# Granted access

2018-02-28

> You can — and should — be taking some precautions to ensure that, say, an auto-created subdomain for a user account doesn’t conflict with a pre-existing subdomain you’re actually using or that has a special meaning, or that auto-created email addresses can’t clash with important/pre-existing ones.

> But to really be careful, you should probably also just disallow certain usernames from being registered.

> Let’s talk about usernames (cache)

Let me tell you a story about that. I have the username david on Bitbucket. You might think it’s quite harmless and I do agree.

There is no such week for the last ten years without somebody giving me write access to a private repository. This is not intentional, it is a user experience security flaw that is really hard to spot. And still, I get access to so many critical stuff!

Even with good will, I cannot find an elegant solution to that confusion. The first year I sent an humorous email about that to each owner and then I gave up. Now imagine if I was nasty…

My point is: even with a strong password — two-factors authentication or whatever — when the user interface is confusing social hacking is made incredibly simple.

Other articles in English: On caching links, Bushcraft retrospective, Into the Raft, Into the Bugs, Meritocracy crisis, The Seller, the Teacher and the Wise, Into the Good, Into the Mice, Into the Camp, Into the Wind, Into the Snow, Into the Cold, Async Python Frameworks, Distributed teams, Into the Wild, Without JavaScript, Inclusive Python, Micro-cultures and governance, Resilient Web and Tools, Bitcoin and energy, Team building, Inclusive developer, Cultural Intimacy, Tools and teams, Senior developer, Slow Data, Inclusive communities, Delivery and value(s), Collaboration debt, Communities and leadership, Specifications and APIs. Oh, and most of the 2018 thoughts.