Reply New Topic
2011/1/9 5:33:57
#1
Offline
Home away from home

Re: ERROR: Invalid Username - Is it?

my experience on Tim's site when i tried registering was that it wasn't clearly defined as to what the problem exactly was.

i couldn't register, and didn't know why. but the term invalid username just doesn't give enough detail, that and it is very confusing because we DON't have a username on any registration form.

we have Display Name & Login Name. but the error says invalid Username! so which of those was invalid? psychic head on.

it turned out it was the display name that was invalid & not the login name.

now i know that can easily be sorted by changed the Language definition, shouldn't be a problem then.

then there's the issue of external scripts, i couldn't login to a site, because the site was using uname, which is actually displayname, so i had to login using displayname and not login name. very confusing.

now onto my opinions regarding this matter, and some may disagree with what i'm about to say.

I think having Login Name & Display name is completely unneccessary, i was against it then, and i'm afraid, it hasn't changed my opinion since. i honestly can't see where the extra benefits of having them are in terms of security.

Brute force??? hmmm yeah, an unknown login name prevents it. but as far as i can tell, that is the ONLY reason for it.

silently locking the account after 3 or 5 failed attempts (either with a timer that can be set in admin, or via email asking the owner to confirm via clicking a link in the email to unlock is FAR Superior method at stopping brute force.)

my proposal to this argument.

1. ICMS users can actually log in to the system using their email address!!! <do people know this???>

2. get rid of the login name completely, just have display name for display purposes!

3. users would then use their email address/open id to login to their sites with, this can already be done anyway, so no coding changes are required on that part!.

4. create a function where after x failed attempts, the account is locked (either silently or with a notice) for either x amount of time or via an email sent to the users account which they have to confirm to unlock the account, or via admin unlocking it for them)

5. Problem Solved!

_________________
Live as if you were to die tomorrow, Learn as if you were to live forever

The beauty of a living thing is not the atoms that go into it, but the way those atoms are put together!

Subject Poster Date
     ERROR: Invalid Username - Is it? Tom 2010/12/21 16:21:18
       Re: ERROR: Invalid Username - Is it? Vaughan 2010/12/21 16:40:13
         Re: ERROR: Invalid Username - Is it? Madfish 2010/12/22 4:35:29
       Re: ERROR: Invalid Username - Is it? Tom 2011/1/8 17:59:19
         Re: ERROR: Invalid Username - Is it? skenow 2011/1/8 20:40:11
           Re: ERROR: Invalid Username - Is it? Vaughan 2011/1/9 5:33:57
             Re: ERROR: Invalid Username - Is it? david 2011/1/9 6:27:32
               Re: ERROR: Invalid Username - Is it? Vaughan 2011/1/9 6:41:36
Reply New Topic extras
 Previous Topic   Next Topic
You can view topic.
You can start a new topic.
You can reply to posts.
You cannot edit your posts.
You cannot delete your posts.
You cannot add new polls.
You cannot vote in polls.
You cannot attach files to posts.
You can post without approval.