Is "different usernames" as good as "different passwords"

Question

The answers to this question, and the associated xkcd got me wondering: if I use different account names in every service, then can I use the same hard-to-crack password in each?

I'm thinking that cross-site password hacking, a-la-xkcd, is done by a machine, not a person. So it's easy to have usernames/emails that are site dependent (for example, all email addressed to @gregories.net comes to me, so I can have [email protected] as the email for my bank). That's a lot easier to remember than a bunch of secure passwords, but if the bank gets hacked, [email protected] is not going to work anywhere else.

What's the problem with this?

Answer 1

Big data analysis means that your different usernames probably aren't as disassociated from one another as you think they are. In other words, they are likely all identifiable as yours.

But perhaps the bigger issue is that if your password is compromised in one attack, then it becomes part of a password database the attackers can use against other password databases. Regardless of your usernames, they'll still (potentially) compromise your other accounts just by virtue of already having your common password in their database.

More recent attack vectors use heuristic techniques more, and things like rainbow tables less, but still consider that if a heuristic approach has broken your password (and the lessons learned have been fed back into the password cracking algorithms), then it's going to break the same password everywhere you've used it.

You're still better off using unique passwords for each service, IMO.

Answer 2

if I use different account names in every service, then can I use the same hard-to-crack password in each?

If the account names can be associated with the same person (i.e. different forums, same style of writing, similar content etc) then it does not matter if the names are different. And, contrary to the plain text or the hashed password the usernames are often displayed to other users.

I'm thinking that cross-site password hacking, a-la-xkcd, is done by a machine, not a person.

This depends on the goals of the attacker. If the goal is to compromise as much accounts as possible then you might be right. If the goal is to steal the identity of a specific person then it does not matter much if this person uses different user names as long these can be associated with the same person.

Answer 3

You really shouldn't. The reason why? Once a password common to several accounts is cracked, getting access is just a case of finding them. Since account names are relatively public, they are less well-protected than password data. A bit of innocuous research work would then give someone access to most or all of your online activity.

Answer 4

Most common folks dont care and arent as paranoid as us about this kind of thing so they usually use the same password(or variations of it), in most services whether those are their bank accounts, email, game username, forum username, (etc you name it) and the same applies for usernames(relating to your question). This makes the general population of our planet, that has access to internet easy targets for hackers, companeis and even their own family/friends, since once you discover one password or username you can try variations of it in their other services and chaces are that you will be able to find a match.

Now going back to your question of: Is “different usernames” as good as “different passwords ?

I believe so. In this age where privacy is becoming harder and harder to get as big corporations such as google and microsoft find better ways and improve their technology to use their advertsingbots to track all our activities and throw us Ads related to our activities, the best thing we can do is make it harder for them to track us down. I believe this also applies for security purposes, if you use the same username in several websites it makes it easier for a hacker or anyone to track you down and have a full picture of all your activities on internet, most people think this is not a bad thing but it is. Also Add to the fact that this kind of phyloshopy of putitng the same username also makes it easier for your friends, family, relativies colleagues discover all that you do in the internet by the simple fact that you werent careful enough to use different usernames. Which might lead to annoying/embarassing situations depending,since those people in your real life know where they can find you in the virtual world.

For example a hacker can discover your password in X service that you use. He might try to also check if your password is the same in the Y service, since you use the same username in both, even if the passwords are different he might have already collected enough information about your tastes, desires and your other password to try similar matches. In order to not have to go through this burden the best thing you can do is use different usenrames, passwords and if possible different emails or alias to make it harder for them.

Answer 5

The simplest way that this could be broken is probably thus:

1. One of your accounts has their password broken for some reason (we can take this as read, as if that never happens then just using the same user/pass everywhere would be fine too, so this is our starting point).
2. Your hard-to-guess password gets put into a password dictionary.
3. Your (not generally considered secret, and rarely as a vital secret) username gets tried with the password dictionary, that has your password in it.

That's a lot easier to remember than a bunch of secure passwords

And yet still harder to remember than not trying to remember passwords. Still, eventually you might find yourself having to bend your naming convention for usernames to fit different services' policies, so you're going to need to use a secure password store to keep track of them. In which case, why would you keep using the same password?

Answer 6

The question here is always "what is your threat model?" It is meaningless to ask such questions without a proper context given by a threat model. Most of the time a different username is not as secure as a different password. Other times, such as spy vs. spy situations or duress situations, a different username can absolutely be effective.

In nearly all cases (at least 99%, if not more), you will find a different username is less secure than a different password because traditional security approaches assume a username is not a secret while the password is a secret. This means anyone storing, displaying or using your credentials will likely fail to sufficiently protect the information that matters.

As a specific counterexample to your claim, consider the case where an attacker has compromised a server, so they have access to the database of username/password pairs of several sites. Let's say all of them played by what are considered "good" security rules: the passwords are salted and hashed, so no plaintext passwords are available. However, usernames are available in plain text (this is very typical, because there is no reason to hash data that is not a secret). Now, consider a compromise of one of those servers that gives your full credentials, username/password:

• If you have different passwords for each server, the attacker can determine that you have accounts on the other servers, but because the passwords are still salted and hashed, they gain very little towards attacking the other servers.
• If you have different usernames for each server, the attacker simply scans down the list of users, hashing your known password with the correct salt for each user until he finds a match. He then looks to the username column, and has your "secret" username. With no more than a few minutes worth of work, he has access to both accounts.

As a note: there are tools which will assist with attacks like this even if you just make simple permutations of your passwords to keep them "unique." We as humans are not very unpredictable - we may feel we are clever shifting our fingers one spot to the right when typing a password, but many password cracking suites already include that simple shift as one of the things they test for.

Answer 7

It's easy to overestimate how interested hackers are in figuring out how 2 usernames fit. If someone really wants to, they can figure it out, but most hackers don't really care about that. To them usernames are just 1 part of a 2 part identity confirmation form, and the only reason they would care about that is if it can bring them money. Obviously, a bank would be a prime target for such a thing, something like Paypal or an e-bank. If someone can get your bank username, and your password, they can steal your money.

Because of that, having multiple usernames to choose from is a bonus. Even if they can figure out your regular username and password, if you use another username and password for your bank, they need to start from scratch. NOTE that you should still use another password, but if your username on the other sites you are using is sufficiently different from your bank username, an attacker is unlikely to make a connection between the 2.

Different usernames is just a minor hurdle to defend against targeted attacks, but it won't defend you against an attacker that just wants to compromise as many accounts as they possibly can.

Answer 8

It is very common for a site to ask for email address instead of username, that can cause problem for you, and if you are using different email that can be hard to manage.

From security point of view it is a good idea , and it can confuse those hackers who know you on social networking or any other public site and try to use your same username on bank or paypal sites,

this is part of one way hackers get username or at least what they think is going to be username.

when it comes to encryption - password are always encrypted while storing them. Username may not be encrypted or are visible on screen, so it is possible for them to hack it easily then password , for password they will need decryption algorithm even if they have hacked the data.

In anyway if you are changing one of the value and both are encrypted it is at same level for the hacker and both the fields will be at same difficulty for him to track down.