Many advice not to post email addresses on the public forum since some may try for several login attempts using some brute force attacks etc., but I notice in several websites(even in sensitive websites which deal with money) I can find that it uses email-id/username for login mechanisms and they actually display user names publicly, example website GitHub (https://github.com/login?return_to=%2Fpersonal).
My question are these websites vulnerable to a wide range of bruteforce attacks? Like using web crawlers to gather large number of usernames and brute forcing against with a single popular password.
For example "nopassword" is one of the commonly used password by many people Instead of using passwords as wordlists (common method) the attacker could use usernames which are obtained from the bots as wordlists with one single password like "nopassword"
It is narrow spectrum attack but the attacker could gain access to huge number of accounts that use popular passwords by this method. So is this a vulnerability of the websites?