Holy Hash!

Security is quality under attack. Hard-won lessons in software security, from someone who built the programs and wrote the standards.

18 July

Keep it simple – user names

All right, now after the lengthy discussion on user names and ids let’s have some simple rules:

  1. Do not use sequential numbers for user ids.
  2. Do use random numbers for user ids.
  3. Do not use any scheme for user names that ties (semi-)public user information to the user name.
  4. Use user nicknames (aliases) if “natural” user names are not sufficiently unpredictable.
  5. Allow users to change user names.

The last point was not mentioned previously but it is quite logical, isn’t it? The system identifies the user by a fixed random user id. But the user identifies itself to the system by a nickname that can be changed once the user is logged in and his id is known.