Is Username/Display Name Login more secure than email login?

Question

I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an email from Bioware (the developers) today, that said this:

Beginning April 2, 2013, you will only be able to log in to the Game or Website using your Display Name – Your email address will no longer be accepted from that point forward.

It goes on to say that

This new change to the log in procedure is being implemented for several reasons. This change increases the security of our game authentication system, which helps continue to keep the game protected from many security threats including account takeovers.

Is forcing me to log in with my username instead of my email actually more secure than logging in with an email? Both use the same password. Why would a company choose to do this, from a security standpoint?

Answer 1

One aspect is nicely described by @AJHenderson and involves a potentially insecure password reset verification scheme, if end user's computer was compromised by a key logger.

Another is pointed out by @Zaffy and is concerning using one of the published values for verification. I would add to it that these changes are usually prompted by changes in EULA/TOS of websites, and if so, you could find your answer there. Did they change their terms of service lately? Or perhaps the service provider wanted their members to be able to publish their email addresses to other members, if they chose so? Either case, if email address will suddenly become visible to other members, then that's a clear case for hardening log-in security by using non-disclosed user data.

But there is possibly also another security related reason not to include user email addresses. If the log-in process in any way discloses which of the two required fields didn't match any record in the registered users database (by a distinct error message, by removing invalidly input field values,...). That is, if a log-in process was too user friendly with its responses, an attacker could quite easily gain knowledge, whether a certain email address is registered with the website in question. Which might in turn invalidate EULA/TOS addressing any such privacy concerns. While having such 'user friendliness' in place is greatly diminishing security on its own, many web developers still didn't discover this website, to know any better.

Another, albeit less strictly security related reason why developers decided to change the log-in process, could also be they're planning to expand their business to third-parties and the EULA/TOS you were agreeing with when signing-up didn't cover disclosing your email address to these third-parties. This way, they could avoid invalidating their very own EULA/TOS and still offer third party services to an already existing user base, identifying network users by non-private data.

You are right though to doubt there's any security benefits, as advertised on this SWTOR page. It does seem rather strange how they can claim greater protection against possible account takeovers, when an attacker would now be only a password away from successfully logging-in as another user, whereas before both username and password were adding to the entropy of the whole process. Curious indeed. Then again, I'm not a SWTOR player, which is curious enough on its own :)

Answer 2

This is because people use the same password when they shouldn't. If a key logger gets your SWTOR login email and password, they can't send an email to verify suspicious activity since the attacker may have your email account as well.

Using a display name prevents password reuse from resulting in the email address also being compromised as easily. This makes it easier to recover a stolen account since if they don't have access to your e-mail address, they can't respond to any confirmation e-mails that SWTOR customer support sends to it.

Answer 3

It varies. If your username is not displayed and only you know it - then yes. On the other hand if the username is public I think the email login is safer.

For example: most of web applications exposes users' usernames but not emails. So anyone can see your username but not email. So logging in through your "secret" email would be safer.