Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I've worked with a CRM product that allowed non-unique usernames. That's right the usernames could be duplicated, so we had like 10 jsmith's. It would parse the username/password combo, and if one matched, that's who you logged in as. I never got to test what happened when jsmith had the same password as another jsmith. I'm sure the results would have been terrifying and hilarious. Apparently, the history here is that it used to log people in using their email as their only username, but someone here didn't like that and the vendor tacked on this half-assed solution. So you email is your unique identifier but its not used during login.

I suspect there's a lot of poorly written software that still does stuff like this. The message is still valid in these cases as well.



I'm going to guess when a new jsmith comes along and tries to sign up with the same password as another jsmith, you get a helpful 'Sorry, that user name and password combination are already in use.'

:P


If they're stupid enough to allow non-unique usernames I wouldn't bet on getting a helpful answer like that :)


You do realize the helpful answer reveals another users username and password...


Anything other than allowing the user to register with the same username and password as someone else will already give it away, so I don't see the harm in spelling it out.


Just because the requirement was remarkably dumb doesn't mean the developers that implemented it were.


I think Amazon used to do this back in the depths of time.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: