What user names to forbid for registration?

Question

Possible Duplicate:
What user names should I disallow?

What potentially misleading user names would you forbid for user registration?

I think of "moderator", "admin", "administrator", "guest", "anonymous".

Do you have other suggestions?

Answer 1

Two more: root and superuser

Answer 2

Your list looks to be a good start. I would also include

• sa
• dbo

One very simple, yet effective security measure is just to change the default admin login account names to something non-standard. Very simple way to avoid those who target such accounts specifically.

Answer 3

If other users might get messages from them, you might want to add these to avoid people tricking others into giving up passwords.

• Support
• Help
• AccountServices

Answer 4

Words with manager, [tech]support, and other common job designation titles. Also if you're going to take out anonymous and moderator, you may also want to take out user and owner.

Answer 5

Definitely "Robert'); Drop Table Students;--". As show here.

Answer 6

You should also avoid names that are offensive, e.g. F*CK*OFF. etc. Don't forget that people will be creative and creating speling variants, like using numbers instead of letters, etc. so you really need a perl-like processor for this.

We wrote a code-scanner for work, because some programmers would put obscenities in their comments in their code. And one day it appeared on a site because of a bug -- of a reputable major US bank.

Answer 7

You won't be able to create a blacklist of every possible bad name ; even if you try, and get a nice list...

... So, you definitly must have the possibility to modify a user's name (and there has to be some kind of notification sent to him, to inform him of this change ; and explaining him why is really a good idea, so that he doesn't feel to much offended)

You also should clean the names, by filtering out "bad data" : an HTML tag (in the case of a website), for instance, should not be allowed in a username, I think -- event if it is properly escaped in every output.

Maybe preventing users from using an email address is a good thing too, so they don't have their address publicly displayed, and don't get loads of spam because of your website (here too, explain to them why ! )

Fixing limits on the size of the name might also be a good thing, so that no user can say "My login is 'a', because I'm one of the oldest users" ?

Finally, only allowing ascii characters (letters (only lowercase ? ), numbers, and a couple of simple symbols) is probably good practice too...

Answer 8

"Jon Skeet"

Answer 9

You can't go wrong forbidding "Adolf Hitler" and "Jeffrey Dahmer".