Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When users try to log in to my web application they have two options: their username or their email including password, both of them are unique.
When the logged-in user tries to write comments in the public comment box, shall I post his/her username as a name or ask them to write their name? What can I do for better security?
If I post their username as a name, their account is at risk since a hacker can take the username and try to login with it.
A solution to your conundrum is having two separate handles for login and for display. Steam is a prominent example for this pattern. Users log in with their account name, while only the player name is displayed in forums or when playing with other users.
For this measure to be effective, you must ensure that those names cannot be the same. An attacker can harvest player names as much as he want, because only the account name can be used to log in.
You should be aware though, that user names are usually not treated as a secret and users are likely to leak them anyway. Your security should not revolve around keeping user names secret. A solid 2FA is all you need for state of the art user authentication.
