Imposter warning

[ToSeek]

Hi,

Recently the moderators (and others) have noted the emergence of new users who have names so similar to the names of existing established members that vBulletin gets confused. Specificallly, they will see the name "Reliable User" and use the name "Reliable-User", which for purposes of looking up profiles and such are identical so far as vBulletin is concerned. We are looking into ways of squashing this. (And if you're doing this, be warned that this is a ban-on-sight offense.) In the meantime, be aware of the situation and, if you see an example, please let me know via PM. Thanks.

ToSeek
BAUT Forum Administrator

[Nick Theodorakis]

Could users request that certain names be "locked out" so they can't be used? For example, one might make the usernames "To-Seek" and "To Seek" unavailable by request.

One more question: are usernames case-sensitive?

Nick

[swampyankee]

I would think that it would be fairly straightforward to add a bit of filtering software to the registration software to filter out names which are not sufficiently different from existing names. Obviously, how you define "sufficiently" is the difficult part, but I'd start by forbidding any new names with characters that vBulletin ignores, and those that differ only in case. One suggestion is to try googling for "Levenshtein distance."

[Nick Theodorakis]

We'd have to make allowances for existing members; for example, there are two well-established posters with the usernames "publius" and "publiusr."

Nick

[Fazor]

We'd have to make allowances for existing members; for example, there are two well-established posters with the usernames "publius" and "publiusr."

Nick

That's different. While they're similar to a reader, they're spelled differently and I'm sure the software picks that up. At least, I've never been confused as an admin by the software, just from the occasional user. :-P

[Moose]

Could users request that certain names be "locked out" so they can't be used? For example, one might make the usernames "To-Seek" and "To Seek" unavailable by request.

1) How could the admin tell if this was done intentionally or maliciously? We'd wind up with a problem we'd have no way of solving, short of meticulous record-keeping.

2) You'd wind up hijacking your own profile, and making it difficult for others to contact you through it, plus you'd have trouble making changes to your own settings.

One more question: are usernames case-sensitive?

Usernames aren't case sensitive as far as registration and login. Moose = moose = MOOSE. But the board will keep the caps intact in the (similar but different) display name field.

[Nick Theodorakis]

1) How could the admin tell if this was done intentionally or maliciously? We'd wind up with a problem we'd have no way of solving, short of meticulous record-keeping.
...

What I meant was, could users proactively ask that an currently unused username similar to theirs be locked out of future registration? Sort similar to the way that a company may register a number of domain names similar to their main one to make it harder for somebody to hijack their web traffic.

Nick

[BetaDust]

Well the number of posts made, would be a clue.

If I see a "ToSeek" somewhere here, with less then 25,000 post's...

I'll hit Red Alerd.

---
Thanks for the heads up, ToSeek.

--Dennis

[ToSeek]

What I meant was, could users proactively ask that an currently unused username similar to theirs be locked out of future registration? Sort similar to the way that a company may register a number of domain names similar to their main one to make it harder for somebody to hijack their web traffic.

Nick

I tried to find a vBulletin setting that would let me do that. So far I have not been successful.

[Fazor]

As popular as the vBulletin software is, I'd think this issue would have come up on other forums as well. Have you talked to their support people (if they have any)?

[Jeff Root]

In order to lock out specific names, you might need to register them and
then ban them.

-- Jeff, in Minneapolis

[chrissy]

So far it is the users who have a space in their names, like Jeff Root, the imposters are just adding the "-" between the first and second name ie: Jeff-Root and bingo, it takes over your account.

[Nick Theodorakis]

So far it is the users who have a space in their names, like Jeff Root, the imposters are just adding the "-" between the first and second name ie: Jeff-Root and bingo, it takes over your account.

As Jeff suggested, is it possible to just register those variations and ban them, or does that also lock out the "original" account?

Nick

[chrissy]

I have banned the imposters but it still remains on the origional users account, it doesn't ban the origional user but the rider.
Only an administrator can change the name of the imposter and it vanishes from the real users profile. This is how we can clear them so far.

[Swift]

As Jeff suggested, is it possible to just register those variations and ban them, or does that also lock out the "original" account?

Nick

ToSeek has a system for dealing with the ones that are already created (at least once we learn about them). I won't elaborate.

The bigger issue is what could be done about the ones that don't yet exist. I suspect manually going through the list of all members with a space in their name, and doing what you suggest, would be a very big job, unless we can figure out a way to automate it.

[Nick Theodorakis]

ToSeek has a system for dealing with the ones that are already created (at least once we learn about them). I won't elaborate.

The bigger issue is what could be done about the ones that don't yet exist. I suspect manually going through the list of all members with a space in their name, and doing what you suggest, would be a very big job, unless we can figure out a way to automate it.

You could let the users volunteer to police their own names. Could they submit a registration request with a note added they are requesting it to be locked?

Nick

[Swift]

You could let the users volunteer to police their own names. Could they submit a registration request with a note added they are requesting it to be locked?

Nick

So, a user who has a user name with a space (like Nick Theodorakis, for example ) would create a second user called "Nick-Theodorakis", then ask us to ban the new user?

We'd still have to ban the new user, and that couldn't be done by a moderator, only an administrator, because of the method that has to be used (if I'm understanding this whole thing correctly, I'm not the alpha-geek for this sort of stuff). I think this still might be a ton of work for our two admins.

[Moose]

I suspect manually going through the list of all members with a space in their name, and doing what you suggest, would be a very big job, unless we can figure out a way to automate it.

As I said before, that would be a poison pill. If we did that, nobody with spaces in their name could reach their own profile. We'd have literally caused, globally, what we're seeking to prevent.

What we have is an irritant, not a crisis.

Best thing folks can do for now is that if you have a username with spaces in it, check your profile now and again. If you don't wind up in your own profile, let a mod or admin know. If we come up with a better way ahead, we'll let you all know.

[01101001]

The bigger issue is what could be done about the ones that don't yet exist. I suspect manually going through the list of all members with a space in their name, and doing what you suggest, would be a very big job, unless we can figure out a way to automate it.

I think it's another reason to dump vBSEO. I don't think it's a vBulletin problem. It think it happens because vBSEO creates search-engine-friendly URLs, but pretty much ignores everything but alphanumerics and "_" when generating the URLs, mapping all funny characters to "-".

That turned out to be the culprit during an earlier episode of confusion of multiple member names mapping to one member CP.

(The other reason, of course, is that "permalinks" don't work for everyone since vBSEO assumes everyone uses the page size setting of 30.)

[ToSeek]

Okay, I found a vBulletin setting that limits the character set that's allowed in usernames. We'll see if that does the job.

[Swift]

Okay, I found a vBulletin setting that limits the character set that's allowed in usernames. We'll see if that does the job.

Yeah, I mean we have more than enough characters around this place already.

[Otherworldly]

Yeah, I mean we have more than enough characters around this place already.

Another self-affirming post

[slang]

I'm not sure if it's the same problem, but there's an imposter with my name, and the same post count and signup date, who sometimes posts something dumb.

[Swift]

I'm not sure if it's the same problem, but there's an imposter with my name, and the same post count and signup date, who sometimes posts something dumb.

They live in the Netherlands and quote Charles Darwin and Jason Thompson in their signature? Yeah, we're on them, and are about to ban them permanently!

[HenrikOlsen]

Well the number of posts made, would be a clue.

If I see a "ToSeek" somewhere here, with less then 25,000 post's...

I'll hit Red Alerd.

You probably won't, that's not the designed-in buggy behavior that's being exploited.

It's the braindeadness that thinks it's a good idea to construct the link to a user's profile by replacing spaces in the name with a hyphen and didn't consider that this is not a bijective function, so the link can't uniquely identify the user and thus will show the profile of the wrong person.

Banning the other name preemptively only makes the profile-link point to the banned profile so isn't a solution.

[Torsten]

Would it be feasible for the spaces in existing user names to be replaced by underscores? That is, change the names of those users so that they essentially appear the same, but require the underscore upon login. (In case limiting the character set doesn't work out. Are there legitimate hyphenated user names that wouldn't work as a result of that?)

[Otherworldly]

This sounds like a really appalling bug. So the software treats two IDs as distinct in some circumstances (at registration), but the same in others? It would be perfectly OK to have multiple text strings map to the same logical user identity, but you've got to use the same mapping all the time.

[sirius0]

Now if I tried to set up another account with the user spelt exactly the same as another I would not be able to. But obviously the initial registration can see the difference, allowing these other accounts, so why can't the login algorithm?

[Otherworldly]

Now if I tried to set up another account with the user spelt exactly the same as another I would not be able to. But obviously the initial registration can see the difference, allowing these other accounts, so why can't the login algorithm?

Yep. It's OK to do it one way, and it's OK to do it the other way. It's just not OK to do it one way sometimes, and the other way other times

[HenrikOlsen]

Now if I tried to set up another account with the user spelt exactly the same as another I would not be able to. But obviously the initial registration can see the difference, allowing these other accounts, so why can't the login algorithm?

Because the login algorithm is part of the core system and the "search engine friendly" links are generated by an add-on that lies for a living and lies badly at that.

If only the add-on designers had though of including the user id number in their pretty link so it had been e.g. .../henrikolsen-2600.html instead of .../henrikolsen.html, and used the number to identify the user so it would still uniquely identify the user regardless of character replacements, character set conversions and other transformations, it might actually have been good.

Same with the permalink, if they'd made it use the post number instead of page number it would have been great, as it is now it's just plain broken