Beyond "pollution", the magic string is subject to race conditions. If someone puts it in the profile, and then waits a while to register, anyone could claim that username.
Sure, it's a somewhat unlikely scenario...but pretty easy to exploit if someone forgets they have the magic string in their profile but haven't yet registered. A unique magic string per-user would be the solution to that.
That's true, but Google can find profiles with the magic string, and one could even go so far as script finding the names that haven't been registered. A unique magic string, only generated during account creation, at least means you have to crawl HN yourself, and pull out those strings via some regex (which could be thwarted by making the magic string unpredictable in length and format), and do so in a very small period of time.
I'm sure it's not really likely that any of those scenarios would happen...but it seemed an odd bit of security theater, which could at least be made a bit more secure by adding a dose of randomness.
Beyond "pollution", the magic string is subject to race conditions. If someone puts it in the profile, and then waits a while to register, anyone could claim that username.
Sure, it's a somewhat unlikely scenario...but pretty easy to exploit if someone forgets they have the magic string in their profile but haven't yet registered. A unique magic string per-user would be the solution to that.