usernames should be case insensitive, right? #503

chadwhitacre · 2013-01-21T13:26:29Z

Sure seems like someone shouldn't be able to create a Whit537 account that's different from whit537. But how does this interact with Unicode? Casing is one kind of spoof attack. How hard are we going to try to protect against spoof attacks? Isn't that just a huge can of worms?

sigmavirus24 · 2013-01-21T13:35:31Z

It isn't. We can probably also borrow the homoglyph detection algorithm from HTTPS Everywhere. They use that to verify (in part) the rulesets for the extension. As per casing, I'm 90% sure that GitHub forces entirely lowercase usernames. I don't know about twitter, or facebook. I'm fairly confident Google does force everything to be lowercase too though.

sigmavirus24 · 2013-01-21T13:38:15Z

A secondary thought, Google allows the following:

Let's say you register an email account with Google, say [email protected]. You will then get emails if they're sent to any of the following email addresses (all @gmail.com): gittipisawesome, gittip.is.awesome, git.tip.is.awesome, g.i.t.is.awe.some, &c until you've exhausted all permutations of the original email address with periods added. This could be a different way of one person signing up with multiple email addresses to do something nefarious after we've added Google authentication. Then again, I'm not sure if OpenID (which is what I assume we will be using) will catch this or not, so it may not be a big concern of ours.

lyndsysimon · 2013-01-22T03:46:12Z

OpenID should catch that with Google - it ties to Google account number, not an email. For instance, my Google ID is 104460120585566250078.

As an aside, Gmail also discards the + character and everything after it. [email protected] routes the same places as [email protected]. I use this to watch for people selling or leaking my personal information.

sigmavirus24 · 2013-01-22T04:06:25Z

Yeah the extensions are fairly widely supported (postfix supports them as
well) and they're damn awesome.

chadwhitacre · 2013-01-29T11:14:12Z

I suppose this would mean adding a participant.id_for_display column, and then canonicalizing id when we try to insert or update it (where, for now, canonicalizing means calling .lowercase).

chadwhitacre · 2013-01-29T11:15:18Z

Hey @joonas @alexcouper: Is this something either of you would be able to look at?

alexcouper · 2013-01-30T15:27:03Z

I'm pretty tied up for a while now TBH @whit537.

In other news, I'm hoping to organise a sprint here with the python group in Reykjavik to work on something opensource. I'll be suggesting we do gittip. Others may have different ideas, but it'd be a nice blitzer. If/when it happens I'll get in touch before hand.

chadwhitacre · 2013-01-30T16:30:13Z

No worries, @alexcouper. Definitely let me know if the sprint comes together around Gittip and I'll try to be online during it.

chadwhitacre · 2013-02-20T04:13:06Z

+1 from Whit537: https://www.gittip.com/Whit537/

These guys trolled our latest hangout:

alexcouper · 2013-02-20T08:59:55Z

Looks like you had some fun there... curses the internet

johana-star · 2013-03-21T15:33:44Z

1-up, user names should not be case sensitive. I don't know the code base well enough to make a pull request, but I think when someone goes to either /strand or /Strand they should go to my account. This should be resolvable by routing to a lower case name if we have a display_id/display_name column added to the db.

dmitshur · 2013-03-31T17:58:23Z

I agree that usernames should be case insensitive, as in https://www.gittip.com/whit537/ and https://www.gittip.com/Whit537/ should take you to the same page. It makes the URL design better. And it just makes more sense in the long run (and you can always reverse this decision more easily if there's ever a pressing need).

We need live search to populate the list of people who deserve the money for Gittip, but we need lower-cased usernames (#503) to properly implement search.

chadwhitacre · 2013-04-10T22:01:49Z

identify and clean up existing conflicts (first come, first served; rename somehow)
add username_lowercased column, populate it
add a rule to set username_lowercased when a new row is inserted
add a rule to update username_lowercased when username changes
write a test to verify that this is enough to catch conflicts in username changes

chadwhitacre · 2013-04-10T22:18:23Z

We've got 11 username casing conflicts.

chadwhitacre · 2013-04-10T22:59:10Z

select username_lower, count(username_lower) into temp counts from participants group by username_lower;
select username, username_lower from participants where username_lower in (select username_lower from counts where count > 1) order by username_lower;

chadwhitacre · 2013-04-10T23:04:58Z

Rather than attempting to merge accounts for people, I think we should:

add the username_lowercased column to the db
write, test, and deploy the code to insert and update username_lowercased
repair conflicting accounts by renaming the newer account to _username
add the UNIQUE constraint to username_lowercased
notify affected participants manually via Twitter and this GitHub thread.

chadwhitacre · 2013-04-11T00:06:14Z

Gah, this is like Inception!

I need to use participant.id as the primary key instead of username throughout the schema.

chadwhitacre · 2013-04-11T00:08:26Z

No I don't. Stay focused, Chad!

rummik · 2013-04-11T01:14:26Z

Can't we change usernames though? Seems like the pk should be something unique and unchangeable -- but maybe that's just me

chadwhitacre · 2013-04-11T01:22:55Z

@rummik Exactly. That's what #835 is about.

rummik · 2013-04-11T01:25:59Z

@whit537 Ah, okay.

chadwhitacre · 2013-04-11T01:30:27Z

Here are the accounts we need to rename:

chadwhitacre · 2013-04-11T01:41:57Z

Done.

#!/usr/bin/env python                                                                                                               

import gittip                                                                                                                       
from gittip import wireup                                                                                                           
wireup.db()                                                                                                                         
gittip.RESTRICTED_USERNAMES = []                                                                                                    

from gittip.models import Participant                                                                                               

for line in open("foo"):                                                                                                            
    username = line.strip()                                                                                                         
    participant = Participant.query.get(username)                                                                                   
    participant.change_username('_' + username)                                                                                     
    print participant.username

chadwhitacre · 2013-04-11T02:04:57Z

Okay! Deployed! Time to follow up with affected users.

This was on there so we could populate the column initially. It's a bug if the application layer doesn't inserts new participant rows without this column set.

chadwhitacre · 2013-04-11T02:19:23Z

Dear @chase @encukou @erikrose @floft @JerrySievert @jiaaro @joelmccracken @limeburst @Lothiraldan @toomore,

Greetings! I'm paging you because you have two Gittip accounts with the same username but just different casing. Sorry about that! I've cleaned up usernames so they're now case insensitive. The second account you created has been renamed, so you now have:

https://www.gittip.com/username/
https://www.gittip.com/_username/ <= with leading underscore

Here is how to fix up your situation:

Log in to one of the accounts using the relevant OAuth provider—Twitter, GitHub, or Bitbucket.
Look on your profile page under "Connected Accounts," and connect the account type that's connected to your _username Gittip account.
You should get a merge UI to fold the second account back into the first.
You can edit your username after that as desired.

You can scroll up for full details on this issue. Drop a line if something is amiss! :)

chadwhitacre · 2013-04-11T02:20:03Z

Let's see how well that does. If we have any stragglers tomorrow I'll reach out on Twitter.

joelmccracken · 2013-04-11T02:24:29Z

it worked =)

On Wed, Apr 10, 2013 at 10:20 PM, Chad Whitacre [email protected]:

Let's see how well that does. If we have any stragglers tomorrow I'll
reach out on Twitter.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/503#issuecomment-16213623
.

JerrySievert · 2013-04-11T02:25:47Z

Apparently.

chadwhitacre · 2013-04-11T02:25:59Z

@joelmccracken Sweet! :) I actually see a 500 from you, investigating that ...

JerrySievert · 2013-04-11T02:26:54Z

Credit card and giving did not follow though

joelmccracken · 2013-04-11T02:28:28Z

Yeah I wanted to seeeee what would happen, refreshed, got a 500. So.

On Wed, Apr 10, 2013 at 10:26 PM, Chad Whitacre [email protected]:

@joelmccracken https://github.com/joelmccracken Sweet! :) I actually
see a 500 from you, investigating that ...

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/503#issuecomment-16213780
.

chadwhitacre · 2013-04-11T02:36:56Z

@joelmccracken Okay, fix deployed and db repaired (for that 500).

chadwhitacre · 2013-04-11T02:40:08Z

@JerrySievert D'oh! Yeah, Balanced accounts don't survive merges yet. :( #818

Re: Giving. I show you giving to one person. Is that not expected?

JerrySievert · 2013-04-11T02:41:25Z

That is expected but my credit card info disappeared. Is that normal?

chadwhitacre · 2013-04-11T02:46:37Z

@JerrySievert The credit card disappearing is a known bug: #818. Let me see what I can do ...

dmitshur · 2013-04-11T02:53:40Z

@whit537, https://www.gittip.com/ReadTheDOCS/public.json gives error. Is that intentional, or are you planning to make it work in that case too?

We were instantiating Participant directly in public.json. This updates it to use get_participant.

chadwhitacre · 2013-04-11T12:26:41Z

Good catch, @shurcooL. Try now?

https://www.gittip.com/ReadTheDOCS/public.json

Should redirect.

chadwhitacre · 2013-04-11T12:27:01Z

@JerrySievert Your card should be fixed up, per #818.

chase · 2013-04-13T17:07:56Z

Looks like @DeviaVir got stuck with _Chase

DeviaVir · 2013-04-13T17:23:45Z

I'll get over it.

chadwhitacre · 2013-04-14T01:59:25Z

@DeviaVir You should be able to change your username on Gittip. There should be an "Edit" button on your profile page.

dmitshur mentioned this issue Mar 31, 2013

Update README.md with more complete API docs. #806

Merged

chadwhitacre added a commit that referenced this issue Apr 10, 2013

Shelving work on live search; #449

085085a

We need live search to populate the list of people who deserve the money for Gittip, but we need lower-cased usernames (#503) to properly implement search.

chadwhitacre mentioned this issue Apr 11, 2013

use id as primary key instead of username #835

Closed

33 tasks

chadwhitacre added a commit that referenced this issue Apr 11, 2013

Start changing username casing; #503

e65dcd6

chadwhitacre added a commit that referenced this issue Apr 11, 2013

Finish username case folding; #503

e7295ed

chadwhitacre added a commit that referenced this issue Apr 11, 2013

Move branch.sql to schema.sql; #503

f82e2e4

chadwhitacre added a commit that referenced this issue Apr 11, 2013

Redirect to proper casing; #503

20f6383

chadwhitacre added a commit that referenced this issue Apr 11, 2013

Drop default from username_lower; #503

31ddfe1

This was on there so we could populate the column initially. It's a bug if the application layer doesn't inserts new participant rows without this column set.

chadwhitacre added a commit that referenced this issue Apr 11, 2013

Set username_lower when archiving; #503

b3dd5d7

chadwhitacre added a commit that referenced this issue Apr 11, 2013

Fix public.json to also be case insensitive; #503

21c54a9

We were instantiating Participant directly in public.json. This updates it to use get_participant.

chadwhitacre closed this as completed Apr 11, 2013

zbynekwinkler mentioned this issue Nov 25, 2013

Clean up db schema #1549

Closed

chadwhitacre mentioned this issue Dec 18, 2013

Add option to hide total receiving from others #1683

Closed

usernames should be case insensitive, right? #503

usernames should be case insensitive, right? #503

Comments

chadwhitacre commented Jan 21, 2013

sigmavirus24 commented Jan 21, 2013

sigmavirus24 commented Jan 21, 2013

lyndsysimon commented Jan 22, 2013

sigmavirus24 commented Jan 22, 2013

chadwhitacre commented Jan 29, 2013

chadwhitacre commented Jan 29, 2013

alexcouper commented Jan 30, 2013

chadwhitacre commented Jan 30, 2013

chadwhitacre commented Feb 20, 2013

alexcouper commented Feb 20, 2013

johana-star commented Mar 21, 2013

dmitshur commented Mar 31, 2013

chadwhitacre commented Apr 10, 2013

chadwhitacre commented Apr 10, 2013

chadwhitacre commented Apr 10, 2013

chadwhitacre commented Apr 10, 2013

chadwhitacre commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

rummik commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

rummik commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

joelmccracken commented Apr 11, 2013

JerrySievert commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

JerrySievert commented Apr 11, 2013

joelmccracken commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

JerrySievert commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

dmitshur commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

chadwhitacre commented Apr 11, 2013

chase commented Apr 13, 2013

DeviaVir commented Apr 13, 2013

chadwhitacre commented Apr 14, 2013