2

Possible Duplicate:
Is there any added security benefit to username complexity requirements?

Are there any good security reasons for a web application to limit the length of a username?

If there is, what should be the minimum and maximum length allowed?

Improve this question
1
  • 1
    @AndreyBotalov Thanks for that, didn't come across it in my search. Voted to close my question, we'll wait for Rory or AviD to close it eh.
    – user10211
    Commented Aug 11, 2012 at 10:33

3 Answers 3

Reset to default
3

If it's email, up to 254 characters has to be handled to be in line with the rest. If it's username, PCI limits to 16, but I think 32 would be just fine.

The limit is to prevent actually bugs, for example, inserting too big key (more then sql index), making page render differently, as well there might be limits imposed by hardware devices / other systems were the length cannot be longer, so 32 characters as on Linux should be fine, at least for me.

Improve this answer
1
  • 1
    I'm lost. What does the Payment Card Industry or Peripheral Component Interconnect interface have to do with e-mail? Or, is there another "PCI" I'm not thinking of?
    – Iszi
    Commented Aug 31, 2012 at 16:07
2

There is no good security reason to limit the length of a username. The only reason to limit the length of the username is so it doesn't stretch parts of the website when displayed, but even that can be solved differently.

Improve this answer
1
  • That and database efficiency, limit the field in the database to a CHAR of a particular length tends to be more efficient at nor storing excessive information and even VARCHAR is defined with a maximum length (mysql allows developers to define a length upto 65,535 bytes). But with price per MB being so low these days, even that isn't as relevant any more as it used to be.
    – ewanm89
    Commented Aug 11, 2012 at 10:19
2

It is important to remember that in some environments, restricting a username may also lead to it's own security risk.

When bruteforcing a web application login, where no usernames or passwords are known, it often makes more sense to take a number of common passwords and attempt to guess usernames. The theory is that given X number of users of a web application, it is more than likely that a number of those users will have week passwords. This kind of bruteforce also helps to get around password lockout policies.

Now of course there is a trade off between security and usability, the last thing that you want if to allow every character and find that most of your time is spent answering customer support requests for lost usernames, but when considering restrictions, I find it best to be as unrestrictive as possible.

Improve this answer