So I've noticed a recent (and irritating) trend to require user names to have numbers in them. Is there really any security value to this?
Other than the fact that user names are not password replacements, because they are often public (or at least less secured):
No, forcing a user to have a number in the input actually decreases the number of possibilites, thus making it less secure against guessing.
As small example, lets have a password of length 4, where each character can be one of 70 possible ones (26 uppercase, 26 lowercase, 10 digits, and some signs like .,?! etc.). That's 70^4 = 24010000 possibilities.
If one of these 4 characters must be a digit, there are 70^3*10*4 = 13720000 possibilities (the 4 is because the digit can be any of the 4 positions).
So without digit, there are about two times as much possibilities here.
Of course this can be generalized for any set of possible characters (as long as it's significantly more than the 10 digits alone) and any password length.
And yes, the fact that humans are no perfect random generators is missing here - forcing a digit could prevent some people from using eg. their own name. On the other hand, other people will use their name with 1 added. Nonetheless, some people actually use good RNGs (password managers etc.etc.), and like shown the digit allows less possible values.
I've noticed this as well. Many times from banking & credit card institutions.
The reason I believe they enforce this is to
- make it harder for an attacker to guess the username and
- force you to have a unique username that's dissimilar from other online services.
To me, this really doesn't inherently making it any more secure. It's moreso a case of obfuscation. As we all know, obscurity does not equal security.
On the contrary, I do recommend having unique usernames for each online service as much as possible and of course long and strong unique passwords for each as well.
It could be of some value against bots that try common username/password combinations by ensuring that users pick user names that are not common. Also, some websites respond differently in case a user exists or not (it'll either say wrong password or user does not exist for example) and scripts try to scan for common usernames to later brute-force their passwords. If you make guessing usernames harder you at least gain something.
I mean... to launch a "dumb" attack against some website you need to guess both the username and the password correctly. In this scenario you'd make that harder by requiring users to have complicated usernames. Of course, it doesn't help against attack scenarios where the attacker already knows your username.