ATTENTION: Profile changes!

[helvetica]

A new profile field has been added to replace username as a method of identification.  Under Profile -> Account Settings you will see a new option named "Nickname", it will show up right under your avatar so people can recognize you even if you change your display name.  This is PERMANENT, so choose wisely what you wish to be there.  We are leaving the field open for editing for the next couple of days to let people set their own, but after that it can only be edited by an admin.  At registration time you are forced to fill it out.

The field will be locked for editing after 2/20.  After this time only admins will be able to set and edit this field.  Don't put anything stupid, this is going to show up on your profile for the life of your account and we will only change it in cases of offensive or inappropriate nicknames.

Usernames are now hidden again, only staff and the owner of the account can see the actual username you use to login with.

[Iryan]

So, just so I get this straight, the nickname becomes the permanently displayed name in your profile where your username used to be visible, whie the username is the one with which you log on, and the two must not be the same...

Would it be possible to keep the former username as the nickname and changing the username instead? Aside from being what at least some people would prefer name-wise, it seems to me that it would also be safer than keeping the login name the same as before. Or maybe I am just being paranoid again.
If that is too much work in one way or another (I wouldn't know, sorry), well, too bad, but if you could do that, it would be pretty cool.

Anyways, props on the quick reaction to the attacks and thanks for the information and work you are doing. 

[Gpop]

Since I'll always be known as Gpop and I PREFER to be known as Gpop (not Koipop that was just for a time being) this is something very good for me. Thank you TSO.

[helvetica]

So, just so I get this straight, the nickname becomes the permanently displayed name in your profile where your username used to be visible, whie the username is the one with which you log on, and the two must not be the same...

Yes, your login name (username) is now no longer visible by anyone except you or the staff.  It used to be open to anyone who could view profiles as it was something that wasn't user-changeable and unique, but now because of the attacks it is hidden again.  Your username should not match ANYTHING publicly identifiable on your account, so don't set your display name, your nickname, or any instant messaging nicks to your username.

Would it be possible to keep the former username as the nickname and changing the username instead? Aside from being what at least some people would prefer name-wise, it seems to me that it would also be safer than keeping the login name the same as before. Or maybe I am just being paranoid again.
If that is too much work in one way or another (I wouldn't know, sorry), well, too bad, but if you could do that, it would be pretty cool.

Oh we can easily do that.  Just send a note to any of the admins (me, Kilga, Edible, Matsuri, 7hs and Ruro), and we can have your username changed and then you can go ahead and set that as your nickname.

I know this is kind of frustrating for everyone but we have everyone's safety and security in mind.  By divorcing your public name from your login name, it will be nearly impossible for someone to even attempt to bruteforce your account.

[Azure Lazuline]

One small suggestion: If someone's displayed name is the same as their nickname, it seems weird/awkward to have both shown beside each post. I think this is a cool idea overall, though, and is a great way to keep changeable display names without it getting out of hand.

[helvetica]

One small suggestion: If someone's displayed name is the same as their nickname, it seems weird/awkward to have both shown beside each post. I think this is a cool idea overall, though, and is a great way to keep changeable display names without it getting out of hand.

There's no easy way for me to check if they both match, so it'll have to be for now.

[Gpop]

I know this is kind of frustrating for everyone but we have everyone's safety and security in mind.  By divorcing your public name from your login name, it will be nearly impossible for someone to even attempt to bruteforce your account.

That's awesome because my login name here is different from my nick

[三重階乗]

This is probably going to feel awkward for a few posts, as I haven't used a separate name anywhere since the summer of 2007 when I assumed the name *fakeremoved for security reasons* on the Internet for the first time. Right now I'm nicknaming myself as my main in MUGEN (even though I haven't uploaded a vid of it in months and am basically retired as far as that's concerned). Hopefully I can think of something better before the deadline, as it seems silly to have a name that sounds like the Touhou equivalent to Master Hand on a Touhou forum and an RP account to anyone who knows about Dragon Claw. I was actually going to do this in a MUGEN forum as an April Fool's joke, but decided not to.

If anyone cares, this is the image I'm using (I tried to upload it to Danbooru long ago, but it went unapproved).

Anyway, would it be risky to put my YouTube account in the URL field due to a match with my username?

[helvetica]

I would recommend against it.  But to be honest the risk of someone coming through, making 10 posts, just to harvest URLs/IM names to attempt logins is very low.

We can just change your username (what you log into the forums with) to something random but memorable for you if you're really worried though.  Then you can have your nickname/display name be whatever you want.

[Whatthe]

This is great! Now I can change my display name when I get a new avatar without fear of becoming unrecognizable

[Tengukami]

Are we required to fill out this field? Do we have the option of leaving it blank?

[helvetica]

We would prefer if you filled it out with something so if you change your display name for whatever reason there's something to fall back on.  It's mandatory for all new registrations so I would say yes it's mandatory here, even if it's just the same thing your display name is.  Eventually I will have some sort of code that checks your display name and if they're the same will remove the tag from view.

[Kilgamayan]

Thank you for this. It gives me an excuse to change my nick to this without making me a hypocrite about the irritation of nick changing obscuring identity.

[Gpop]

Thank you for this. It gives me an excuse to change my nick to this without making me a hypocrite about the irritation of nick changing obscuring identity.

I recognize you by your siggy and avatar :3

[Tengukami]

We would prefer if you filled it out with something so if you change your display name for whatever reason there's something to fall back on.  It's mandatory for all new registrations so I would say yes it's mandatory here, even if it's just the same thing your display name is.  Eventually I will have some sort of code that checks your display name and if they're the same will remove the tag from view.

Alright then, done.

I appreciate the measures you're taking to make things more secure here, and that you're keeping things as transparent as possible about what's going on and why.

[ultramage]

I have a question. What are you DOIIIIIING?!
Is the issue with people whose login and display name is identical? What's so bad about it? The password is supposed to be the secret thing that protects your account, not your username O.o
And if it's something about logging out people whose accounts had password failures, then... don't end their sessions, and instead come up with something better?

[Conqueror]

I have a question. What are you DOIIIIIING?!
Is the issue with people whose login and display name is identical? What's so bad about it? The password is supposed to be the secret thing that protects your account, not your username O.o
And if it's something about logging out people whose accounts had password failures, then... don't end their sessions, and instead come up with something better?

If your login name isn't publicly visible, it can't be brute forced. That's what this is all about; making it so that the login handles aren't publicly visible.

Eventually I will have some sort of code that checks your display name and if they're the same will remove the tag from view.

Well that was fast. Thanks.

[helvetica]

OK code in place to hide the nickname field if it matches your current display name.  :3c

I have a question. What are you DOIIIIIING?!
Is the issue with people whose login and display name is identical? What's so bad about it? The password is supposed to be the secret thing that protects your account, not your username O.o

No username, no bruteforcing.  There's nothing to attempt password breaks at if you can't even get the login name.  We're under bruteforce attack and will continue to be for the forseeable future.  I cannot block the attempts as they're coming from all over the place, so to reduce the attack surface we are keeping login names out of anything publicly viewable.

After being in IT for the past 8 years I've learned never to trust users to make secure passwords, or to use a unique password for each of their logins.  Rather than enforce a password strength policy that does nothing except cause headaches, I've chosen to hide from prying eyes the big piece of the puzzle, the login name.  The ONLY people attacked so far had their display name equal to their username.  Without a valid login name they can sit there and spin their wheels as much as they want but will get nowhere.

And if it's something about logging out people whose accounts had password failures, then... don't end their sessions, and instead come up with something better?

All current user sessions are invalidated when you fail to login as a security measure.  This is so active sessions cannot be hijacked if such a vulnerability surfaced.  I will not be disabling this or changing the behavior.

[Garlyle]

Honestly... the 'this is who it is!' type display is something I'm surprised didn't exist before!

[Unassuming Squid]

OK code in place to hide the nickname field if it matches your current display name.  :3c

Wow. That was fast.

I really have to commend you on the speed and efficiency with which this was taken care of. Great job, TSO.

[helvetica]

It actually took quite a bit of work to get it together, before I was lazy and I just exposed usernames in the profile so people can see who's who that way.  But out of necessity we are now hiding that information again so I had to figure out how to get a new profile field added.  Not only that, but make it so it's only admin editable.

SMF has some barebones support for custom fields thankfully, still required some hacking to get the autohide and stuff like that :V

[ふねん1]

I chose something else for my nick that I probably wouldn't use as a screenname, though that was before TSO got that new coding in. Had I waited I would have kept the nick as the English spelling of my screenname. Oh well. I still like the name Sparky anyway. :V

[Turtlesaur]

Is there any reason you didn't just go with email addresses as login instead? Makes a lot more sense than having 3 different names to me, doubly so because no normal user can/could see emails.

I'm assuming that SMF doesn't do something braindead like sending over SHA1(username:password) on login.. which, to be fair, might be a bad assumption.

[helvetica]

Is there any reason you didn't just go with email addresses as login instead? Makes a lot more sense than having 3 different names to me, doubly so because no normal user can/could see emails.

I did what was quickest and easiest.  I considered email addresses but it would have required extensive rebuilding of the registration/login system.  We've been wanting a solution to identifying people who change display names often anyhow, this kills two birds with one stone.

Your display name can match your nickname.  When that occurs it just hides the nickname field.  The only one of the three that has to be unique is your USERNAME, what you login with.  Really the only people that have to rotate usernames are people who wish to use their "current" username as their new nickname.

I'm assuming that SMF doesn't do something braindead like sending over SHA1(username:password) on login.. which, to be fair, might be a bad assumption.

This was all bruteforcing from what I can tell.  They just assumed display name = username and tried to bruteforce login those.  The only people that had any sort of successful attempts all had their username matching their display name, and I don't see the bruteforce attacks ceasing anytime soon.  The real big change was hiding the username again, and since it had been out in the open for so long, it was kind of a moot point without also recommending username changes.

[Whatthe]

Pointed this out in the attacks thread; figured I should point it out here too.

Anyone whose display name has ever matched their username should get their username changed, since old quotes keep their authors' old display names.

[Drake]

/nick Drake

[Conqueror]

We've been wanting a solution to identifying people who change display names often anyhow, this kills two birds with one stone.

Anyone whose display name has ever matched their username should get their username changed, since old quotes keep their authors' old display names.

Tangentially related, but I've wondered if it wouldn't make more sense for quotes to say, "quote from" Nickname instead of "quote from" DisplayName.

[helvetica]

Tangentially related, but I've wondered if it wouldn't make more sense for quotes to say, "quote from" Nickname instead of "quote from" DisplayName.

I'm not sure what it'd take for me to do that.  I can look into it.  Part of the problem is the quote name is actually baked into the post at the time of posting (look at the quote string next time you post).  So it's not automatically updated when people nickchange etc.

[Mimachiro]

Hopefully this should end the problems caused by the attacks. I haven't been around MotK for that long, anyway, so changing my display name/nickname doesn't hurt me too much, anyhow. Thanks for the effort! 

[E-Nazrin]

I actually like having 'legacy' quoted-by names; lets you see what's going on if the conversation relied on namechange shenanigans.

But eh.