3 ms·

This could also be done with Apps, such as Lattice. If you impersonate you could ask you to reset your password with a link to latticechangepassword.com or some

This could also be done with Apps, such as Lattice. If you impersonate you could ask you to reset your password with a link to latticechangepassword.com or something like that. The solution might be a verified name system, if you change your name of display name, it gets "moderated" by an admin first. In a corporate environment there is no need for people to change their name often, maybe once ever when you either actually change your name or decide to use an alias in real life. This is similar to HN not allowing someone to use the displayname "dang", or if display names were a thing, it gets moderated somehow. Probably good idea to do that on the profile pic too! I'm not sure if there is a cool technical word for this in security jargon, but the "Full Name" "Display Name" and "Profile Photo" are what I'd call "trust-centric fields" and need to be treated differently to say "What I do" or "Phone Number". In a corporation this is easy, someone's job is to vet changes to this. Whoever sets up systems for employees for example. Outside of a corporation it may rely on flagging and moderators.

smoldesu 5y ago
How is your phone number not a trust-centric field?
- quickthrower2 5y ago
  I don’t trust what you say because of your phone number, but I might trust what you say because you have assumed my bosses name. Obviously it is definitely a field that needs to be secure, I.e. I can’t set your phone number.
monkeybutton 5y ago
Slightly off topic but I've run into the opposite extreme with in the corporate world. A few years ago the company I was working at was acquired and we were all eventually migrated over to new systems like Office 365, Teams and Workday. From that day onwards it was like profiles were frozen in time; we couldn't change anything on our own and anything we could get updated through the proper channels would eventually, and inexplicably, be reset to what it was when we migrated. Contact information, who was managing who, job titles, everything. Even our previous CTO, title intact, was stuck reporting to another CTO in the system.

smoldesu 5y ago

How is your phone number not a trust-centric field?

quickthrower2 5y ago
I don’t trust what you say because of your phone number, but I might trust what you say because you have assumed my bosses name. Obviously it is definitely a field that needs to be secure, I.e. I can’t set your phone number.

monkeybutton 5y ago

Slightly off topic but I've run into the opposite extreme with in the corporate world. A few years ago the company I was working at was acquired and we were all eventually migrated over to new systems like Office 365, Teams and Workday. From that day onwards it was like profiles were frozen in time; we couldn't change anything on our own and anything we could get updated through the proper channels would eventually, and inexplicably, be reset to what it was when we migrated. Contact information, who was managing who, job titles, everything. Even our previous CTO, title intact, was stuck reporting to another CTO in the system.