Is it okay/safe to mention/display information about the example format of user Login ID (aka Username) on the website? Will this become a source of information for hackers to figure out the Login ID format?

  • 2
    Safe against what? What specific security concerns do you have? Please edit your question to include more information.
    – Polynomial
    Mar 25 '19 at 1:14

The short answer is that yes, an attacker would benefit from knowing the format of your usernames if they are going to attempt to launch an online guessing attack of likely username/password pairs against your system. But this may not be a risk you should worry about.

The long answer is that you need to judge the value this practice provides you against the risk. Our industry has generally embraced the idea that while usernames should not be easily disclosed to attackers, knowledge of a username alone should not grant access to user accounts. Accounts should primarily be protected by a password or other authentication factors. There is a faction that believes the username should be more secretive to further decrease risk, but this idea hasn't been embraced by most system owners.

So by disclosing the format of usernames you are merely giving an attacker seeking that knowledge a slight advantage. They still have to take the info that usernames are in a certain format and apply it to their guessing process. Hopefully the username format itself isn't risky (e.g. not 'user1', 'user2', etc.) and you aren't trying to obscure that fact to avoid attacks against it.

Presumably you ask because you or someone else sees a benefit in publishing this information on your site to begin with. Whether it's to help users through the account creation process or something similar, you may need to communicate your standard to them. If not, then you can easily decide to remove this info from your site. But if so, you should weigh this benefit against the low risk incurred from the practice and decide if it is worth it.

I see similarities between this and disclosing your password policy. Yes, knowing passwords must contain uppercase, lowercase, and numeric characters can help attackers. But it doesn't tend to help them very much.

Personally, I wouldn't worry about disclosing the username format.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.