Login should automatically try lowercase usernames if the first attempt at login fails

[ara4n]

No description provided.

[turt2live]

Related discussion (UX on doing this for groups): #5434

[lampholder]

Is there scope for additional confusion here? Could two people both think they have "@-Bob:matrix.org" whereas one of those is actually getting silently bounced to @-bob:matrix.org each time?

[ara4n]

@lampholder i think you may need to phrase that again without binging github’s @bob...

[ara4n]

see also #5445

[ara4n]

eitherway, no: the point is that Bob would always go to Bob and bob would always log in as bob if they are on a legacy acct with clashing case sensitivity

[lampholder]

Sorry Bob :P

@ara4n if I understand correctly, I don't think your response addresses my concern.

• Alpha Bob registers @Bob:matrix.org with password s3cr3t
• Beta Bob register @bob:matrix.org with password sh4d0w
• Beta Bob forgets his mxid is @bob and thinks it is @Bob - he logs into riot.im with username @Bob:matrix.org and password sh4d0w
• Riot.im tries the upper case Bob and sh4d0w combo, but it fails
• Riot.im falls back to the lower case bob and sh4d0w` and succeeds

Problems:

• Beta Bob doesn't get his understanding of what his mxid is reinforced. He might think he's registered @Bob, because that's what he always types. This could cause confusion down the line (when he asks people to invite him to a room/direct chat/group)
• Worse: if Alpha Bob and Beta Bob have the same password (either because they're the same person who got confused registering two accounts, or because they both have a pet dog called Shadow), then they might log in as each other by horrible mistake.

[turt2live]

This is probably better implemented on the homeserver as a check. It should know if Bob and bob exist, and handle the case accordingly. Presumably if it gets Bob and Bob isn't a user, it can try bob.

Handling it on the client side seems risky as it may result in the wrong account (as mentioned) or require existing endpoints to provide more information about who is and isn't a user (leading to a possible vector for spam).