So I've noticed a recent (and irritating) trend to require user names to have numbers in them. Is there really any security value to this?

  • 9
    I don't think adding numbers to any username makes it more secure, as usernames are usually public or easily obtained. And I haven't seen that issue yet. – ThoriumBR Jun 14 '18 at 19:26
  • Probably decreases security as it encourages users to store their usernames which probably increases their chances of storing their passwords and I suspect most users don't store them securely. Also, probably fills your user database with forgotten users with never updated passwords when users forget their usernames. Plenty of users will have multiple email addresses and find it easier to create a new user from a new email address than fight your password/username recovery system. – Glen Pierce Jun 15 '18 at 2:26
  • The only reason a company would force a number is for uniqueness. User ID's should be unquire, there is no security implication or benefit from having a number or not. – Shane Andrie Jun 15 '18 at 14:59

Other than the fact that user names are not password replacements, because they are often public (or at least less secured):

No, forcing a user to have a number in the input actually decreases the number of possibilites, thus making it less secure against guessing.

As small example, lets have a password of length 4, where each character can be one of 70 possible ones (26 uppercase, 26 lowercase, 10 digits, and some signs like .,?! etc.). That's 70^4 = 24010000 possibilities.
If one of these 4 characters must be a digit, there are 70^3*10*4 = 13720000 possibilities (the 4 is because the digit can be any of the 4 positions).
So without digit, there are about two times as much possibilities here.

Of course this can be generalized for any set of possible characters (as long as it's significantly more than the 10 digits alone) and any password length.

And yes, the fact that humans are no perfect random generators is missing here - forcing a digit could prevent some people from using eg. their own name. On the other hand, other people will use their name with 1 added. Nonetheless, some people actually use good RNGs (password managers etc.etc.), and like shown the digit allows less possible values.

| improve this answer | |
  • How does it decrease it ? – Overmind Jun 15 '18 at 11:10
  • @Overmind Added some simple calculation example. – deviantfan Jun 15 '18 at 11:57
  • I see the logic now. I was thinking initially of adding a digit, not replacing a character with a digit (i.e. pass4 instead of p4ss). – Overmind Jun 15 '18 at 12:06
  • How does any of this pertain to a user id? – Shane Andrie Jun 15 '18 at 15:00

I've noticed this as well. Many times from banking & credit card institutions.

The reason I believe they enforce this is to

  1. make it harder for an attacker to guess the username and
  2. force you to have a unique username that's dissimilar from other online services.

To me, this really doesn't inherently making it any more secure. It's moreso a case of obfuscation. As we all know, obscurity does not equal security.

On the contrary, I do recommend having unique usernames for each online service as much as possible and of course long and strong unique passwords for each as well.

| improve this answer | |
  • Why would it force you to have a different username than others? You can still pick a number others already picked like 00 1234 etc – Xenos Jun 15 '18 at 12:46

It could be of some value against bots that try common username/password combinations by ensuring that users pick user names that are not common. Also, some websites respond differently in case a user exists or not (it'll either say wrong password or user does not exist for example) and scripts try to scan for common usernames to later brute-force their passwords. If you make guessing usernames harder you at least gain something.

I mean... to launch a "dumb" attack against some website you need to guess both the username and the password correctly. In this scenario you'd make that harder by requiring users to have complicated usernames. Of course, it doesn't help against attack scenarios where the attacker already knows your username.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.