search

unicef / iogt

BSD 2-Clause "Simplified" License
25 stars 34 forks source link

Preventing impersonation in usernames #631

Open cbunicef opened 2 years ago

cbunicef commented 2 years ago

If this isn't already in Wagtail it would be useful to prevent, where possible, impersonation of users via

  1. Commonly-used titles of authority, eg "administrator" "moderator" etc
  2. Homographic attacks
  3. Case-sensitive usernames

Possible solutions:

  1. Prevent most commonly used authority titles from being used in usernames created outside admin panel; add "badge of authority" for administrators, moderators, etc as on eg Facebook image
  2. This may be quite difficult to get right, work has been done on a Python library for defending against domain name attacks
  3. Check for existing accounts during registration in either upper or lower case, to prevent new accounts being made with same letters and different cases
cbunicef commented 2 years ago

Needs to also apply to user's chosen display names.

cbunicef commented 2 years ago

1 and 3 are short-term, 2 (homographic attacks) can be back burner.