Increased security from separating username and login name?

Question

I seen this question: Does username length/complexity positively impact security? which got me thinking about usernames/passwords from a developer-aspect.

If a developer for an application were to separate the user's 'username' (what they login with) from their 'display name' (what other users see) and add the ability for the user to change their 'username', would this necessarily increase security?

I had a few thoughts as to why it might help security that I'm not certain are valid.

• If an attack is targeted it might help by adding another layer? Assuming the user keeps their login-name secret and there are rules to prevent it from being the same as your display name.
• If your display name is separate from your username then you might be able to make it an option as a developer to change your username to add security similar to changing your password.

Answer 1

Not more secure and maybe less due to user expectations and behavior.

What you are proposing is no different than requiring a user to split their password into two pieces, entering one half in the username field and one in the password field. So it can't be better than having the combined string as a password.

But users will not likely treat their username as a secret. Nor will password managers. And maybe not even you and your developers. So half the user's password will be insecure.

There are well-known patterns for working with passwords and authentication. It is usually best to stay with them.