Linked Questions

4 votes
5 answers
10k views

Why have username AND password? [duplicate]

It seems most security mechanisms nowadays default to a username + password combination for authorization. I want to know why there are 2 "keys," if you will. Won't one credential suffice? Put ...
Mario Campos's user avatar
1 vote
1 answer
371 views

Why to use username and password instead of just a long password? [duplicate]

Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user? A simple example: On the server, we create a JSON file with user data ...
stckvrw's user avatar
  • 127
21 votes
10 answers
6k views

Why don't we use single input authentication? [duplicate]

Two input authentication uses both username (may be available publicly) and password (kept secret). For the sake of comparison, assume the length of username is the same as the length of password, i....
Display Name's user avatar
19 votes
9 answers
28k views

Difference between authentication and identification [Crypto and Security perspective]

I am always confused by the way the word authentication is used in security literature (i.e., outside the crypto realm). Most of the time I understand that they are actually implying identification. ...
Jus12's user avatar
  • 1,375
49 votes
5 answers
13k views

Should usernames be kept secret?

Help me settle an discussion among colleagues and guide future design: Even in a high impact scenario: e.g. protecting payment application or government gateway but in an Internet accessible ...
Rakkhi's user avatar
  • 5,823
10 votes
7 answers
5k views

Does the new Danish authentication solution for online contact with municipality etc. genuinely use 2FA?

In Denmark, the current digital identification/authentication solution for pretty much any online contact with the municipality, state, etc. is being switched over to a setup consisting of the ...
KeyboardCat's user avatar
5 votes
5 answers
942 views

Is a password really necessary? [closed]

For the purposes of security, is there any difference in having a 50 character randomly-generated secret username accompanied by a 50 character randomly-generated secret password, versus a 100 ...
End Antisemitic Hate's user avatar
4 votes
4 answers
9k views

Using only password to authenticate user (no "username" field)

I am creating a client access system, to allow manage invoices, make payments, access information about their products and information/functionality alike. Supposedly there are less than 1000 clients....
Gajus's user avatar
  • 553
0 votes
2 answers
564 views

Protect key-streched hashes from rainbow tables?

I have a database table with accounts. I'm using PBKDF2 to create hashes from passwords. The passwords are of the correcthorsebatterystaple type, so we assume they are secure and unique. There are no ...
AndreKR's user avatar
  • 507
4 votes
1 answer
282 views

Single randomly generated passphrase for both identity and authentication

There are questions about using a password only to identify and authenticate a user, rather than an email address or username plus password: Why do we authenticate by prompting a user to enter both ...
user3842252's user avatar