Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
    Post Closed as "duplicate" by PwdRsch, Steffen Ullrich, Xander, NULLZ, Matthew of
3 added 530 characters in body
source | link

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why this dogma has continued for so long.

If an authentication system depends on a secret password to authenticate, wouldn't logic dictate that a secret username would be twice as secure?

My opinion is that, if a username is treated by both the user and authentication system as a password then, by definition, it IS a password; the first in a series of two.

What caused this confusion and frustration is a question I posted elsewhere. I asked if it were possible to separate an email user's address from the username during authentication. The logic being that if a hacker needed to brute the username along with the password for a targeted attack, it could take twice the effort to succeed.

What logic could you possibly provide to prove that a username is not a password if it is treated as such (aka a secret)?

This question concerns only this specific attack vector and not any other related ones like social engineering, system vulnerabilities, etc.

UPDATE: This question is not a duplicate of another question because it asks a completely different question: "would like to know why this dogma has continued for so long" in the first paragraph. The other questions are only included to provide support for the main one and to offer the Answer-er a vehicle for supporting their answer.

UPDATE: I get it - with an authentication system that does not intend to keep a username secret (ie reveals if a username is valid or not) is not more secure than a password of double length). My question targets an authentication system that DOES treat a username as a 1st password (ie does not reveal the validity of a username).

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why this dogma has continued for so long.

If an authentication system depends on a secret password to authenticate, wouldn't logic dictate that a secret username would be twice as secure?

My opinion is that, if a username is treated by both the user and authentication system as a password then, by definition, it IS a password; the first in a series of two.

What caused this confusion and frustration is a question I posted elsewhere. I asked if it were possible to separate an email user's address from the username during authentication. The logic being that if a hacker needed to brute the username along with the password for a targeted attack, it could take twice the effort to succeed.

What logic could you possibly provide to prove that a username is not a password if it is treated as such (aka a secret)?

This question concerns only this specific attack vector and not any other related ones like social engineering, system vulnerabilities, etc.

UPDATE: This question is not a duplicate of another question because it asks a completely different question: "would like to know why this dogma has continued for so long" in the first paragraph. The other questions are only included to provide support for the main one and to offer the Answer-er a vehicle for supporting their answer.

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why this dogma has continued for so long.

If an authentication system depends on a secret password to authenticate, wouldn't logic dictate that a secret username would be twice as secure?

My opinion is that, if a username is treated by both the user and authentication system as a password then, by definition, it IS a password; the first in a series of two.

What caused this confusion and frustration is a question I posted elsewhere. I asked if it were possible to separate an email user's address from the username during authentication. The logic being that if a hacker needed to brute the username along with the password for a targeted attack, it could take twice the effort to succeed.

What logic could you possibly provide to prove that a username is not a password if it is treated as such (aka a secret)?

This question concerns only this specific attack vector and not any other related ones like social engineering, system vulnerabilities, etc.

UPDATE: This question is not a duplicate of another question because it asks a completely different question: "would like to know why this dogma has continued for so long" in the first paragraph. The other questions are only included to provide support for the main one and to offer the Answer-er a vehicle for supporting their answer.

UPDATE: I get it - with an authentication system that does not intend to keep a username secret (ie reveals if a username is valid or not) is not more secure than a password of double length). My question targets an authentication system that DOES treat a username as a 1st password (ie does not reveal the validity of a username).

2 Explained that I am asking a completely different question than the proposed duplicate
source | link

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why this dogma has continued for so long.

If an authentication system depends on a secret password to authenticate, wouldn't logic dictate that a secret username would be twice as secure?

My opinion is that, if a username is treated by both the user and authentication system as a password then, by definition, it IS a password; the first in a series of two.

What caused this confusion and frustration is a question I posted elsewhere. I asked if it were possible to separate an email user's address from the username during authentication. The logic being that if a hacker needed to brute the username along with the password for a targeted attack, it could take twice the effort to succeed.

What logic could you possibly provide to prove that a username is not a password if it is treated as such (aka a secret)?

This question concerns only this specific attack vector and not any other related ones like social engineering, system vulnerabilities, etc.

UPDATE: This question is not a duplicate of another question because it asks a completely different question: "would like to know why this dogma has continued for so long" in the first paragraph. The other questions are only included to provide support for the main one and to offer the Answer-er a vehicle for supporting their answer.

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why this dogma has continued for so long.

If an authentication system depends on a secret password to authenticate, wouldn't logic dictate that a secret username would be twice as secure?

My opinion is that, if a username is treated by both the user and authentication system as a password then, by definition, it IS a password; the first in a series of two.

What caused this confusion and frustration is a question I posted elsewhere. I asked if it were possible to separate an email user's address from the username during authentication. The logic being that if a hacker needed to brute the username along with the password for a targeted attack, it could take twice the effort to succeed.

What logic could you possibly provide to prove that a username is not a password if it is treated as such (aka a secret)?

This question concerns only this specific attack vector and not any other related ones like social engineering, system vulnerabilities, etc.

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why this dogma has continued for so long.

If an authentication system depends on a secret password to authenticate, wouldn't logic dictate that a secret username would be twice as secure?

My opinion is that, if a username is treated by both the user and authentication system as a password then, by definition, it IS a password; the first in a series of two.

What caused this confusion and frustration is a question I posted elsewhere. I asked if it were possible to separate an email user's address from the username during authentication. The logic being that if a hacker needed to brute the username along with the password for a targeted attack, it could take twice the effort to succeed.

What logic could you possibly provide to prove that a username is not a password if it is treated as such (aka a secret)?

This question concerns only this specific attack vector and not any other related ones like social engineering, system vulnerabilities, etc.

UPDATE: This question is not a duplicate of another question because it asks a completely different question: "would like to know why this dogma has continued for so long" in the first paragraph. The other questions are only included to provide support for the main one and to offer the Answer-er a vehicle for supporting their answer.

1
source | link

Authentication System Usernames

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why this dogma has continued for so long.

If an authentication system depends on a secret password to authenticate, wouldn't logic dictate that a secret username would be twice as secure?

My opinion is that, if a username is treated by both the user and authentication system as a password then, by definition, it IS a password; the first in a series of two.

What caused this confusion and frustration is a question I posted elsewhere. I asked if it were possible to separate an email user's address from the username during authentication. The logic being that if a hacker needed to brute the username along with the password for a targeted attack, it could take twice the effort to succeed.

What logic could you possibly provide to prove that a username is not a password if it is treated as such (aka a secret)?

This question concerns only this specific attack vector and not any other related ones like social engineering, system vulnerabilities, etc.