4

It has just dawned on me, that a system I am developing exposes a users username in the URI. This is a problem, since some of the users pages are public. Therefore people will know their username.

I thought that this would be a security issue, but then realised that big names like twitter do the same thing. Pretty much every single twitter user has their username on full display.

If a big name like twitter see it as safe, should I also assume the same?

  • The only true problem this might cause is if you didn't want people looking over your shoulder to know what username you use. That still won't grant them access, but sometimes you don't want to be associated with your account just the same. – Neil Mar 6 '13 at 17:07
6

Pretty much every website I know does the same.

Account security relies on password, not the user name. This password should be kept secret and secure.

  • If it is, it doesn't matter who knows the user names.

  • If it doesn't, deal with it, because it's the primary issue: hiding user names won't help.


Note that relying on the fact that the web application doesn't display the user name is problematic for a few more reasons:

  • If the database is hacked, the hacker has the names of every user. While you can (and should) avoid storing users' passwords anywhere on the servers, you may not be able to do the same with user names. For example, storing only the hash of the e-mail makes it impossible to contact the person later by e-mail.

  • With a bit of social engineering, it's easy to determine what is the user name or the e-mail address which is used to access the web application. Let's take an example. You want to know what do I use to log in to Stack Exchange. From my profile, you get my real name. A quick Google search for it reveals my Google+ profile with my personal e-mail address, as well as my full profile on the website of my company as the first search result, this second profile containing my business e-mail address. This gives you two potential addresses.

    From Gravatar, you learn that the MD5 hash of my e-mail address is

    0f379b115b9090a1df9319f17574fa8b
    

    Surprisingly, two e-mail addresses you've previously found have different hashes:

    97ec33bbad0a2e26f7fcc1feea6447fc
    60597478d2736c4eeb915327474e8fab
    

    Let's see what additional information we can get. We can:

    • Either explore my profile on my company's website in order to find a screenshot of Password Manager, an app I developed. This screenshot displays two e-mail addresses: my personal one, already found through Google+, and a new one. A quick MD5 test reveals that it matches.

    • Or look at Google results for my first and last name and notice that they mention lakaidreams.com. A whois search shows not only that I'm the owner of the domain, but also reveals the very same e-mail address.

As you see, if Stack Exchange was relying on the secrecy of my e-mail address to prevent unauthorized access to my account, you couldn't be sure if the person who is typing this answer is really me.

  • is stackexchange the same? I use my email address to login – Gaz_Edge Mar 6 '13 at 17:12
  • @Gaz_Edge The URL includes an ID instead, but still, from the URL of your profile and from a link on my profile, I can guess that the link to edit your profile -- yet I get a 404 there, as SE (like any remotely decent site) applies proper authorization checks. – user7043 Mar 6 '13 at 17:21
  • @Gaz_Edge: I would think this would only be an issue on your system if the username is an email address AND you're exposing it through the URI. Many use their email address to log in to StackExchange, but all the user profile pages use the user ID / display name (lowercase and spaces converted to hyphens), so I'm not worried about my email address being exposed on this site. You should do something similar in your system. – Aaron Blenkush Mar 6 '13 at 17:30
  • An email address makes a good username because you guarantee you have a way to contact the user for whatever reason (including password resets.) It's not good to show a user's email on a page because of spamming issues. This makes having a separate email-as-username and display name system attractive. Facebook is an obvious example. Playstation Network and XBox Live (though not websites) also both do this. – Gort the Robot Mar 6 '13 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.