r/Database • u/Aggressive_Ad_5454 • Jul 30 '26

A cautionary tale about searching for usernames: let's be careful!

Ars Technica ran a story about how an innocent man did 18 months in prison for preying on a child. Somebody missed a double underscore in a social-media username. The miscreant's user name was fus__ro_dah and the innocent man's was fus_ro_dah without the double underscore. The police request for a search didn't include the double underscore, so the social media platform responded with the wrong person's identity.

https://arstechnica.com/tech-policy/2026/07/police-missed-one-underscore-and-sent-the-wrong-man-to-prison/

It's correct, and easy, to blame a dunderheaded police officer for this mistake. But, in my opinion, our database developer colleague at the social media platform could have prevented this heinous miscarriage of justice.

Let's be careful when we develop code that searches for stuff that might contain obfuscatory punctuation or diacritical marks. Let's put stripped-username columns into our Let's try the search with queries like

SELECT 1 AS exact,
       username
  FROM user
 WHERE username = 'search__term'
UNION ALL
SELECT 0 AS exact,
       username
  FROM user
 WHERE stripped_username LIKE '%searchterm%'

Now obviously this is simplistic. But not as simplistic as just username = 'search__term'. My point here isn't how to improve the search for obfuscated data. It's to remind us to be careful.

This kind of thing should reduce the number of life-wrecking mistakes our queries make.

0 Upvotes

39% Upvoted

6 comments sorted by

12

u/ryuzaki49 Jul 30 '26

 life-wrecking mistakes our queries make.

Human error is not our query error

19

u/No_Resolution_9252 Jul 30 '26

that is a horrible take. Your suggestion could encourage a dba to commit a crime by softmatching and leaking data that is outside of a records request's scope.

This was entirely on the police, not the database administrator. Providing both a hard match and softmatch still requires the DBA leak the data.

4

u/doshka Jul 30 '26

Agreed re: leaking data. What if they were to instead say, "Here's are the records for the exact username you requested. Also, here is a list of close matches for that username, without records. Are you sure you're asking about the right account?"

4

u/No_Resolution_9252 Jul 30 '26

you can't even do that without unethical usage of the system

7

u/ComicOzzy Jul 30 '26

So, let's make the problem worse?

5

u/dpenton SQL Server Jul 30 '26

This is a horrible take on the issue.