Default user names to avoid

Question

Following this answer on a question about fake users, is there a general list of users which would be deemed to be a common username?

The part of the linked answer I'm referring to is

Don't use a common username, such as admin. This is likely to get hit by passive multi-host attacks just scanning

Off the top of my head I can come up with:

• admin
• administrator
• root

It's a lot easier to get lists of default passwords because these mainly come with hardware, and naturally using those is a bad idea; but what about commonly used usernames which we should be avoiding?

I'm thinking mainly along the lines of new sites/services which require logon, but this could easily extend to hardware too.

EDIT: I am developing some applications/services which will need default admin users and am looking to minimise the risk of those being accessed, even with strong passwords.

Answer 1

TL;DR Don't worry about your username if it isn't the default admin username, worry more about securing your passwords with strong, unique passwords.

There isn't a good way to answer this question that can be fully satisfactory, because there are too many usernames.

Just like Matthew's suggestion to check out https://github.com/maryrosecook/commonusernames/blob/master/usernames.txt, and you can also check out https://sg.answers.yahoo.com/question/index?qid=20111101181037AANzt6G to get another list.

There are many lists like that online, so finding what people expect a common username to be is easy. The problem I see is how that person worded that answer you quoted. Really common usernames aren't the problem, it's default usernames that can be changed.

Think of it like this, your system is only as secure as you are. So if you use admin as a username for example, then it's easier to guess an administrator's username. If you use a strong, unique password for each website, then it doesn't matter if they know your username (which can still be easy to find). If you use a weak and/or the same password for each website, then you will eventually have a problem where they use a dictionary attack of leaked passwords and eventually get in.

So focus more on strong/unique passwords rather than common usernames, because that's a very small piece of the problem. And depending on the system, it could be very easy to find valid usernames (e.g. email addresses, abbreviations of lastname firstname, etc.). Also to give you an idea how easy it is to get someone's username, if you go to any website that lets you register, it will tell you what you need for a username. If it says put in your email, then you know it's someone's email address, but if it says to enter one on your own, it's most likely a common username they use for other websites too. Now just because you don't know what other people choose for their username, that doesn't mean it isn't easy to get. When hackers get lists of usernames and passwords, they will get it from sites with weaker security like forums or third party sites. After they have a list, they can dictionary attack sites like banks, video games, or even your facebook to get what they want. This is why you want to use unique passwords for every website you go to, so if that does happen they can't get into your email and reset every password you have (that they can find).

After all that if you still want a list, check out the links or just google search it with different keywords like common or popular passwords.

Answer 2

One common mistake is to associate a user name with a well-known piece of information such as the user's email address. While this makes it easier for the user and eliminates support issues with password reset features, etc.; it is far easier to start guessing passwords than to have to guess user names and passwords. A pretty comprehensive set of authentication best practices can be found on OWASP https://owasp.org/index.php/Authentication_Cheat_Sheet Implement as many of these as you can when applicable.