{"action":"closed","issue":{"url":"https://api.github.com/repos/irungentoo/toxcore/issues/1430","labels_url":"https://api.github.com/repos/irungentoo/toxcore/issues/1430/labels{/name}","comments_url":"https://api.github.com/repos/irungentoo/toxcore/issues/1430/comments","events_url":"https://api.github.com/repos/irungentoo/toxcore/issues/1430/events","html_url":"https://github.com/irungentoo/toxcore/issues/1430","id":106894137,"number":1430,"title":"Display names in client controlled by remote user","user":{"login":"TheElf","id":4720546,"avatar_url":"https://avatars.githubusercontent.com/u/4720546?v=3","gravatar_id":"","url":"https://api.github.com/users/TheElf","html_url":"https://github.com/TheElf","followers_url":"https://api.github.com/users/TheElf/followers","following_url":"https://api.github.com/users/TheElf/following{/other_user}","gists_url":"https://api.github.com/users/TheElf/gists{/gist_id}","starred_url":"https://api.github.com/users/TheElf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TheElf/subscriptions","organizations_url":"https://api.github.com/users/TheElf/orgs","repos_url":"https://api.github.com/users/TheElf/repos","events_url":"https://api.github.com/users/TheElf/events{/privacy}","received_events_url":"https://api.github.com/users/TheElf/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-17T01:16:24Z","updated_at":"2015-09-17T15:27:11Z","closed_at":"2015-09-17T15:27:11Z","body":"A small security concern here,\r\n\r\nWhile users will always have a unique Tox Id, it is worth noting that as it stands now, a user's name is controlled by the user themselves.\r\n\r\nThis means that a user may change their name unexpectedly causing confusion. The only current defense for this is to only add friends that you trust not to do this, but I think a more elegant way to deal with this is to allow users to add nicknames to contacts that are controlled by them. This removes the possibility of impersonation.\r\n\r\nIf our goal is an accessible and secure option, I think that users should by default freeze display names and maybe prompt them to allow renaming when a user wants to change the name. "}}