find the email address.

The security bug was not really about having an improper function to do unicode translation. It was more about having different functions for the same check, simply because they were in different parts of the code.

Modular code is just so much better on all fronts, including security.

Re: Creative usernames and Spotify account hijacking

#3

Post by Jhsto »

I'd like to point out that even though not every website accepts unicode characters on registration, some software such as vBulletin let the administrator/user to replace the username with such characters once the user is signed up.

You may not create as much havoc as in the original post, but some level of confusion at least.

Re: Creative usernames and Spotify account hijacking

#7

Post by dan_manges »

pilsetnieks wrote: post #4

I'm confused about why they even had the need for canonicalising the usernames for whatever purpose? Why couldn't they just have stored and used them just as they are?

They gave one reason in the post. They wanted usernames to be case insensitive, so that if there's a user named BigBird, somebody else can't sign up as bigbird. Case insensitive usernames are also helpful to minimize support issues when somebody forgets the exact case they used when they created their account.

Re: Creative usernames and Spotify account hijacking

#8

Post by eli »

johnvschmitt wrote: post #2

This seems odd. I mean, if their code was properly modular , they would have just one place where they "fetchUserIdByName(userName)", which returns one user ID or null if it's not used yet. When a new user is created, it then gets assigned a unique user ID. The email address is assigned to that user ID. Then, if they do a password reset on user = "bigbird", it should do the exact same lookup to find the email address…

Easy to implement in a small project. Not so easy in a large enterprise project likely comprised of multiple interconnected systems.

Re: Creative usernames and Spotify account hijacking

#9

Post by yathern »

pilsetnieks wrote: post #4

I'm confused about why they even had the need for canonicalising the usernames for whatever purpose? Why couldn't they just have stored and used them just as they are?

Because, then there can be multiple accounts that are variations of BigBird, and all annoying to differentiate for users. Such as Bigbird bigBird BigBIrd. Combind with this, the fact that you have unicode characters, and it makes it very easy to 'spoof' as another user by simply changing the letter 'o', to a unicode circle, or various other tricks.
Post reply on HN