Does a random number after the login name in the public members section of a website increase security or privacy?

Question

http://forum.example.com/users/username-3723484

vs

http://forum.example.com/users/username

where username is specific to each user, as is its salt.

My hypothesis is that it makes it harder for spammers to collect information about someone by not giving a direct answer to the question: do you know user $login ?

If I had 20 millions of email adresses that I wanted to spam, I would certainly try to establish a profile for each user, for example by trying to find his interests. With a list of forum, I would just fetch and parse one page on each forums members section, but with the salt in the URL, I would have to make a complete copy, and update it regularly. So what do you think ? Is it done to increase the cost of data collection or is it something else ?

Answer 1

If you're wondering why this is done in practice, it generally (to my knowledge) has nothing whatsoever to do with information security. With forum software I'm aware of, the username is actually completely superfluous from the server's point of view; the number is the member ID number, and is all the server looks at. The username is just there so that the URL is more descriptive; it's strictly optional, and can be whatever you want, but by default it makes it clearer what the URL points to. You can see an example on Stack Exchange: your user profile is https://security.stackexchange.com/users/15000/antoine-lecaille but https://security.stackexchange.com/users/15000/cpast or https://security.stackexchange.com/users/15000/not-a-real-user takes you to the exact same page.

Related question on SO: https://stackoverflow.com/questions/16064124/incidentally-se-does-the-same-thing-for-question-urls

Answer 2

There is a security merit to having entropy in user names, though as cpast's answer points out, it's usually not a primary reason.

Let's say that Bob has the username bobertack at forum.example.com and that an attacker knows his username and password. That's bad, but at least it's just one forum. However, the attacker could perform a password reuse attack, e.g. by trying the same password for bobertack on blog.example.net; if Bob is like many other people out there, there is a high chance that he uses the same password for both.

With a different username, Bob would have been less vulnerable to this kind of attack. It is for this reason that some people (myself included) consider their bank account user names to be essentially passwords in their own right.

An example of a password reuse attack:

The question itself supposes an almost reversed password reuse attack, in which a spammer could find connections between a person's accounts and use that to better target the person. Advertisers (both good and evil) do this every day; this is called targeted advertising and its ramifications are themselves quite interesting.

To learn more on how privacy is connected to security, watch Mikko Hypponen (Chief Research Officer at Sophos) give a presentation on privacy and security in which he notes that the world's top scientists are focusing their time on delivering targeted ads rather than solving the world's problems.