Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. It only takes a minute to sign up.
Sign up to join this community
It has just dawned on me, that a system I am developing exposes a users username in the URI. This is a problem, since some of the users pages are public. Therefore people will know their username.
I thought that this would be a security issue, but then realised that big names like twitter do the same thing. Pretty much every single twitter user has their username on full display.
If a big name like twitter see it as safe, should I also assume the same?
Pretty much every website I know does the same.
Account security relies on password, not the user name. This password should be kept secret and secure.
If it is, it doesn't matter who knows the user names.
If it doesn't, deal with it, because it's the primary issue: hiding user names won't help.
Note that relying on the fact that the web application doesn't display the user name is problematic for a few more reasons:
If the database is hacked, the hacker has the names of every user. While you can (and should) avoid storing users' passwords anywhere on the servers, you may not be able to do the same with user names. For example, storing only the hash of the e-mail makes it impossible to contact the person later by e-mail.
With a bit of social engineering, it's easy to determine what is the user name or the e-mail address which is used to access the web application. Let's take an example. You want to know what do I use to log in to Stack Exchange. From my profile, you get my real name. A quick Google search for it reveals my Google+ profile with my personal e-mail address, as well as my full profile on the website of my company as the first search result, this second profile containing my business e-mail address. This gives you two potential addresses.
From Gravatar, you learn that the MD5 hash of my e-mail address is
0f379b115b9090a1df9319f17574fa8b
Surprisingly, two e-mail addresses you've previously found have different hashes:
97ec33bbad0a2e26f7fcc1feea6447fc
60597478d2736c4eeb915327474e8fab
Let's see what additional information we can get. We can:
Either explore my profile on my company's website in order to find a screenshot of Password Manager, an app I developed. This screenshot displays two e-mail addresses: my personal one, already found through Google+, and a new one. A quick MD5 test reveals that it matches.
Or look at Google results for my first and last name and notice that they mention lakaidreams.com. A whois search shows not only that I'm the owner of the domain, but also reveals the very same e-mail address.
As you see, if Stack Exchange was relying on the secrecy of my e-mail address to prevent unauthorized access to my account, you couldn't be sure if the person who is typing this answer is really me.
