4

I seen this question: Does username length/complexity positively impact security? which got me thinking about usernames/passwords from a developer-aspect.

If a developer for an application were to separate the user's 'username' (what they login with) from their 'display name' (what other users see) and add the ability for the user to change their 'username', would this necessarily increase security?

I had a few thoughts as to why it might help security that I'm not certain are valid.

  • If an attack is targeted it might help by adding another layer? Assuming the user keeps their login-name secret and there are rules to prevent it from being the same as your display name.
  • If your display name is separate from your username then you might be able to make it an option as a developer to change your username to add security similar to changing your password.
  • The secret login-name seems to behave like a second password, with the difference, that the login-name wont most likely be encrypted. So this would indeed add a little bit of security. The question is, at which cost? – hamena314 Mar 24 '16 at 15:40
  • Also isnt this already common practice to a certain degree? I.e. I log into website www.bagelsAreDelicious.com with my email GandalfTheWizard@gmail.com and on the websites forum my avatar has the name I am Saruman .... when the website does not show the users email and display- / loginname have(!) to be different: We have the scheme you suggested. – hamena314 Mar 24 '16 at 15:47
  • Yeah, I guess I was asking more about the ability to change your username (that you login with). I know the changing display name is common and having them separate is semi-common (especially with forums and games) but I wasn't really sure if adding the ability to change your username adding any security. – Shelby115 Mar 24 '16 at 15:48
  • When the username is your email, that you login with, you can change that on several websites. I.e. I log in with GandalfTheWizard@gmail.com, click on "change my email" and input HobbitsAreDelicious@AOL.com, I have effectively changed my login-name, with which I will login next time. – hamena314 Mar 24 '16 at 15:53
4

Not more secure and maybe less due to user expectations and behavior.

What you are proposing is no different than requiring a user to split their password into two pieces, entering one half in the username field and one in the password field. So it can't be better than having the combined string as a password.

But users will not likely treat their username as a secret. Nor will password managers. And maybe not even you and your developers. So half the user's password will be insecure.

There are well-known patterns for working with passwords and authentication. It is usually best to stay with them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.