Spoofing someone in Slack is terrifyingly easy

It is not the display name that has to be unique, it's the handle. We have the same issue with email, you get a "name" and an "email address". If the name reads "Bill Gates" but the email address reads bad_guy@hotmail.com then you know it's problematic.

Is it trivial for the new user? Probably not. That is why organizations have training courses, where they tell the employees: Pay attention to the important parts (aka the handle, not the name)

I don’t think it’s a problem. It’s certainly not a problem unique to Slack.

Consider “internationalized domain names”, which are implemented via Punycode. The following URL does not go to Gmail: mail.goοgle.com

Note that this URL isn’t resolvable as of when I submitted this comment. Assuming no one has bought the domain and hosted something malicious there since then, you should be able to paste it into your browser to see what I’m talking about.

Depending on your font settings, that probably looks indistinguishable from the correct URL. Here it is again, followed by the correct URL:

mail.goοgle.com

mail.google.com

I created the above by substituting the first “o” with a lower-case Greek omicron (ο, Unicode U+03BF). The URL bar in your browser may or may not show the ASCII version - mail.xn--gogle-sce.com - once you navigate to it.

I suppose my point here is that if the domain name system in use by the entire Internet doesn’t consider this to be a bug that must be squashed, then I wouldn’t consider Slack’s lack of a uniqueness constraint for display names to be an issue :)

ETA: HN converts non-ASCII characters in URLs to Punycode upon submission. I had to omit the protocol portion of the URL to get it to display as entered. Good job, @dang :)

Hmmm not sure if this is an actual problem or bad configuration. Might be based on Org settings, my org locks this down since it uses ldap as source of truth for display names.

Your example kind of shows why this is needed, in a large org 2 "John Smith"s might happen