My intuition is failing me with this. Would it make it easier or harder for an attacker trying to gain access to any of the accounts in a database?

I can see that in the case of a single login string, you're comparing it to all of the users in the database, as opposed to a particular one, so there's a greater chance you'll get a match for a random login. On the other hand, with username and password, if you're not interested in a particular user, you're also effectively comparing a single concatenated string to the whole database, except usernames are far less random than any part of a single randomly created login, so that feels like it would be less secure.

I guess what I'm really asking is whether claiming to be someone and demonstrating it is more secure than just demonstrating it.

  • It depends from how the login string is generated. If it's a string users manually enter, its entropy is probably not different from the entropy username + password have. On the other side, when the username is publicly shown, trying to gain access would just require to find the password.
    – apaderno
    Sep 7 at 17:40

This is a confusion of two aspects of a system / security of a system.


The modelling of a user in the system, usually uniquely identified as username.

This may not be a required feature of a system, although for a non-trivial system especially a secure system it is very important.


The process and attributes related to the verification of the user in the system.

  • Username / Password challenge process.
  • 2nd factor challenge (mobile number).

Other Parts: Authorisation

The mechanism to allow a user access to (all or part) of a system. Which may be as simple as the implicit permission granted by creating the users account.

  • Process to Grant access
  • Process to Verify access.

Now to answer the Question Itself:

This method of authentication can be used for a simple resource see Presigned URLS where there is no requirement to know the user.

Or such URLS can also be used for a simple Single Use action that interacts with a System, such as in concert with a "reset password" email.

So for general repeatable access to a system this mechanism should not be used as it is unlikely to be secure.

  • When re-reading the Question, another interpretation of the question might be for passwords that scan over all passwords to find a match to a given user. This is a dangerous design that fails to distinguish users. For example imagine two people choosing the same password, the login account is thus one of the two accounts? Sep 8 at 1:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.