Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?

Question

I don't know why do we authenticate by prompting the user to enter both username and password. In my mental model, prompting password only suffices.

The reason is as follows:

Assume there are x valid characters to use.

Case 1 (prompting username and password)

Let the length of username and password be n/2 characters each. Since the username is exposed to the public, the probability of success to break the password is one over x^(n/2).

Case 2 (prompting password only)

Let the length of the password be n characters. The probability of success to break the password is one over x^n.

Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?

Edit 1

For case 1: the username is unique.

For case 2: the password is unique.

Answer 1

I think the issue is in requiring passwords to be unique. If I entered my desired password, and you told me I can't use it, it's already in use, then I know that I can log in to a random persons account with the password that I would have wanted.

So, you need a username, which is unique, and can be known to everyone. Then you have a personal password, which is not necessarily unique, making even harder to guess.

While you are at it, hash and salt that password.

Answer 2

There are already good answers here, but the simple, basic concept is still missing:

Identification and Authentication are not the same thing.

Simply put, these are two separate requirements, and should not be mixed up.
A username provides for identification, and a password allows you to verify that claimed identity (i.e. authentication).

Answer 3

Both the user and the administrator benefit from a username, typically unique, that is not a secret, which they can freely use to refer to the account. If the username is not unique, it can be associated with an email address or other unique contact id. This way a user can reset their password and get a new one, or change their password without changing their account.

Besides that, as noted by others, requiring just a unique password is also problematic when it is the only identifier and there is a collision.

Answer 4

Still cant comment :(

Your probabilities of finding a password are definitely wrong.

example:

you have 8 users & each password is 64 bits long (standard 8 chars, not salted in any way).

For case two:

An attacker will have to run his breaking the password algorithm only once to get all 8 users (total work at worst = 64 bits, 32 bits on average)

For case one:

To break all passwords an attacker will have to run his algorithm 8 times (once for each user), which is obviously more work(e.g. total work at worst = 67 bits, 33-34 bits on average)

Probability for breaking the password should be:

For case one:

1/(2^bitsUsedForPassword)

For case two:

numberOfUsers/(2^bitsUsedForPassword)

therefore the second case has more of a chance of getting the password, if there more then one users.

Answer 5

The point of the username is to identify the user. If you only ask for a password, multiple people will (sadly) have the password 123456 or password. How do you identify now, which user with that password is trying to log in? That's why there is also a username.

And since the password shouldn't be saved in plain text, you shouldn't check that the password is unique.

The other point that you miss in case 2: I just need to find a password that someone used, and not who actually used it. So if one person uses the password 123456, I only have to know that and can log in. If there is also a username, the password alone doesn't log one in successfully.

Answer 6

Having a username and a password is definitely more secure. Suppose your site has one million users:

• If you use just a password, then an attacker only has to guess one of the million valid passwords, to break into the site.

• If you use a username and a password, then the attacker has to come up with a valid username and the correct password for that username (not just any password on the site). That's a lot harder for the attacker.

Requiring both a username and a password provides much better security.

Example: Suppose we assume that each password is chosen uniformly at random from a set of one billion possibilities, e.g., it is a random 9-digit number. (Yeah, I know that's an unrealistic assumption, so this example will be a simplification, but the similar results apply to more realistic assumptions.)

• If the site only requires a valid password to log in, then an attacker who enters random 9-digit numbers will manage to get into the site after about 1000 tries, on average.

• If the site requires a valid username and its corresponding password to log in, then even assuming the attacker knows everyone's username, the attacker will have to try about 1,000,000,000 (one billion) times before getting into the site, on average. (Actually, half of that, but whatever.)

You can see that the difference in security is dramatic.

In addition, @Justin C's and @nealmcb's comments provide additional, orthogonal reasons to require both a username and password. Any one of these reasons would be sufficient; taken together, the case for requiring both a username and a password is that much stronger.

Answer 7

In theory @Sigtran is correct that having a username is always better, by a general rule the more obfuscation the more security :) In implementation, in situations where you don't need UUID or specific user privileges, you really don't need a username (something like a general repository that multiple people are accessing). In those scenarios, requiring a lengthy and complex password (alphanumeric + special chars) and then salting it is the way to go.

Answer 8

Or you can bypass the entire argument by using Open ID. All the user needs is a login ID or URL and the rest is taken care of by the provider. :)