Why use usernames, and not just email addresses, to identify users? - What is the main concern or the main case when a security expert (which I'm not) should recommend inserting another layer of usernames, for example, when a native/web application is created?
Your question is missing a lot of context, but what you do say sounds like you’re looking to settle an argument. So my answer will start with “It depends...”
One reason to have unique usernames that aren’t email addresses is to protect privacy when other users can see the username. For example, GitHub profiles indicate the username in the profile URL, and as authorship indicators on commits, issues, comments, etc.
Providing a username as the user’s public face instead of their email address allows them a layer of privacy.
In some rare cases, a service may elect not to collect email addresses at all... since email addresses can be considered sensitive and personally identifiable information. The downside to not collecting an email address at all is that account recovery for someone who forgets their password, or has their account breached, will be more difficult without a verified channel to use for recovery.
Or for the hybrid approach, one might collect the email address, but store it in the database behind strong encryption. Strong encryption is generally difficult to search on, so having a less sensitive identifier to use that can be store in plaintext would be convenient.
E-Mails are in fact used for user identity on many websites.
There are advantages and disadvantages to this. An incomplete list:
- the problem of uniqueness is solved already
- no need to come up with or invent a username
- you don't need to ask the e-mail address additionally
- people do sometimes change their e-mail address
- it often exposes the e-mail address publicly (spam, harrassment, etc. issues)
- depending on context, people might want to have a username, not an address
A common and secure solution is to have both a displayed username and using the e-mail address to log in.
It depends on the type of application. If it's a forum, it makes sense to add another layer of usernames for a couple of reasons:
Mask the e-mail address from public (you need to have a display name, and many people might not want their e-mail address to go public). Though, another option would be to make people login with their e-mail address, and give them an option to choose a display name.
Ease of login (of course, with browsers remembering your login IDs, this becomes less relevant).
If it's some application where the members don't interact with public, probably logging in with the e-mail address would make sense.
One reason that has not been mentioned yet is the ability to allow users to create multiple accounts. Not every site needs to limit accounts to one per person.
Allowing multiple accounts/identities is a security/privacy concern. While it can be abused, it also gives more privacy to people because they can separate work from private matter, etc.
Stack Exchange does allow people to hold multiple accounts. However, since the email is used as an id, every account needs a different email address.
If the email is not used as id, one could create multiple accounts with the same email address. this could simplify things for users, and even allow a proper support system for multiple identities.
One reason to disallow multiple accounts per person is the allocation of resources. (For example, you may have 10 GB of free space) However, if people create multiple accounts for privacy reasons they don't actually care about the free space.
By allowing the use of the same email address for multiple accounts, people could get their multiple identities, but the email address can be used to track the limited resources.
This doesn't prevent abuse, but it helps to identify the honest people.
There are of course other ways to achieve this too.
In addition to privacy and ease of use, a username may cover the scenario when a mail account is compromised.
If my mail account linked to a site is compromised, for example, I would change the mail account to a new one (change the default) in an attempt to minimize the damage.
People lose access to mail accounts all the time for various reasons.
Email addresses aren't a good idea for usernames – let alone unique usernames – unless you go to a lot of trouble.
For example, I register accounts with an email address like 'email@example.com' so that if I get spam I can see which service leaked my address.
That's the address you should register as my email address for the purposes of delivering me email.
But for uniqueness of username, you should just be checking 'firstname.lastname@example.org'. Except that gmail (and I'm sure others) also accept email to 'email@example.com', 'firstname.lastname@example.org' etc. So you'll also need to ignore the dots when checking for uniqueness.
Oh, and I might not remember whether I used the dots or included a service name, and what that service name was. So I'll probably lose access to my account.
Actually, emails are sometimes used to identify a user. Stack Exchange itself does that, and you must log in using your email and password. The only purpose of an identifier is to be unique, creating a namespace of sorts. If you enforce uniqueness for all identifiers (whether username, email, or something else), then, a fortiori, all identifier:password combinations will be unique.
The username usage has a few advantages over using e-mail as a form of login:
- Is more secure (against browser cache, others viewing the e-mail address, phishing, etc.)
- Is more private (similar reasons to above)
- Can be typed faster (and yes, this many times matters)
- Can be configured server-side to be something usable in case of e-mail compromise or independent to e-mail status
- Can prevent a specific set of errors (from related and not only - using alphanumeric characters only are always better to be used generally in the IT world)
The previous company that I worked for developed websites which allowed logins for various purposes. However, most of our clients had quite strict policies towards applications that gathered personally identifiable information (PII). There were forms to be filled, justifications to be filed, access to data be controlled and so on. Hence, where we could, we would implement logins using usernames (and not ask for any PII) so that those applications could be used.
Typically, an email address is a username from another system. Some exceptions are aliases and role based email addresses. Contrary to popular belief, email addresses are not unique to an individual. Just as an individual is not required to have one and only one email address.
Email addresses are not forever and an individual may lose access before they no longer need access to a site. Email access loss is unpredictable. I have had to deal with this. I have lost access to online accounts because of this.
Because of the prevalence of spam, people do want to keep their email addresses limited in exposure with a few exceptions. I am considering abandoning an email address due to spam loads. Those sites requiring an email address in lieu of a username and do not support an identifier change will keep me from completely abandoning it. Such site may be abandoned by me instead.
Usernames are identifiers, not authenticators. Because of this they have a long history of not being held secret and at times intentionally being publicly visible. Even if a username were to be held secret, it rarely changes or cannot be changed. Secrets get out. Secret passwords get changed if they get out. A system should be designed to be secured even if an identifier is publicly known. FYI Social Security Numbers (SSNs) are identifiers. Problems abound when trying to keep identifiers secret to make weak identification schemes work.
Security here comes from authenticators. Authentication must be implemented securely.
Since none of the other answers did mention this yet:
It is also more secure against social engineering / hacking. As you may know, much hacking does not happen because the hackers are geniuses from a superior race who can crack any system technically, but because the hackers are able to guess usernames and passwords (sadly enough, in many cases those of administrators).
Conceptually, a username and a password are two independent credentials. When you use the email address as username, you are actually reducing that to one real credential. How that?
Well, users are lazy, and many of them have only one email address (please let us not start a discussion if it is one, two or three - that won't change the following reasoning too much). That means that a lot of people know their first credential for many websites without any hacking.
At that point, you can safely assume that the password is the only credential which provides protection.
Personally, for that reason, I have made the following rules for myself:
- When developing a web site, I do not use the email address as user name.
- When developing a web site, and a user registers, and I detect that the user chooses a user name which could be something like an email address, refuse registering (of course with an appropriate error message which asks that user to choose a user name which is not and even does not resemble an email address).
- When registering myself with a web site, I do not use one of my email addresses as a username unless the web site forces me to do so.
- If a web site allows to choose the user name randomly, I use something like
xKAiSP0k0hILscxUas user name (remember: it would not be wise to use a thing like forename.lastname, your birthday or your cat's name as user name because then you have exactly the same problem - everybody knows or can guess it).
- If a web site forces me to use an email address as user name, I generate a new address which can't be guessed (e.g.
xKAiSP0k0hILscxU@some_disposable_email_service_like_mailinator), and I use that address only for that web site.
Just my two cents ...