3 ms·
Why the scheme in case-study 2 can be bad: User 1 registers username "alice". User 2 registers username "alice". User 1 verifies account. User 2 tries to verif
by legulere 12y ago
Why the scheme in case-study 2 can be bad:
User 1 registers username "alice".
User 2 registers username "alice".
User 1 verifies account.
User 2 tries to verify the account. If the programmer didn't forget to check twice if an account name exists there's some error.
This might not happen often, but you still need to write a good error handling for that case.
- TJSomething 12y agoAdd a salt. It doesn't even have to be that large because of the unlikelihood. Alternately, adding IP address as a hashed parameter should distinguish them well.
- legulere 12y agoDo I understand you right, that you should add something to the user-generated usernames? This seems like something that would be rejected by users to me.