So, a rather unfortunate bug on the Minecraft website.

Minecraft allows you to change your name every 30 days. I was reverse engineering their API so I could use it personally.

On the username change form there are two fields: your desired username, and your password.

To protect myself from actually changing my name, I purposefully put in password123 so that it would fail. Then, I clicked "Change name" to monitor the network traffic.

Well that's when two unfortunate things combined.

#1: I used my last name to test. It's a unique word that is relatively short and very easy for me to type out of habit.

#2: That password field doesn't actually get validated.

So imagine my shock when I clicked "change username" and it WORKED.

And now my username is doxxing me for at least 30 days + the permanent name history

FUCK me