Identity

Design User Identifiers to Resist Visual Spoofing

Two account identifiers can be different to software while looking almost identical to a person. That gap matters anywhere people use a displayed identifier to decide whom they are trusting: administrator consoles, collaboration tools, package registries, marketplaces, support systems, or internal approval workflows. If an application treats visual appearance as irrelevant, an attacker may be able to register an identifier that resembles a trusted account closely enough to mislead another user. The database still sees two distinct strings. The human may not.