15

I need to know what is the standard rule for creating username/login ID. Should it be case-sensitive? If I have successfully created three accounts (user2, useR2, USER2), should I consider this a bug?

Improve this question
2
  • 7
    We can't tell you what your software is supposed to do. Ask the BA/SA/PM/Product Owner.
    – Paul Muir
    Oct 13, 2015 at 13:28
  • 1
    he is talking about the username, not the password.
    – JohnS
    Mar 27, 2017 at 20:37

10 Answers 10

Reset to default
13

No, it's not a bug by default. This depends on the requirements of the system, there is not global rule for situations like this. Some operating systems allow the same user with different casing.

Even the user part of an email adress (username@hostname.tld) is not case sensitive in all cases. For more info see the question Are email addresses case sensitive? on Stack Overflow.

Improve this answer
4

Checking for case sensitivity itself isn't a bug in my opinion.

I'd consider it a bug, if the user doesn't get informed about the username being case sensitive. Otherwise one may wonder, why he sometimes can log in fine (Username1) and sometimes gets an error message (username1). In other cases the case-sensitivity is used to add an extra (but very thin) layer to the security.

For usability reasons, if a username is case sensitive it shouldn't be allowed to create accounts with the same name but different capitalization. This part I'd definitely see as a bug.

Improve this answer
2
  • Case sensitivity adds more than a very thin layer to security. It expands the possible entries significantly, and consequently makes a brute-force attack more difficult.
    – Joe Strazzere
    Nov 26, 2015 at 16:46
  • I absolutly agree with you in this point, but I mean overall extra security is very weak, since the username is typed in plain text, stored in plain text and isn't treated with the same caution as passwords (IMHO).
    – print x div 0
    Nov 26, 2015 at 20:52
3

I'd consider this as a matter of usability/UX. Most services I know use case-insensitive logins, and most people I know use to blame services with case-sensitive logins.

So, I'd say you should check the requirements, and, depending on the result, consult with BA/PO/PM, or whoever you have on the project, and ask him a) if anyone ever thought about login case-sensitivity and b) which option would be correct.

If requirements say it should be case-sensitive, you can also talk to your manager, ask him why he thinks it should be so and share your opinion on the matter.

Improve this answer
1
  • 1
    +1 for "most people I know blame services with case-sensitive logins." The worst systems are the ones that take a password you didn't create using their system such as your domain password (case-insensitive when you use it most places, like logging into your computer), and then arbitrarily decide that you have to enter it in their system as all uppercase or lowercase.
    – c32hedge
    Nov 2, 2017 at 20:03
2

There is no standard rule. Every application decides how to handle user names and whether case sensitivity is needed/wanted.

If your application is supposed to be case-sensitive and isn't, that's a bug. If it's not supposed to be case-sensitive and is, that's a bug.

Improve this answer
1

In case of username it isn't case-sensitive so user2 = useR2 = USER2 but in password case those are 3 different passwords because password will be encrypted.

Improve this answer
2
  • My question is that should I consider this bug or not? If I creates three accounts using following: user2 | useR2 | USER2
    – Muhammad Ali Khamis
    Oct 13, 2015 at 11:14
  • yes it is a bug @user1837530
    – A.Mo5tar
    Oct 13, 2015 at 11:26
1

I agree with @Niels. This cannot be considered as a bug, solely on the basis of being able to create accounts with different set of upper case letters. You should refer to the requirements, to see if it specifically distinguishes between upper case and lower case in case of account creation.

There is no rule to check in this scenario. For Gmail allows you to log in using USERNAME@gmail.com as well as username@gmail.com. It can't be considered a bug.

Improve this answer
1
  • it is a bug. Google won't let you create username and USERNAME both.
    – Mohan
    Mar 20, 2020 at 14:19
1

From a UX perspective usernames should NEVER be case sensitive. The marginal gains against brute force attacks do not offset the added UX complexity to the point where a developer cannot QA against the possible mistakes a user can make.

Case in point is the reason that I even searched for and found this discussion thread. I am working with Axis cameras which like many IP cameras is basically an embedded web server. These devices allow for multiple accounts one of which we create for our service folks. Out of typing habit I accidentally created a number of these accounts with an initial cap. I received no warning that usernames are case sensitive.

When the service person could not login I realized that they use the all lowercase version of the username. No problem, I think, just an annoyance. But when I try to delete the "Username" and create the "username" I am met with a user already exists error even though the user is not actually listed. I can add a user with the case sensitive version just fine but to add the lower case version I have to reset the device back to factory defaults to clear out the bad entry in the user table.

For this and many other reasons, Windows usernames are case insensitive and this is why ALL COTS usernames should be case insensitive. If your requirements specify case sensitive users or do not specify user case sensitivity at all, then your requirements are likely wrong and professionally speaking, speak up. If there is a clear justification for a locally developed solution to have case sensitive usernames then be prepared to significant additional testing and user support costs.

Fortunately I only did this on 10 cameras and not all 2000 so I only have a few hours of extra work and service gaps on the 10 cameras that need defaulting but I could just as easily have used the vendor tools to create the capital Username and then I would be having to default our entire plant.

There is NO real upside to case sensitive usernames that I can see and some huge downsides with regard to additional bug testing and user dissatisfaction when the inevitable bugs hit the windshield of life.

Improve this answer
1

Depends on the use case. However, if public usernames allow case, you can have someone impersonate a well-known user by just capitalizing one or more letters.

The username 'president' look like 'presIdent' or 'President' or 'presidenT'.

I would recommend discussing this with the product owner and advocating for case-insensitive usernames, with case-sensitive passwords.

Since passwords are personal and not displayed, case allows for more combinations and permutations.

Improve this answer
0

I find case-sensitivity in passwords to be a standard feature in most of the major sites that I use.

Indeed in many of them the password requirements frequently include "both an upper and lower case letter" and for that to work obviously the password must be case-sensitive itself.

Improve this answer
-1

I believe it should depend on the situation. Large external websites should be case insensitive like for instance Gmail. But if the web app or application was a internal app used just by a certain company then it should be case sensitive.

Improve this answer
2
  • Do you have any source or data to back up this claim / opinion?
    – corsiKa ♦
    Nov 2, 2017 at 23:29
  • Well from personal observation. Obviously email sites like gmail and yahoo are case insensitive as well as Amazon. Most of the places that I have worked at who had internal web apps or other apps that required usernames were case sensitive. One of the big companies I worked for was Dell. Also another thing to think about certain languages other than English have oddities when it comes to being upper and lower case. For instance Turkey it's would be harder to make a username case insensitive. Look here for details on that: stackoverflow.com/questions/234591/upper-vs-lower-case
    – ashlar64
    Nov 6, 2017 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.