Astra
c39011e542
Lower the username floor to 3 characters on the admin-only write path (account/channel set-username), separate from the 5-character self-service minimum, since a deliberately short operator handle isn't the squatting the higher floor guards against. Channel admin username assignment previously had no length/format validation at all; this adds it. Also adds three reference docs: the client's deep-link (tg://, owpg://) surface, an OpenAPI 3.1 spec for both admin HTTP APIs (built from source, not the stale docs/admin-panel-api.en.md), and a starter reserved-username blocklist.
73 lines
4.2 KiB
Markdown
73 lines
4.2 KiB
Markdown
# Suggested reserved usernames
|
|
|
|
A starter blocklist for `TELESRV_RESERVED_USERNAMES` (see
|
|
`internal/config/config.go`, `ReservedUsernames`), beyond the shipped
|
|
default (`owpengram, admin, administrator, support, staff, moderator,
|
|
official, root, owner`). The mechanism blocks these, case-insensitively,
|
|
from self-service `account.updateUsername` / `channels.updateUsername` —
|
|
an operator can still assign one deliberately from the admin panel, since
|
|
that's not the squatting this exists to stop.
|
|
|
|
Organized by why each entry is worth blocking. Trim or extend per your own
|
|
deployment — none of this is enforced by the server itself, it's just a
|
|
starting list to feed into the env var.
|
|
|
|
## Official-sounding / staff-impersonation
|
|
|
|
Names that would read as "this account speaks for the operator" if a
|
|
random user grabbed them.
|
|
|
|
```text
|
|
telegram, telegramofficial, telegramsupport, telegramteam, telegramstaff,
|
|
telegramhq, telegramnews, telegramnotifications, telegramverify, telegrambot,
|
|
telegramservice, security, securityteam, verify, verification, verified,
|
|
helpdesk, helpcenter, customerservice, customersupport, servicedesk, service,
|
|
system, systemmessage, systembot, notifications, notification, alerts,
|
|
announcements, announcement, newsroom, press, pressoffice, spambot, antispam,
|
|
abuse, abusereport, reports, legal, compliance, billing, payments, finance,
|
|
accounts, accountservices, recovery, unlock, restore, backup, headquarters,
|
|
staffteam, modteam, moderation, moderators, founder, cofounder, management
|
|
```
|
|
|
|
## Founders / executives (real people this server is not affiliated with)
|
|
|
|
Blocks an account from presenting as Telegram's actual leadership.
|
|
|
|
```text
|
|
durov, pavel, paveldurov, pdurov, nikolai, nikolaidurov, ndurov, durovpavel,
|
|
telegramceo, telegramfounder
|
|
```
|
|
|
|
## Crypto / scam-bait
|
|
|
|
The classic "free crypto giveaway" impersonation targets — official-sounding
|
|
project/exchange names, plus generic scam-pattern handles.
|
|
|
|
```text
|
|
bitcoin, ethereum, toncoin, tonwallet, tonfoundation, crypto, cryptowallet,
|
|
wallet, airdrop, giveaway, bonus, freecoins, claim, claimnow, binance,
|
|
coinbase, kraken, metamask, trustwallet, ledger, opensea, uniswap, elonmusk,
|
|
tesla, spacex, cryptosupport, walletsupport, tonsupport, binancesupport,
|
|
investment, investmentteam, forextrading, tradingbot, signals, cryptosignals
|
|
```
|
|
|
|
## Suggested env var
|
|
|
|
Comma-separated, matching `envListOr`'s parsing:
|
|
|
|
```bash
|
|
TELESRV_RESERVED_USERNAMES=owpengram,admin,administrator,support,staff,moderator,official,root,owner,telegram,telegramofficial,telegramsupport,telegramteam,telegramstaff,telegramhq,telegramnews,telegramnotifications,telegramverify,telegrambot,telegramservice,security,securityteam,verify,verification,verified,helpdesk,helpcenter,customerservice,customersupport,servicedesk,service,system,systemmessage,systembot,notifications,notification,alerts,announcements,announcement,newsroom,press,pressoffice,spambot,antispam,abuse,abusereport,reports,legal,compliance,billing,payments,finance,accounts,accountservices,recovery,unlock,restore,backup,headquarters,staffteam,modteam,moderation,moderators,founder,cofounder,management,durov,paveldurov,pdurov,nikolai,nikolaidurov,ndurov,durovpavel,telegramceo,telegramfounder,bitcoin,ethereum,toncoin,tonwallet,tonfoundation,crypto,cryptowallet,wallet,airdrop,giveaway,bonus,freecoins,claim,claimnow,binance,coinbase,kraken,metamask,trustwallet,ledger,opensea,uniswap,elonmusk,tesla,spacex,cryptosupport,walletsupport,tonsupport,binancesupport,investment,investmentteam,forextrading,tradingbot,signals,cryptosignals
|
|
```
|
|
|
|
## What this doesn't cover
|
|
|
|
- **Collectible usernames** (`internal/admin/service.go` collectible-username
|
|
actions) go through the admin panel/Admin API directly and aren't gated
|
|
by this list at all — an operator minting one bypasses it on purpose.
|
|
- **Prefix/substring squatting** (`telegram_real`, `xtelegram`, `te1egram`)
|
|
— the blocklist is an exact-match (case-insensitive) list, not a pattern
|
|
matcher, so lookalike spellings need their own entries if you want them
|
|
blocked too.
|
|
- This is a *username* blocklist only — it says nothing about display
|
|
names, bios, or profile photos, which can impersonate just as easily and
|
|
aren't restricted by `TELESRV_RESERVED_USERNAMES` at all.
|