News for hackers. Stuff that matters.

A comment on Let’s talk about usernames. Parent comment

Re:Let’s talk about usernames by henrikschroder on Monday February 12, 2018 @12:16AM (#16356707)
> Here is a great example of where it is completely insane: Facebook. There is absolutely no good reason for that website to have usernames for regular users, and they frankly shouldn't have usernames for businesses either.

Uh, Facebook doesn't have usernames, and haven't had usernames for as long as I've been able to be a member.

There's an option to grab a unique identifier for your personal page, so that you become https://www.facebook.com/identifier, but it's completely optional, it's just a vanity thing.

Same for groups, they can grab a unique identifier, or stick to their auto-generated id.

Same for businesses.

[ Parent | on HN ]
Re:Let’s talk about usernames by kiwijamo on Monday February 12, 2018 @01:13AM (#16356893)
In Facebook I can go to Settings > General to find an option to create a username. Been like this for as long as I can remember.
[ Parent | on HN ]
Re:Let’s talk about usernames by henrikschroder on Monday February 12, 2018 @02:34AM (#16357146)
Yes, but they're not required, you can't use them to login, and they're not displayed to other users. They're only used to create a nicer URL for the static link to your personal page.

Actual usernames typically do all of the above.

[ Parent | on HN ]
Re:Let’s talk about usernames by csydas on Monday February 12, 2018 @03:12AM (#16357259)
Well, it adds an air of authenticity when everything lines up right as you just the validity of a page. Let's assume for a moment you were the type to look for support on Facebook for your bank, and you looked wherever for "MyBank Facebook".

First two results are:

facebook.com/mybank

facbeook.com/mm48283df884

Which is the "real one" based just off this information? How do you know that when you message one of them you're getting the actual bank and not a fraudster?

It's not just vanity, people do check these things, not all of them savvy enough to continue researching. Just peek at "safe browsing tips" you'll see from tech rags online and it's pretty clear we do a poor job of educating people about proper vetting online, so you get people instilled with dogmatic understandings of security. ("The URL clearly says Mybank, so it's the real one." "Google actively removes fraudulent websites from the top hit, so it must be the real one", etc)

It sucks, but it is important to try to control for such errors.

[ Parent | on HN ]
Re:Let’s talk about usernames by bringtheaction on Monday February 12, 2018 @03:39AM (#16357363)
> they're not displayed to other users

They are shown in the address bar of your profile page once set.

[ Parent | on HN ]
Re:Let’s talk about usernames by gsa on Monday February 12, 2018 @03:26AM (#16357310)
> you can't use them to login

Incorrect, I can use my username in the email field and log in.

[ Parent | on HN ]
Re:Let’s talk about usernames by ascorbic on Monday February 12, 2018 @01:59AM (#16357034)
Around 2009/2010. I actually set my alarm for the time they opened them up, which was the middle of the night for me. My wife managed to get her first name as her username. Worth it for 10 minutes of interrupted sleep!
[ Parent | on HN ]