5 ms·

The article looks great and makes many good points, but I'll pick on one: why disallow upper case letters from usernames?

singold 11y ago
Probably to avoid that if i have the singold user,someone takes the Singold user to impersonate me, just my guess
ams6110 11y ago
Email addresses and domain names are case-ignoring so you should never allow usernames that differ only in case. Allowing only lower case is an easy way to do this.
- chrismorgan 11y ago
  The username part of an email address can actually be case sensitive, and this has been known to cause problems with some systems (e.g. https://airmail.tenderapp.com/help/discussions/287/113-case-sensitive-email-addresses-being-sent-out-as-all-lowercase https://airmail.tenderapp.com/help/discussions/287/113-case-...).
  - protomyth 11y ago
    Yes, and its a pain in the butt error to track down. I was helping a friend with an old postfix / cyrus server with some custom software and case sensitivity was the final cause of bad mail delivery. Gotta love the combo of a bad config and an old mainframe app sending in all uppercase.
  - nitrogen 11y ago
    So instead of converting to lowercase, store them with case preserved but do a case insensitive uniqueness check (and probably allow any case for login).
    - protomyth 11y ago
      or just force all lowercase and keep the support burden lower and save yourself a ton of trouble when dealing with foreign systems. Add a rule on incoming e-mail to convert all addresses for the local domain to lowercase to complete the package.
      - nitrogen 11y ago
        It probably depends on whether we're talking about making your own users, like the original link, or allowing users to interface with other systems, like entering an email address.
    - edgarbob 11y ago
      Yes, this seems to be the right behavior for case-insensitive things like DNS names as well. If a user inputs one, preserve the case when you store it, but do case-insensitive comparisons.
- gpvos 11y ago
  The local part of an email address is not required to be case-insensitive, except for the Postmaster address. RFC 822: "The domain-dependent string is uninterpreted, except by the final sub-domain; the rest of the mail service merely transmits it as a literal string." However, there are too many services smashing the case of the local part to either lower or upper case that case-sensitive names have become nigh impossible to use.

singold 11y ago

Probably to avoid that if i have the singold user,someone takes the Singold user to impersonate me, just my guess

ams6110 11y ago

Email addresses and domain names are case-ignoring so you should never allow usernames that differ only in case. Allowing only lower case is an easy way to do this.

chrismorgan 11y ago
The username part of an email address can actually be case sensitive, and this has been known to cause problems with some systems (e.g. https://airmail.tenderapp.com/help/discussions/287/113-case-sensitive-email-addresses-being-sent-out-as-all-lowercase https://airmail.tenderapp.com/help/discussions/287/113-case-...).
- protomyth 11y ago
  Yes, and its a pain in the butt error to track down. I was helping a friend with an old postfix / cyrus server with some custom software and case sensitivity was the final cause of bad mail delivery. Gotta love the combo of a bad config and an old mainframe app sending in all uppercase.
- nitrogen 11y ago
  So instead of converting to lowercase, store them with case preserved but do a case insensitive uniqueness check (and probably allow any case for login).
  - protomyth 11y ago
    or just force all lowercase and keep the support burden lower and save yourself a ton of trouble when dealing with foreign systems. Add a rule on incoming e-mail to convert all addresses for the local domain to lowercase to complete the package.
    - nitrogen 11y ago
      It probably depends on whether we're talking about making your own users, like the original link, or allowing users to interface with other systems, like entering an email address.
  - edgarbob 11y ago
    Yes, this seems to be the right behavior for case-insensitive things like DNS names as well. If a user inputs one, preserve the case when you store it, but do case-insensitive comparisons.
gpvos 11y ago
The local part of an email address is not required to be case-insensitive, except for the Postmaster address. RFC 822: "The domain-dependent string is uninterpreted, except by the final sub-domain; the rest of the mail service merely transmits it as a literal string." However, there are too many services smashing the case of the local part to either lower or upper case that case-sensitive names have become nigh impossible to use.