Use Ip Addresses Not Usernames

WardsWiki, like so many other excellent things in this world, was designed for a more trusting and responsible age. It is possible for any person to trivially assume any UserName.

One suggested way to provide some assurance of your identity, is to expose an IP address by simply not setting a UserName. This still has flaws, since many users may share the same IP address (by being behind a NAT gateway or a proxy), and a single user may have many different IP addressess (by having a dynamically assigned IP address). Still, it is better than the status quo.

EditHint: RecentPosts means that users' IP addresses are always available. This page needs to be rewritten or refactored into another page.

Another possibility would be to make user names optional by putting them in brackets after the IP address, or vice versa.

It has been suggested to hash the first three octets of an IP address to something --- the idea is that no link between the user and the change is provided, even though the problem pointed out above (NAT) still exists. However, when doing this it would be possible to find the original IP by brute force (there aren't that many) unless the hash-function is kept secret. This would probably be overkill. Furthermore, not considering the last octet would also make identity collisions more frequent.

It could also be argued that the entire purpose of exposing an IP address (in any form - hashed or otherwise) is indeed to provide a link between the contribution and the user. This may ultimately be the only way to get users to take responsibility for their actions.

The idea is to have a modicum of non-forgeability and traceability. We don't need to expose actual IP addresses because that's a security breach.

[Is that the idea? If you want those things, why have a "modicum" implemented with some kludge? Why not go the whole way and have secure usernames with passwords and the capacity to contribute things unchangeable by others? Then it is not the Wiki way anymore, but that is where you are heading]

"Going the whole way" means using capabilities and objects to separate editing functions into appending, deleting, rearranging and editing individual paragraphs in individual pages in arbitrary page groups. It's entirely possible to build a secure open wiki. So don't give me this dumb slippery slope argument about how security is a bad thing, or how one imperfect security scheme would inevitably lead to another just as imperfect security scheme.

The user name scheme was specifically designed to be obviously untrustworthy so that the words in this site would be left to stand on their own. If you find words here that are wrong, silly or mean, please remove them.

See my note at the top of UserName. -- SunirShah

CategoryAddress