Partial email address should not be allowed as username

[Kirby]

Affected version

2.3.2

Users sometimes mess up the registration form by pasting their email address as username and successfully submitting the form.

As the username is (by default) limited to 25 characters the pasted email address is truncated and the username might end up as smth. like firstname.lastname@gmail. which is not considered a valid email address and thus not blocked.

Users usually do not want their email address to be public so this causes somewhat unnecessary support workload to change their username.

Suggested Mitigation
Disallow usernames that are identical with the beginning of the email address.

 

[Deleted member 184953]

This should already be the case, but it doesn't seem to work effectively.

XF 2.2 Post in thread 'Email as username...'

Nov 1, 2022

I'm not entirely clear how this would happen.

We block registration for usernames that look like email addresses, I think.

• Chris D

 

[Kirby]

This should already be the case, but it doesn't seem to work effectively.

Nope.

XenForo blocks usernames that are considered valid email addresses , eg. name.lastname@gmail.com would be blocked as username, but very-loooooong-local-part would not be blocked if the email address is very-loooooong-local-part@gmail.com for example.

XenForo currently also does not block firstname.lastname@gmail as flag allow_local is not set when checking if the username might be a valid email address.

 

[ENF]

Nope.

XenForo blocks usernames that are considered valid email addresses , eg. name.lastname@gmail.com would be blocked as username, but very-loooooong-local-part would not be blocked if the email address is very-loooooong-local-part@gmail.com for example.

XenForo currently also does not block firstname.lastname@gmail as flag allow_local is not set when checking if the username might be a valid email address.

We have a lot of issues with people using the prefix of their email address, everything before @ as a member name. It would be better (IMHO) if no part of the email address was allowed in the member name field. I just feel like that is a concern since people tend to use common email providers, it doesn't take much effort to generate a list from scraping and then matching them to common email domains. (Could be turned into an attack vector or spam lists) Just a thought on the edge here...

 

[Deleted member 184953]

In the meantime, we can accomplish a great deal of work with these settings.



What would be the regex to use to exclude an email from a username?

 

[woody]

I would love to see this implemented, either natively or as a plugin.

 

[MySiteGuy]

Why not add @ to setting

"Disallowed text in usernames"

 

[woody]

The issue is this:

username: MySiteGuy
email: MySiteGuy@gmail.com

Scammers are now fishing user emails by simply adding the most popular email domain extensions.

 

[Alpha1]

There are plenty of legitimate users who have the email prefix as their username. I would not disallow it unless there is a major issue.

 

[ENF]

There are plenty of legitimate users who have the email prefix as their username. I would not disallow it unless there is a major issue.

It's not about them being illegitimate, it's about the data scrapers scooping up the user names and tying them to commonly used email services.

 

[Dragonfruit]

It's not about them being illegitimate, it's about the data scrapers scooping up the user names and tying them to commonly used email services.

That's on the users, they make that decision. It's not on every website's job to ensure they're using a unique ID from their email address. We do the same with just blocking @ from usernames, because when users try to input their emails there and it fails, that's their cue to change it. If they decide to just remove @domain.com, and continue with it, that's their decision. That's their freedom of choice.

 

[ENF]

That's on the users, they make that decision. It's not on every website's job to ensure they're using a unique ID from their email address. We do the same with just blocking @ from usernames, because when users try to input their emails there and it fails, that's their cue to change it. If they decide to just remove @domain.com, and continue with it, that's their decision. That's their freedom of choice.

No, just the better sites have improved controls in place to prevent unnecessary leakage.

 

[Dragonfruit]

No, just the better sites have improved controls in place to prevent unnecessary leakage.

Or you're just asserting unnecessary control. I go by a very specific username for my personal online profile. And I do have it as an email as username@gmail.com

If you choose to not allow me to register as that username because I'm also using it as an email address, then I'm not registering on your forum. Because it's my choice to have that username, and have that email address.

It's on the user's due diligence to be online safe, it's also why that same email address is just for specific online accounts, not for online banking, shopping, anything that really have financial uses.

And I'll argue, the better improved security for your site is you stop the data scrapers, not block the users from using the usernames they want.

 

[ENF]

Or you're just asserting unnecessary control. I go by a very specific username for my personal online profile. And I do have it as an email as username@gmail.com

If you choose to not allow me to register as that username because I'm also using it as an email address, then I'm not registering on your forum. Because it's my choice to have that username, and have that email address.

It's on the user's due diligence to be online safe, it's also why that same email address is just for specific online accounts, not for online banking, shopping, anything that really have financial uses.

No, it's a very necessary control. Once people understand the rule and why it's there, they are appreciative. Everyone has their own due diligence and that doesn't fall on the user alone. We don't assume what they may or may not use that account for, so the risk appetite is set accordingly.

And I'll argue, the better improved security for your site is you stop the data scrapers, not block the users from using the usernames they want.

We do have controls in place for this as well, but it's impossible to block 100% of the attempts.

 

[Dragonfruit]

No, it's a very necessary control. Once people understand the rule and why it's there, they are appreciative. Everyone has their own due diligence and that doesn't fall on the user alone. We don't assume what they may or may not use that account for, so the risk appetite is set accordingly.


We do have controls in place for this as well, but it's impossible to block 100% of the attempts.

This is something impossible to police.

Like how I'm using 'Dragonfruit' here.

Oh look, a dragonfruit@gmail.com exists - but it's not my email address, that means the fact that I'm using "Dragonfruit" as username is causing data leakage to someone else.



Are you going to develop an username to email validation addon so it checks every username on registration to see if they exist with major email services before you allow them?

This is such a slippery slope, I'll choose to stay away from. If it works for you, keep at it. I rather let people keep their identity & individuality.

 

[Sim]

We have a lot of issues with people using the prefix of their email address, everything before @ as a member name. It would be better (IMHO) if no part of the email address was allowed in the member name field. I just feel like that is a concern since people tend to use common email providers, it doesn't take much effort to generate a list from scraping and then matching them to common email domains. (Could be turned into an attack vector or spam lists) Just a thought on the edge here...

Meh - I think you're inventing problems where there are none.

Scrapers gonna scrape. A large percentage of people on some of my sites use their real names, and firstname.lastname@gmail.com is a pretty obvious choice for scrapers. I have one of those email addresses myself and almost never see any spam (unless I check the spam folder), so

It doesn't matter what username you choose - someone will scrape it and try it against common email domains. Stopping users from registering usernames that match their email addresses is short-sighted and counter-productive. You're only hurting yourself for no tangible benefit to anyone.

 

[ENF]

Are you going to develop an username to email validation addon so it checks every username on registration to see if they exist with major email services before you allow them?

This is such a slippery slope, I'll choose to stay away from. If it works for you, keep at it. I rather let people keep their identity & individuality.

We have a moderation team that validates accounts manually before being allowed in. If the account makes it past the automated checks, the mod team makes a final check and then approves the account. If an account comes up with email data in the member name field, it's rejected and notification sent as to why. 9 out 10 times, they register again correctly. It's completely possible that someone's member name could match some random email address out there, but the focus is on what we hold in our possession.

It's not a slippery slope for us, it's what we have been doing for years.