Problems with the new username feature

IF YOU ARE SOMEONE WHO NEEDS TO CHANGE YOUR PROFILE NAME DUE TO A PRIVACY CONCERN OR FOR YOUR OWN SAFETY

If you are reading this thread and are someone who would like to change your name or hide your past presence on the site without others seeing that it has happened, especially if you have a concern for your own safety or privacy, please report your profile for a reason of “Other”, and explain in the text field what you would like.

I or one of the other members of staff who help with this will contact you to talk about the options that are available and will work out the details of how to help you best.

1. Changing your username happens with no second step of confirmation, just the usual password entry on the bottom of the account page. Given the 90-day period before you can change it again, I think this needs a second step to prevent issues - having to enter it twice, a confirmation email with a link you have to click, even a mod to check off on it.-^~
    
   _{^{~~2. Changing your username breaks all links to your current account. Previously-used usernames are still associated with your account, it’d only take a little extra code to check for a name there before giving up and going to the homepage. This would work even without tying up the username for re-registry, since the minute someone else registers the name, all those old links would redirect to their account instead. Which brings me to:~~}
    
   ^~~3. Username reuse opens the door to impersonation and squatting. Of course, impersonation happens already, with clever character replacement in usernames, but a direct link to your account would not redirect to the impersonator. This changes with this new feature, the door is now open to 100} accurate impersonation.^%
    
   %^4. There is no limit to the number of username changes. Sure, it’s rate-limited to about 4 times a year, but that’s still encouraging at-will changes. This is an issue of wants and needs; usernames on this site are important enough that a change should be a need, not a want. I can’t think of a reason why anyone would need to change their name more than once, if at all. This isn’t comparable to changing an avatar or user title, those are more like flair. Your name is your identity.^%
    
   %^5. The two-week notification period is too short. Honestly, it’s perfectly reasonable to assume that people will go more than 14 days without seeing a comment from a particular user. Some people don’t even check the site that frequently. Just look at how many people were late to the party for the community collab that was in the site banner for over a month.^%
    
   %^6. There is no way for regular users to see previously used names. Aside from the 2-week window, there is no public record or indication that a user has a new username most places on the site. All previously used names should appear on user profiles, not just the last, if that notification does indeed persist there. If a user really wants to distance themselves from their current identity, creating a new account is a better approach anyway.^%
    
   %^7. “Comments made under an old username will show it indefinitely” is wrong. At the very least, it is misleading. Old comments currently display the new username. That’s acceptable behavior, but the language of the page seems to imply the opposite. If they did intend for old comments to display as the old username, it could again lead to broken links, and could be abused by users trying to distance themselves from duckish posts the way Tumblr and Twitter names are abused.^%
    
   %^I believe this feature needs to be disabled until these problems are addressed. At the very least, we should have a two-step process for setting new usernames, and restrictions placed on being able to re-register a retired username. Ideally, I think this is a feature that should require having account verification (e.g. user links) to warrant, otherwise changing usernames should be left to mods to handle. Another idea might be to leave the original username intact, and simply let users change the name that displays on uploads, comments, and the like. We don’t currently make a distinction between account name and display name around here, and as such, it is unwise for users to change these things on a whim.~~^%

1. You know what purpose entering email twice in forms serves? None. Don’t be an idiot with account settings.  
2. If you’re linking your profile outside of Derpibooru, please do keep it up to date. Also, breaking links is quite nice when renaming to ditch an old name you don’t want people finding easily.  
3. My only concern would be that people can be tricked by old URLs, but doing this would mean waiting for your target to rename and relying on URLs not being updated. Also, you can’t 100% imitate artists, they have user links.  
4. Good.  
5. How does this create a problem?  
6. Good.  
7. What? I think you misunderstand how this works. Comments remember the username at posting time and will show it in the previously known as if the username is different (and this overrides recent renames). Usernames btw have nothing to do with the link working (see top).

1. Changing your username happens with no second step of confirmation, just the usual password entry on the bottom of the account page. Given the 90-day period before you can change it again, I think this needs a second step to prevent issues – having to enter it twice, a confirmation email with a link you have to click, even a mod to check off on it.

Also, breaking links is quite nice when renaming to ditch an old name you don’t want people finding easily.

3. My only concern would be that people can be tricked by old URLs, but doing this would mean waiting for your target to rename and relying on URLs not being updated. Also, you can’t 100% imitate artists, they have user links.

7. What? I think you misunderstand how this works. Comments remember the username at posting time and will show it in the previously known as if the username is different (and this overrides recent renames). Usernames btw have nothing to do with the link working (see top).

1. Reserve previously-used names for the same 90 days until the user can change their name again. This ensures that everyone has a chance to get acclimated to the change and possibly edit any links they may have made in that time before they start redirecting to a new person.
    
2. Make permalinks available for user accounts, accessible on their userpage. This only helps moving forward, but if links to the underlying userID were still available, then users could link to the intended account assured that the link would continue to work.
    
3. Redirect unused names to the last account that used them until registered to a new account. I have already mentioned the trivial effort it’d take to make this one happen, and it’s by far my least favorite stopgap, but it does at least temporarily solve the issue of breaking links.
    
4. Rather than freeing up these names, cull the list of registered users for any accounts that have never had any activity and no active logins within the last 30-60 days. I guarantee that you’ll “free up” a whole bunch more names without stepping on the toes of any users who have done more than lurk.
    
5. Building off of the permalink idea, make a script to retroactively go through the database of comments, forum posts, and image descriptions, and edit all direct links to user profiles to become permalinks. Extra points for keeping the text of the link intact. Wow, that sounds like a lot of work? Try telling that to everyone the problem got crowdsourced to when Joey acknowledged the issue but did nothing to address it.

but seeing the names they went through - ☆ and then Chrys - a simple confirmation email with a link to confirm the name change before it took effect might have prevented the unwanted star name.

@DragonMaus
Are you kidding me? Treating this as a trivial matter is what got you into this mess in the first place. Don’t try to slap a “fallacy” label on this and expect that to settle the matter.

creating more problems for yourself and the rest of the staff

than if you had kept name changes to being a modtool.

1. Someone would just rubber-stamp approve all changes  
2. Someone will question every change and ask members why they want to change it
    
   The first option doesn’t add anything beyond a time delay. The second option is intrusive. I don’t believe people should need to justify a name change to me or anyone else of staff. If they want to change it because they want to change it, that’s good enough reason in my opinion.
    

Maybe having an old link to an account redirect to a different person isn’t the end of the world, but there’s no reason to unintentionally let it happen in the first place.

And, quite simply, the biggest difference in opinion is that I think it is entirely too easy to change your username.

carries with it the implication that usernames are unimportant, that the past can be swept under the rug, that it’s just another cosmetic aspect to the site.