44

Why use usernames, and not just email addresses, to identify users? - What is the main concern or the main case when a security expert (which I'm not) should recommend inserting another layer of usernames, for example, when a native/web application is created?

10 Answers 10

71

Your question is missing a lot of context, but what you do say sounds like you’re looking to settle an argument. So my answer will start with “It depends...”

One reason to have unique usernames that aren’t email addresses is to protect privacy when other users can see the username. For example, GitHub profiles indicate the username in the profile URL, and as authorship indicators on commits, issues, comments, etc.

Providing a username as the user’s public face instead of their email address allows them a layer of privacy.

In some rare cases, a service may elect not to collect email addresses at all... since email addresses can be considered sensitive and personally identifiable information. The downside to not collecting an email address at all is that account recovery for someone who forgets their password, or has their account breached, will be more difficult without a verified channel to use for recovery.

Or for the hybrid approach, one might collect the email address, but store it in the database behind strong encryption. Strong encryption is generally difficult to search on, so having a less sensitive identifier to use that can be store in plaintext would be convenient.

  • 1
    The actual account name could be the email address, while the "user's public face" can be a "nickname" they've chosen. I've seen some sites where people can freely change the "nickname", but a unique ID (possibly a hash of their actual account name, or just the next number available when the account was created, similar to a Unix/Linux UID) is displayed as a disambiguator in case more than one person chooses the same nick. Thus, "Joe [dUsWkOPhVq0]" and "Joe [MLxK8aT+Omw]" are two different people, but unless they're running in the same circles, they can both be casually addressed as "Joe" – Monty Harder Apr 23 '18 at 18:43
  • 3
    @MontyHarder Stack Exchange itself operates in a similar manner, where public profiles have a numeric ID to enforce uniqueness. – nbering Apr 23 '18 at 18:47
  • SO is different (and much more common) than what @MontyHarder describes, since the number is all you need to identify the user. I believe Monty is referring to the system that Blizzard and the like use ("battletag"), which is like "katrina#11104", which is a combination of a username and a unique ID, allowing for non-unique names with shorter IDs. As an aside, Blizzard's system still allows you to change usernames and that system is really just for user facing ID, with the email being your account login ID (but also changeable). – Kat Apr 24 '18 at 19:20
  • The inverse could also be important: users may want to give out their email address without revealing one of their login credentials. – Hugh Grigg 葛修远 Apr 25 '18 at 9:16
  • @xiuyuan Email addresses are frequently considered Personally Identifiable Information (PII), unless the user has provided a burner email like a mailinator address. Self-selected usernames that are selected by the user and can be unique per site can be PII, but a privacy-conscious user could protect themselves by not using the same name twice, and not including their real name in the username. Also, usernames should never be considered a security factor. The password and any other auth mechanisms are what protect the account. – nbering Apr 25 '18 at 13:54
19

E-Mails are in fact used for user identity on many websites.

There are advantages and disadvantages to this. An incomplete list:

Advantages

  • the problem of uniqueness is solved already
  • no need to come up with or invent a username
  • you don't need to ask the e-mail address additionally

Disadvantages

  • people do sometimes change their e-mail address
  • it often exposes the e-mail address publicly (spam, harrassment, etc. issues)
  • depending on context, people might want to have a username, not an address

A common and secure solution is to have both a displayed username and using the e-mail address to log in.

  • 21
    A major disadvantage that you don't list is shared e-mail accounts. Those might not be terribly common among IT-savvy people, but they definitely show up for people who aren't that much into computers. – a CVn Apr 23 '18 at 12:55
  • 1
    That is true, I didn't think of that. – Tom Apr 23 '18 at 13:11
  • 7
    To the point about shared email accounts... it happens a lot if your service deals with minors using the site at consent of their parents. In a previous career, I managed a lot of teenage employees, and I'd guess that 20% of our staff shared email with a parent, and those that had siblings also working for us often did not have a unique email address. This was problematic for the shift scheduling site we adopted. – nbering Apr 23 '18 at 13:43
  • 2
    Perhaps not common, but email addresses can also change owner. – Dennis Jaheruddin Apr 23 '18 at 14:51
  • 2
    I sold a domain and lost control of an email address. New owners kindly forwarded my emails but then they went bust. Domain is now in limbo. – Alfred Armstrong Apr 25 '18 at 14:02
10

It depends on the type of application. If it's a forum, it makes sense to add another layer of usernames for a couple of reasons:

  1. Mask the e-mail address from public (you need to have a display name, and many people might not want their e-mail address to go public). Though, another option would be to make people login with their e-mail address, and give them an option to choose a display name.

  2. Ease of login (of course, with browsers remembering your login IDs, this becomes less relevant).

If it's some application where the members don't interact with public, probably logging in with the e-mail address would make sense.

  • 5
    I'm not sure about your second point. I tend to think that users remember their email address more easily than their username. Especially when usernames must be unique and you have to add to add a random number at the end of it/choose another one. – Yuriko Apr 23 '18 at 8:13
  • 1
    @Yuriko Not necessary always. I've seen people with too complex e-mail addresses, which would surely be a pain to enter while logging in. Hence it takes the second position, with a note about less relevance. :) – pri Apr 23 '18 at 9:18
  • 8
    @Yuriko which of my 4 email addresses did I use to sign up (especialy for something like SE which is relevant to work and home)? If I used my primary personal address did I use a disposable alias? A new/unique alias? I've probably got active accounts with >10 different emails used for logging on – Chris H Apr 23 '18 at 10:42
  • 1
    Typing a username is generally easier on mobile than typing an email address - it's usually shorter and has fewer characters. But it also means everyone knows your login name and now just has to guess your password. – corsiKa Apr 23 '18 at 13:13
  • @corsiKa, so if we think about it, the most secure (but also the most cumbersome for the users) would be to have 3 different "identifiers" (or even 4, if we include the internal database ID): the email (for communications and password reset), the login-name (for login), and the nickname (for display on the forum, and which should preferably be different than the login-name). Actually the best solution is to not use login-name and password at all, but to login with a public+private key. But we're dreaming here... – Sorin Postelnicu Apr 24 '18 at 6:29
6

One reason that has not been mentioned yet is the ability to allow users to create multiple accounts. Not every site needs to limit accounts to one per person.

Allowing multiple accounts/identities is a security/privacy concern. While it can be abused, it also gives more privacy to people because they can separate work from private matter, etc.

Stack Exchange does allow people to hold multiple accounts. However, since the email is used as an id, every account needs a different email address.

If the email is not used as id, one could create multiple accounts with the same email address. this could simplify things for users, and even allow a proper support system for multiple identities.

One reason to disallow multiple accounts per person is the allocation of resources. (For example, you may have 10 GB of free space) However, if people create multiple accounts for privacy reasons they don't actually care about the free space.

By allowing the use of the same email address for multiple accounts, people could get their multiple identities, but the email address can be used to track the limited resources.

This doesn't prevent abuse, but it helps to identify the honest people.

There are of course other ways to achieve this too.

5

In addition to privacy and ease of use, a username may cover the scenario when a mail account is compromised.

If my mail account linked to a site is compromised, for example, I would change the mail account to a new one (change the default) in an attempt to minimize the damage.

People lose access to mail accounts all the time for various reasons.

  • For instance, this is happening to Lycos mail users. – Eric Towers Apr 23 '18 at 23:12
  • 1
    A lot of people that collect email account access credentials go with those on other sites and after trying the same credentials there, they use the "forgot my password" feature. Not nearly as easy when you have a username as the login. – PlasmaHH Apr 25 '18 at 9:15
4

Email addresses aren't a good idea for usernames – let alone unique usernames – unless you go to a lot of trouble.

For example, I register accounts with an email address like 'first.last+service@gmail.com' so that if I get spam I can see which service leaked my address.

That's the address you should register as my email address for the purposes of delivering me email.

But for uniqueness of username, you should just be checking 'first.last@gmail.com'. Except that gmail (and I'm sure others) also accept email to 'firstlast@gmail.com', 'f.irstl.ast@gmail.com' etc. So you'll also need to ignore the dots when checking for uniqueness.

Oh, and I might not remember whether I used the dots or included a service name, and what that service name was. So I'll probably lose access to my account.

3

Actually, emails are sometimes used to identify a user. Stack Exchange itself does that, and you must log in using your email and password. The only purpose of an identifier is to be unique, creating a namespace of sorts. If you enforce uniqueness for all identifiers (whether username, email, or something else), then, a fortiori, all identifier:password combinations will be unique.

2

The username usage has a few advantages over using e-mail as a form of login:

  • Is more secure (against browser cache, others viewing the e-mail address, phishing, etc.)
  • Is more private (similar reasons to above)
  • Can be typed faster (and yes, this many times matters)
  • Can be configured server-side to be something usable in case of e-mail compromise or independent to e-mail status
  • Can prevent a specific set of errors (from related and not only - using alphanumeric characters only are always better to be used generally in the IT world)
  • More private then what? Can be typed faster than what? Are you comparing apples against? – 9ilsdx 9rvj 0lo Apr 25 '18 at 6:40
  • It's obvious from the question. We compare user name with an e-mail address. – Overmind Apr 25 '18 at 6:42
  • No, it was not. It seems some stupid edit wars are running. Some troll kept removing the reference to e-mail from the question.... Which rendered your answers lacking context... – 9ilsdx 9rvj 0lo Apr 25 '18 at 6:45
  • Oh, then that explains it. I updated the answer a little just in case. – Overmind Apr 25 '18 at 6:47
0

The previous company that I worked for developed websites which allowed logins for various purposes. However, most of our clients had quite strict policies towards applications that gathered personally identifiable information (PII). There were forms to be filled, justifications to be filed, access to data be controlled and so on. Hence, where we could, we would implement logins using usernames (and not ask for any PII) so that those applications could be used.

-2

Since none of the other answers did mention this yet:

It is also more secure against social engineering / hacking. As you may know, much hacking does not happen because the hackers are geniuses from a superior race who can crack any system technically, but because the hackers are able to guess usernames and passwords (sadly enough, in many cases those of administrators).

Conceptually, a username and a password are two independent credentials. When you use the email address as username, you are actually reducing that to one real credential. How that?

Well, users are lazy, and many of them have only one email address (please let us not start a discussion if it is one, two or three - that won't change the following reasoning too much). That means that a lot of people know their first credential for many websites without any hacking.

At that point, you can safely assume that the password is the only credential which provides protection.

Personally, for that reason, I have made the following rules for myself:

  • When developing a web site, I do not use the email address as user name.
  • When developing a web site, and a user registers, and I detect that the user chooses a user name which could be something like an email address, refuse registering (of course with an appropriate error message which asks that user to choose a user name which is not and even does not resemble an email address).
  • When registering myself with a web site, I do not use one of my email addresses as a username unless the web site forces me to do so.
  • If a web site allows to choose the user name randomly, I use something like xKAiSP0k0hILscxU as user name (remember: it would not be wise to use a thing like forename.lastname, your birthday or your cat's name as user name because then you have exactly the same problem - everybody knows or can guess it).
  • If a web site forces me to use an email address as user name, I generate a new address which can't be guessed (e.g. xKAiSP0k0hILscxU@gmx.net or even xKAiSP0k0hILscxU@some_disposable_email_service_like_mailinator), and I use that address only for that web site.

Just my two cents ...

  • -1 usernames should not be thought of as secret. You should always assume that the password is the only credential which provides protection (unless you have 2fa). – AndrolGenhald Apr 26 '18 at 13:40
  • usernames should not be thought of as secret. Says who? You are just stating your personal opinion which clearly is wrong. The combination of a username and a password is undoubtedly stronger than the same password alone. Note that I did not say that you should choose weak passwords if your user name is not an email address. Note also that there are enough examples where celebrities' accounts were hacked because their email address was known and has been used as a user name. – Binarus Apr 28 '18 at 7:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.