On a website in which all of users' information (line Username, Email and Phone Number) are stored safe and hidden (from other users and public world), is it bad practice to accept email address or phone number or username itself as username with a password and a Captcha?
On this question, it has been told that main risk is that email might be used with same password so compromising the account may lead to getting into user's email account. If user's email is being displayed on his/her resisted profile, it doesn't matter what method is used by hacker to crack the account, s/he'll know the email and password by the way.
If those information kept secure and hidden, is it bad practice to use this kind of implementation? If so, what are the cons and concerns?