Report: "If my secretary logs with our account, it works. If I do, the website logs in but then later shows me errors message when I try to submit a report".[0] Entirely repeatable. Screenshots sent showing it exactly. All of us scratching our heads. How could our web server know who was sitting in front of the keyboard?
Root cause: the username was a number with a leading zero. The login didn't care if you used zeros or not, but the internal logic did care. She logged in with them, he logged in without them (or was it the other way around?). Once logged in, the username was taken from a cookie or something that had been set at login time and fed into the internal logic, which barfed.
Lessons learned: either don't have forgiving logins, or have forgiving functionality when users use inconsistent logins.
[0]They were indeed sharing an account with the same username and password. It was 2005 and government website, so this made sense.
But yes, I do agree with the general sentiment of "communicate via something internal, not something user-supplied".
At some point it became clear that they ignored leading zeroes during login on their end, but still included those leading zeroes when they sent it over to us, so we had a number of duplicate accounts. I purged the duplicate accounts (delete the newest, strip the leading 0s off the oldest) at the same time that they changed their code to send over the truncated number. All went perfectly, except apparently a few spouses were upset that they could no longer use their secondary account.
This was back during the DOS days, and i suspect it was only discovered when she complained that it would no longer start in the morning.
It may well be that said joker had the best of intentions by sorting the keys in the numerical order...
I heard a story about a terminal in a public terminal room that a user was able to consistently log in to if they were sitting down in a chair in front if the terminal, but never if they were standing up.
They thought it might be static electricity, or some mechanical problem, or "problem exists between keyboard and chair", but finally they noticed something else was amiss...
It turns out some joker had re-arranged the 1234567890 keys to be 0123456789, so when the user was standing up, they looked down at the keyboard and typed their password (which contained a digit, of course) by looking at the keys.
But when they were sitting down, they touch typed without looking at the keys, and got their password correct!
[1] https://news.ycombinator.com/item?id=11717010