We should not allow new accounts to have admin/Admin/AdMin/etc as an username

[mario-nt]

I think we should not allow accounts to be registered with the username admin, Admin, or their variations like AdmIn, ADMIN, etc.

As it can be a bit misleading.

What is your opinion on this? @torrust/torrustaceans

[josecelano]

I think we should not allow accounts to be registered with the username admin, Admin, or their variations like AdmIn, ADMIN, etc.

As it can be a bit misleading.

What is your opinion on this? @torrust/torrustaceans

Hi @mario-nt what are the problems you are trying to avoid?

By the way, the "admin" username is not even hardcoded in the app. The admin is whoever signs up first. You can use any username you want.

Maybe the problems you see could be fixed just by making it clear who has the admin role. My proposal would be to use a particular icon or label whenever the admin's username appears.

On the other hand, if the real admin finds someone trying to impersonate him/her. He/she should be able to ban that user. The Index API includes a banning feature but the Index GUI does not support it yet.

Anyway, we could implement a list of non-allowed usernames in general. But that list should be multilingual. For the time being, I prefer the first option. I would implement the second if admins have frequent problems banning users for that problem.

[mario-nt]

@josecelano I thought about two possible scenarios:

1. If we use the username in the casbin policy file for allowing actions, having a user that is not an admin named admin could lead to that user to have admin privileges. This is not a problem right now as we are using the administrator field in the user compact struct.
2. This is the one that concerns me the most, if a user with the name admin (who is not a real admin) uploads torrents with malware, or in the future if we allow comments in the torrent files, it asks for passwords, etc it can make people believe that something is virus free download the file and get infected, or maybe be a victim or a phising attack.

Also in general, I don't like the idea of having users with the name admin to be allowed, but I get your point.

I just wanted to write this proposal down and see what the team thinks, if right now is not really a problem or it is not worth the time implementing it, we can just move it to the backlog for future releases or just discarted.

[josecelano]

I think the list would be very long, and people would find new creative usernames. In the end it depends on how aware users are about phishing attacks.

If we want to somehow restrict usernames I would do the opposite as mentioned here:

https://security.stackexchange.com/questions/65574/where-can-i-find-a-list-of-frowned-upon-usernames-for-web-sites

That is, a whitelist of usernames for admins that no other users can use (for example only admins can use the prefix admin and make sure all users know that convention.

[mario-nt]

Also I like the idea of having an icon or something similar to differentiate admins users from regular ones.