Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Is there any added security benefit to username complexity requirements?

Are there any good security reasons for a web application to limit the length of a username?

If there is, what should be the minimum and maximum length allowed?

share|improve this question

marked as duplicate by Terry Chia, AviD Aug 12 '12 at 9:42

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

@AndreyBotalov Thanks for that, didn't come across it in my search. Voted to close my question, we'll wait for Rory or AviD to close it eh. – Terry Chia Aug 11 '12 at 10:33

There is no good security reason to limit the length of a username. The only reason to limit the length of the username is so it doesn't stretch parts of the website when displayed, but even that can be solved differently.

share|improve this answer
That and database efficiency, limit the field in the database to a CHAR of a particular length tends to be more efficient at nor storing excessive information and even VARCHAR is defined with a maximum length (mysql allows developers to define a length upto 65,535 bytes). But with price per MB being so low these days, even that isn't as relevant any more as it used to be. – ewanm89 Aug 11 '12 at 10:19

If it's email, up to 254 characters has to be handled to be in line with the rest. If it's username, PCI limits to 16, but I think 32 would be just fine.

The limit is to prevent actually bugs, for example, inserting too big key (more then sql index), making page render differently, as well there might be limits imposed by hardware devices / other systems were the length cannot be longer, so 32 characters as on Linux should be fine, at least for me.

share|improve this answer
I'm lost. What does the Payment Card Industry or Peripheral Component Interconnect interface have to do with e-mail? Or, is there another "PCI" I'm not thinking of? – Iszi Aug 31 '12 at 16:07

It is important to remember that in some environments, restricting a username may also lead to it's own security risk.

When bruteforcing a web application login, where no usernames or passwords are known, it often makes more sense to take a number of common passwords and attempt to guess usernames. The theory is that given X number of users of a web application, it is more than likely that a number of those users will have week passwords. This kind of bruteforce also helps to get around password lockout policies.

Now of course there is a trade off between security and usability, the last thing that you want if to allow every character and find that most of your time is spent answering customer support requests for lost usernames, but when considering restrictions, I find it best to be as unrestrictive as possible.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.