Questions tagged [user-names]
The user-names tag has no usage guidance.
70
questions
0
votes
1
answer
117
views
Is every string a possible username?
I have noticed that a lot of websites only allow a fixed amount of username changes, and does not allow the reuse of a previously or currently used username. For example, on Fandom.com once a username ...
- 1
0
votes
0
answers
434
views
Is storing a username in session storage a security risk?
Goal
I have a page which verifies the user's email address, that has access to their user id. From this page they're redirected to the login page. I want their username to be filled in already. In ...
- 11
2
votes
1
answer
164
views
Is it safe for website to generate fake profile pages?
Today I found a website which generates a fake profile when asked if said profile exists. Example: www.site.com/user/mycoolname doesn't exist yet. But if I put it in the browser for the site I get a ...
- 21
1
vote
1
answer
381
views
Your username can only be changed once?
I've seen quite a few security centric sites enforce this policy:
Your username can only be changed once
My question is: Is this done from a security standpoint? If yes, what is the logic behind it? ...
- 141
1
vote
1
answer
180
views
What are the industry recommendations on usernames?
We're having an internal debate within the NHS organisation I work for, around securing admin usernames. Our usernames are generally based on our names (e.g. tom jones username = tojo0001). Admin ...
- 71
3
votes
2
answers
820
views
Case sensitive logins
Why does owasp recommend using case insensitive logins ?
Make sure your usernames/user IDs are case-insensitive. User 'smith'
and user 'Smith' should be the same user.
What's the security aspect of ...
- 63
21
votes
5
answers
9k
views
Program claiming a dedicated user to run itself
A desktop running Ubuntu Linux 14.04 LTS seemed to go slower than usual. top showed that freshclam, the database-update utility for the Unix anti-virus program, was working the hardest.
freshclam --...
- 965
1
vote
1
answer
1k
views
Security issues if I post username in comments on my website?
When users try to log in to my web application they have two options: their username or their email including password, both of them are unique.
When the logged-in user tries to write comments in ...
- 21
1
vote
0
answers
79
views
What’s the real name policy? [closed]
I want to know more about the real name policy and if I can use scrappymatt on google. Facebook uses the real name policy but I’m not sure about google
- 11
5
votes
4
answers
5k
views
Is revealing a PC account user name bad?
Typical computers with modern operating systems require log-on accounts with a user name and a password. Is it dangerous to reveal the user name of the log-on account to the public?
My research:
I ...
- 153
2
votes
1
answer
414
views
Is it insecure to not let a user choose their own username, and base the username on a known pattern?
I have recently changed banks and my new bank has a benefit scheme (discounts etc.) that has its own website and different login details to my online banking (I think the benefits system is ...
- 194
1
vote
2
answers
3k
views
How to brute force only username not password?
I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
- 11
0
votes
1
answer
2k
views
Is it okay/safe to mention/display information about the example format of user Login ID on the website?
Is it okay/safe to mention/display information about the example format of user Login ID (aka Username) on the website?
Will this become a source of information for hackers to figure out the Login ID ...
- 9
0
votes
2
answers
2k
views
Account Recovery: Displaying username without verification
I'm not a security guy, so bear with me. As discussed in other topics, usernames in and of themselves are valid forms of verification, and there's nothing particularly sensitive or secure about ...
- 101
1
vote
1
answer
6k
views
Strange and unknown user name on Windows 10
Today I was through folder information and, when I switched to the security tab, I observed that there were 5 users listed there. In this list, there was also a user called "yupgyzmhuma". I tried ...
- 13
2
votes
3
answers
712
views
Should I treat my SSH username like a secret?
I'm trying to automate the deployment of my blog.
Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me.
...
- 123
0
votes
2
answers
2k
views
How to write down user credentials? [closed]
Sometimes we cannot avoid to write down usernames and passwords internally in our organisation. This is mainly for personal usage, not for reading by programs.
There are several ways to do this, e.g. ...
- 129
150
votes
6
answers
26k
views
Is password entry being recorded on camera a realistic concern?
I live in a city where CCTV camera coverage is comprehensive and increasing. Cameras are getting cheaper and higher resolution. Everyone has a video camera in their pocket already, and we are starting ...
- 1,241
2
votes
2
answers
129
views
Domain offline - are unmaintained email clients a security risk?
I have just unregistered a domain. Now my mail client (Thunderbird) popped up a message saying that it cannot connect to the mail server. That's fine - for the moment.
However, I wonder what would ...
- 3,376
1
vote
0
answers
117
views
What might an attacker do with email address as login name?
This might have been asked before, but I've looked for a few hours and can't find much.
I would also like some opinions on what an attacker might do if he enters an email address on a site and it ...
- 11
2
votes
3
answers
402
views
If I typed username and password, but wrongly clicked another button to go to another page instead of the login button, is there any security risk?
For example, suppose I already typed username and password at this Facebook page:
https://m.facebook.com
But I wrongly clicked 'Create New Account' instead of Log In. My question is, does it ...
- 525
2
votes
3
answers
1k
views
What are the benefits of logging the username of a failed authentication attempt?
From time to time, some users can accidently type their password in the username field, either because they missed the tab key or because they thought their account was simply locked, not logged out (...
- 183
2
votes
3
answers
1k
views
Does having a number in your username make it more secure?
So I've noticed a recent (and irritating) trend to require user names to have numbers in them. Is there really any security value to this?
- 141
2
votes
1
answer
163
views
Should pin numbers expire?
We're using pin number for username retrieval process. Similar to a standard bank solution where a user must enter their ssn and account number to get their username. Is it necessary to expire this ...
- 133
1
vote
1
answer
1k
views
Should we use different usernames for each website, to achieve better anonymity?
I have big problems trying to remember different usernames for each site. Chrome remembers only passwords, so I should install a password manager, however it's crazy you have to do that in order to do ...
- 163
-1
votes
1
answer
92
views
Access Token or User Id
After logged in to application, why one should use "access token" instead of simply using "user name", to call further APIs ? How it is more secured with access token ?
26
votes
3
answers
12k
views
How to handle emails as usernames under GDPR?
Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
- 363
53
votes
10
answers
38k
views
Why use usernames and not just email addresses to identify users?
Why use usernames, and not just email addresses, to identify users? - What is the main concern or the main case when a security expert (which I'm not) should recommend inserting another layer of ...
0
votes
1
answer
220
views
Username visibility on network
People in the security world recommend changing the hostname of a computer to something that is not connected to the user. For example: "don't name it: MacbookPro Erica." This way IT staff and '...
- 584
0
votes
3
answers
1k
views
How smart is storing passwords and usernames in files?
So, I wanted to make a login system with PHP, and basically what it would do would be to have a file for usernames and a file for passwords so when a user tries to log in, it just gets information ...
2
votes
1
answer
135
views
Are there any risks with prepopulating a username from a querystring on a login page?
So, we've got a fairly standard login page on a web application.
We want to make a slight change so that if a user gets their password wrong, the page reloads (as it currently does) but the username ...
- 121
116
votes
13
answers
30k
views
Is it good or bad practice to allow a user to change their username?
I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven't found anything. In my particular case, the product is a website, but ...
- 1,061
7
votes
2
answers
2k
views
I accidentally entered password for a website as a username for another website
First and foremost, I am sorry for posting anonymously for security reasons. Exposing my identity might mean exposing my vulnerability, which comes from the problem decribed below.
I have accounts in ...
- 71
2
votes
1
answer
6k
views
Storing Username in sessionStorage: bad idea?
I am working on React-Django application that uses JWT for authentication. The user signs in with their username and password, the server validates and responds with JWT and username, and (currently) ...
- 223
5
votes
2
answers
491
views
Someone has registered my partner's recycled email account
My partner has a unique name, and while we can't truly be certain, we're almost 100% sure she is the only one in the world with it.
Once upon a time she had a Hotmail account with her name as the ...
- 195
60
votes
13
answers
27k
views
Why not use a national ID as username for every website?
Everyday we visit many websites, including our university's website, maybe Google, Yahoo, etc. But on each of them, we have a unique username, while each person in a country can have a "national code" ...
- 759
0
votes
2
answers
290
views
Password and Login verse very long string (token)
I'm building a PHP login system that uses a username and password at first to grant the user a token and uses that token to grant the user access to their account.
My original thought was to force ...
- 199
1
vote
1
answer
256
views
Is it unsecure to let my personal computer user name be known publicly?
I took a screenshot of a certain finder window to ask a question on apple.stackexchange, and the image includes the name of my home folder, i.e. my user name.
Should I bother to blur that out?
Is ...
- 113
1
vote
1
answer
209
views
Is username and password needed to register and authenticate user in zero knowledge guillou quisquater?
I want to make guillou quisquater authentication for a website with Laravel (PHP). The authentication is between server and client(user). In the references i've read (here and here) the registration ...
- 13
1
vote
1
answer
105
views
Is any security gained from bank issued usernames in this authentication flow? [duplicate]
My Bank's Online Banking feature doesn't use usernames. Instead, they assigned me a digit-only account number*. To log in, I enter my number, then it brings me to a new page to prompt for my password. ...
- 113
0
votes
1
answer
2k
views
Is it bad practice to accept phone number or email as username?
On a website in which all of users' information (line Username, Email and Phone Number) are stored safe and hidden (from other users and public world), is it bad practice to accept email address or ...
- 867
2
votes
1
answer
7k
views
Spoofing the identity of another user in Telegram
In telegram you can setup a unique public username which is available to anyone in the search option, but if you choose not to do that, the only way someone can identify you is by the name you set (ex....
- 21
0
votes
1
answer
133
views
Account information gathering on subnet device
I have a cybersecurity test coming up. We have a practice test, but no solutions. One question involves being given a fresh Kali VM and a target IP on our subnet, and having to discover as many ...
- 139
6
votes
3
answers
499
views
Is asking for password before asking for email/username more secure?
When I - and many others - login on a webpage or someone else, I type: <email or username> [tab] <password> [enter].
In case of making a specific typing error - not pressing [tab], the ...
- 473
4
votes
3
answers
476
views
What can be done to secure passwords that might be stored in plain text or hashed inside a git repository?
I've heard a lot lately about coders being really bad at security. For one they store passwords and sensitive information inside Git repos which are often not secured well enough. Someone then comes ...
- 1,385
1
vote
2
answers
178
views
Does an image showing exception error on my site pose a prominent security risk?
I wrote a small website in PHP and ZF2.
Had a friend test it out by posting a link to it on Facebook.
Apparently I forgot to turn off ZendFramework reporting and he find an error. Posted a photo ...
- 123
79
votes
3
answers
17k
views
Does correcting misspelled usernames create a security risk?
Does correcting a misspelled username and prompting the user with a valid username introduce a security risk?
I recently tried logging into facebook and misspelled my email. They prompted me with ...
- 865
3
votes
1
answer
1k
views
Should I use random usernames for a MySQL database? [duplicate]
I have a script that accesses a MySQL database - clearly a strong, random password and a username unique to the script with no more privileges than it needs are all sensible norms here.
However, is ...
- 218
31
votes
7
answers
7k
views
Does username length/complexity/uniqueness positively impact security?
Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security?
This is assuming that adversaries aren'...
- 625
5
votes
3
answers
968
views
How can I keep usernames out of /etc/passwd on LINUX [duplicate]
I've been challenged with auditing a systems security on a scenario and giving various areas we have to audit. Most of which were easy to understand and to provide vulnerabilities as well as ...
- 51