Creative usernames and Spotify account hijacking
This seems odd.  I mean, if their code was properly <i></i>modular<i></i>, they would have just one place where they "fetchUserIdByName(userName)", which returns one user ID or null if it's not used yet.<p>When a new user is created, it then gets assigned a unique user ID.   The email address is assigned to that user ID.<p>Then, if they do a password reset on user = "bigbird", it should do the exact same lookup to find the email address.<p>The security bug was not really about having an improper function to do unicode translation.  It was more about having <i></i>different functions for the same check<i></i>, simply because they were in different parts of the code.<p>Modular code is just so much better on all fronts, including security.