Question

I run a social networking / blogging website ( http://www.obsidianportal.com ), and currently the users are identified by their unique (and unchangeable) username everywhere. Many have requested the ability to have a display name as well that they can choose. I’d like to support this, but I’m worried about spoofing and identity theft. So, I’m wondering if anyone has dealt with this and has any advice?

Here’s what I’d like to avoid:

I’m known as Micah on the site. I don’t want anyone to be able to choose my name as their display name and then impersonate me to others on the site. Similarly, I don’t want people to be able to impersonate each other.

Here are some possible avenues I’ve identified:

• Let them choose whatever name they want (within reason: profanity, racism, hate speech, etc.)
• Don’t allow users to choose a display name that overlaps with an existing unique username
• Don’t allow users to choose a display name that overlaps with an existing unique username OR an existing display name.

Am I being too paranoid? Should I just chill out and let users pick whatever names they want?

Answer 1

I’d go with the principle of least astonishment, in this case ‘Don’t allow users to choose a display name that overlaps with an existing unique username OR an existing display name.’ Otherwise you could have 10 different people with nickname Piskvor talking to each other 😉