1

When users try to log in to my web application they have two options: their username or their email including password, both of them are unique.

When the logged-in user tries to write comments in the public comment box, shall I post his/her username as a name or ask them to write their name? What can I do for better security?

If I post their username as a name, their account is at risk since a hacker can take the username and try to login with it.

2
  • 2
    The username isn't secret, the password is.
    – user163495
    Apr 20, 2020 at 13:26
  • Seems like more of a privacy issue, but even then, people voluntarily advertise their username or even real name all the time online. Apr 20, 2020 at 14:20

1 Answer 1

3

A solution to your conundrum is having two separate handles for login and for display. Steam is a prominent example for this pattern. Users log in with their account name, while only the player name is displayed in forums or when playing with other users.

For this measure to be effective, you must ensure that those names cannot be the same. An attacker can harvest player names as much as he want, because only the account name can be used to log in.

You should be aware though, that user names are usually not treated as a secret and users are likely to leak them anyway. Your security should not revolve around keeping user names secret. A solid 2FA is all you need for state of the art user authentication.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .