Is there any added security benefit to username complexity requirements?

Question

I've come across several sites lately that have complexity requirements for usernames like "must be 8 characters long and contain at least 2 numbers". Is there any real added benefit to this from a security standpoint?

I would think that since a username is designed to be an identifier and not a secret that this is an unnecessary and annoying policy to have. It annoys me particularly because it comes across as a "security" requirement that provides only the illusion of security at the expense of convenience.

Answer 1

I cannot think of a tangible security benefit, other than maybe possibly it being a little more difficult to enumerate the user names. Some practice of security through obscurity, i would think that would have the disadvantage of then requiring your users to have to write down their username to remember it, maybe defeating the purpose of a complex user name.

On the other hand, I'm not certain how prevalent it is to use keystores like KeePass; sort of making remembering the username irrelevant.

Answer 2

The reasoning behind the requirement could be to discourage users from re-using a username and password from another system.

Answer 3

My bet is that this requirement is to lower the rate of username collisions, because such collisions can trigger user support (user tries his name, but the name is already taken, user does not understand and phones/emails the webmaster). Then this requirement is called a security requirement so that the users will swallow it.

Answer 4

Yes there is added security with these requirements, here is a scenario that will help it become clear (ideally).

Scenario
Bob Jones is the CEO of AwesomeCo. He decides to make his username bobJones (or any other enumeration of this that does not involve numerals i.e. bob.jones, bJones, etc). Someone who does their homework discovers that this is a company that is involved with environmental disasters and wants to exact revenge. His username is easy to guess, which decreases the complexity required to access his information.

Now typically the security requirements around usernames are that they cannot contain your first, last, or middle names. Now in conjunction with passwords, the requirement typically is that you cannot use your SID(username), first,last, or middle name. This theoretically should make it more difficult for a system to crack your user/password combination as they should be mutually exclusive to some degree.

Answer 5

Potentially the username complexity requirement could be part of a DOS mitigation.

You do not need to know the password to lock a user out; you only need the user name. Simply attempt to sign on five times using the user name and the wrong password, and voila, the user is locked out. Do this for a thousand users and you've created a serious backlog in the site's call center.