Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security?
This is assuming that adversaries aren't aware of what the username may be, eg. a remote terminal login.
A harder to guess username adds to the security if it's kept secret.
The problems are
Usernames are often not kept especially secret. On most systems allowing multiple users to log in, any user can view the list of valid users. On systems that run mailservers, the mailserver can effectively be used to check if a username might be valid as most mailservers will accept mail for any local user. Various programs may include your username by default in outgoing traffic when they connect to servers. New user signup forms or password recovery forms may allow an attacker to check if a username is taken.
Usernames are often harder to change than passwords.
So when adding additional complexity to your login credentials, it's best to get into the habit of putting that extra complexity in the password rather than the username.
No. A username is not supposed to be kept secret and thusly won't be. A username is a public ID. Relying on it for security is not smart.
It has a little positive impact, but you can not rely on it. And this little impact doesn't worth for having a complex username. Systems are not designed to keep usernames secret, so keeping it secret will be too hard.
It's about obscurity not security.
There is one point I find useful not mentioned by other answers so far. Keeping your usernames random and different between different sites makes it harder for an outsider to connect your activities between various sites. Instead of googling for your username, someone wanting to track your activities will have to use other means, like tracking IP addresses you use, to correlate your activities between different sites that have public usernames—making, let say, harassment, more difficult.
Yes, increasing the complexity of a username will improve security overall. It's the combination of username and password that matters from a security point of view, so anything you do to make that combination more difficult to guess, will help.
Some services will give affirmative feedback for a correctly guessed username, even if the password then fails. Having a confirmed username is one extra bit of information a hacker should not have.
Yes, there is a significant addition to the security in the case you describe. In fact, many system disable logins for accounts with well-known names, like root or guest exactly for this reason: the attacker will have to acquire a valid username before starting the actual attack.
Of course, there are other reasons to disable root login in particular, but a predictable username is part of the problem.
Just like all Security through Obscurity techniques, this would add some security but is not reliable security.
If doing this has no additional costs and does not impact the bizness, it is a nice little addition that could cost some time to attackers but that will not reliably prevent anything.
An analogy would be to build a house in the middle of a desert - it is hard to find. But you still want the house to be protected.
