The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [user-names]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
146
votes
6answers
22k views

Is password entry being recorded on camera a realistic concern?

I live in a city where CCTV camera coverage is comprehensive and increasing. Cameras are getting cheaper and higher resolution. Everyone has a video camera in their pocket already, and we are starting ...
115
votes
13answers
22k views

Is it good or bad practice to allow a user to change their username?

I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven't found anything. In my particular case, the product is a website, but ...
75
votes
3answers
15k views

Does correcting misspelled usernames create a security risk?

Does correcting a misspelled username and prompting the user with a valid username introduce a security risk? I recently tried logging into facebook and misspelled my email. They prompted me with ...
73
votes
7answers
16k views

Are random URLs a safe way to protect profile photos?

I would like to move from sequential to random user IDs, so I can host profile photos publicly, i.e. example.com/profilepics/asdf-1234-zxcv-7890.jpg. How long must user IDs be to keep anyone from ...
58
votes
13answers
27k views

Why not use a national ID as username for every website?

Everyday we visit many websites, including our university's website, maybe Google, Yahoo, etc. But on each of them, we have a unique username, while each person in a country can have a "national code" ...
44
votes
10answers
24k views

Why use usernames and not just email addresses to identify users?

Why use usernames, and not just email addresses, to identify users? - What is the main concern or the main case when a security expert (which I'm not) should recommend inserting another layer of ...
34
votes
5answers
5k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
30
votes
4answers
6k views

Should I be worried if I accidentally entered my password in a username field?

Occasionally I will fail to hit Tab properly when entering a username/password combination. This results in me submitting username "myUsername$ecretPa$$word" along with a blank password. I always ...
29
votes
7answers
5k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries aren'...
26
votes
5answers
3k views

Why do “Forgotten Password?” links generally reveal usernames or registered email addresses? [duplicate]

It seems that most sites or systems will just state Invalid username or password As a means to not reveal usernames for use in brute force (and other) attacks. Seems like a good idea as a ...
14
votes
3answers
18k views

Why is there a minimum username length?

In some (web) applications there is a minimum length for usernames, usually there is a restriction for a minimum of 6 characteres length. For example, free gmail accounts and miiverse (Nintendo ...
13
votes
3answers
4k views

How to handle emails as usernames under GDPR?

Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
11
votes
4answers
2k views

Are short usernames a security concern?

I was somewhat suprised that the sysadmin approved a one-letter username like "m" and my username is also short ("nik"). I think that if usernames are brute force attacked then the username should ...
9
votes
6answers
1k views

What methods can be used to prevent mistyped usernames?

I wanted to log on to my account on my bank's website. The account is protected by a number of security checks. The first one is what really amounts to a username, a confidential one. It's an 8-digit ...
7
votes
2answers
1k views

I accidentally entered password for a website as a username for another website

First and foremost, I am sorry for posting anonymously for security reasons. Exposing my identity might mean exposing my vulnerability, which comes from the problem decribed below. I have accounts in ...
6
votes
1answer
397 views

CAPTCHA enough to thwart user enumeration?

Say I have a site that has a user registration process where, when a user enters an email address already in use, an error message is displayed telling them that. This seems like a easy way to a ...
6
votes
3answers
362 views

Is asking for password before asking for email/username more secure?

When I - and many others - login on a webpage or someone else, I type: <email or username> [tab] <password> [enter]. In case of making a specific typing error - not pressing [tab], the ...
5
votes
3answers
2k views

What are the benefits to a two-page login system for a webapp?

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit. ...
5
votes
4answers
277 views

Is revealing a PC account user name bad?

Typical computers with modern operating systems require log-on accounts with a user name and a password. Is it dangerous to reveal the user name of the log-on account to the public? My research: I ...
4
votes
4answers
722 views

Why is a password accompanied by a username deemed 'safer'?

While browsing this community I notice that some people say that the main advantage of usernames accompanied by passwords is as they take more tries to be brute forced, however I don't think that is ...
4
votes
3answers
219 views

What can be done to secure passwords that might be stored in plain text or hashed inside a git repository?

I've heard a lot lately about coders being really bad at security. For one they store passwords and sensitive information inside Git repos which are often not secured well enough. Someone then comes ...
4
votes
2answers
4k views

staying not signed in: is it the safest procedure?

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
4
votes
3answers
539 views

How can I keep usernames out of /etc/passwd on LINUX [duplicate]

I've been challenged with auditing a systems security on a scenario and giving various areas we have to audit. Most of which were easy to understand and to provide vulnerabilities as well as ...
3
votes
3answers
182 views

Does having a number in your username make it more secure?

So I've noticed a recent (and irritating) trend to require user names to have numbers in them. Is there really any security value to this?
3
votes
1answer
530 views

Should I use random usernames for a MySQL database? [duplicate]

I have a script that accesses a MySQL database - clearly a strong, random password and a username unique to the script with no more privileges than it needs are all sensible norms here. However, is ...
2
votes
3answers
16k views

Advantages to alphanumeric-only usernames?

Let's say we are setting up some registration form for some website. I know that if input fields aren't sanitized then SQL injection can happen. But let's say all fields are sanitized correctly. Is ...
2
votes
3answers
240 views

Where can I find a list of frowned upon usernames for web sites?

There are some usernames that shouldn't be allowed to register on online services, for example: administrator, admin, root, system, owner, hostmaster, webmaster, sitename or sitenameadmin As far as ...
2
votes
1answer
226 views

Is it insecure to not let a user choose their own username, and base the username on a known pattern?

I have recently changed banks and my new bank has a benefit scheme (discounts etc.) that has its own website and different login details to my online banking (I think the benefits system is ...
2
votes
4answers
211 views

What is the risk of different responses when a login username matches or not?

I am responsible for a website that allows a user to reset the password, as usual. However, the response of the website is different whether the entered username matches or not. This would allow an ...
2
votes
1answer
3k views

Spoofing the identity of another user in Telegram

In telegram you can setup a unique public username which is available to anyone in the search option, but if you choose not to do that, the only way someone can identify you is by the name you set (ex....
2
votes
3answers
214 views

If I typed username and password, but wrongly clicked another button to go to another page instead of the login button, is there any security risk?

For example, suppose I already typed username and password at this Facebook page: https://m.facebook.com But I wrongly clicked 'Create New Account' instead of Log In. My question is, does it ...
2
votes
1answer
68 views

Are there any risks with prepopulating a username from a querystring on a login page?

So, we've got a fairly standard login page on a web application. We want to make a slight change so that if a user gets their password wrong, the page reloads (as it currently does) but the username ...
2
votes
2answers
71 views

Domain offline - are unmaintained email clients a security risk?

I have just unregistered a domain. Now my mail client (Thunderbird) popped up a message saying that it cannot connect to the mail server. That's fine - for the moment. However, I wonder what would ...
1
vote
3answers
946 views

How can hackers access WordPress usernames? [duplicate]

Recently I've had brute force attack attempts on some of my WordPress sites and the attackers are using actual usernames other than the default admin (which was removed). How is it possible for them ...
1
vote
3answers
286 views

What are the benefits of logging the username of a failed authentication attempt?

From time to time, some users can accidently type their password in the username field, either because they missed the tab key or because they thought their account was simply locked, not logged out (...
1
vote
2answers
125 views

Email used to log in but doesn't have to be unique. Issues?

I've moved onto a project where they are implementing a system whereby a user's email address can be used multiple times by different people - i.e. users can sign up as many times as they want with an ...
1
vote
1answer
119 views

Linux file information leakage

What information is kept in a linux file about the user and/or system that created it? I want to make some files publicly available, posted on another server such as GitHub or FTP, but I'd rather the ...
1
vote
1answer
105 views

Should I treat my SSH username like a secret?

I'm trying to automate the deployment of my blog. Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me. ...
1
vote
1answer
150 views

Is it unsecure to let my personal computer user name be known publicly?

I took a screenshot of a certain finder window to ask a question on apple.stackexchange, and the image includes the name of my home folder, i.e. my user name. Should I bother to blur that out? Is ...
1
vote
1answer
48 views

Should pin numbers expire?

We're using pin number for username retrieval process. Similar to a standard bank solution where a user must enter their ssn and account number to get their username. Is it necessary to expire this ...
1
vote
1answer
2k views

Storing Username in sessionStorage: bad idea?

I am working on React-Django application that uses JWT for authentication. The user signs in with their username and password, the server validates and responds with JWT and username, and (currently) ...
1
vote
2answers
127 views

Does an image showing exception error on my site pose a prominent security risk?

I wrote a small website in PHP and ZF2. Had a friend test it out by posting a link to it on Facebook. Apparently I forgot to turn off ZendFramework reporting and he find an error. Posted a photo ...
1
vote
0answers
51 views

What might an attacker do with email address as login name?

This might have been asked before, but I've looked for a few hours and can't find much. I would also like some opinions on what an attacker might do if he enters an email address on a site and it ...
1
vote
1answer
139 views

Is username and password needed to register and authenticate user in zero knowledge guillou quisquater?

I want to make guillou quisquater authentication for a website with Laravel (PHP). The authentication is between server and client(user). In the references i've read (here and here) the registration ...
1
vote
1answer
63 views

Is any security gained from bank issued usernames in this authentication flow? [duplicate]

My Bank's Online Banking feature doesn't use usernames. Instead, they assigned me a digit-only account number*. To log in, I enter my number, then it brings me to a new page to prompt for my password. ...
1
vote
0answers
654 views

Password automatically typed into user box on facebook [closed]

Just want to ask some questions regarding on this strange experience while logging on my account on Facebook There are cases that I'm accidentally typing my password into the username box of the ...
0
votes
1answer
117 views

Should we use different usernames for each website, to achieve better anonymity?

I have big problems trying to remember different usernames for each site. Chrome remembers only passwords, so I should install a password manager, however it's crazy you have to do that in order to do ...
0
votes
2answers
1k views

How to encode a username in PKIX certificate?

I was reading through RFC 5280, PKIX Certificate and CRL Profile, Section 4.2.1.6, Subject Alternative Name: The subject alternative name extension allows identities to be bound to the subject ...
0
votes
3answers
274 views

How smart is storing passwords and usernames in files?

So, I wanted to make a login system with PHP, and basically what it would do would be to have a file for usernames and a file for passwords so when a user tries to log in, it just gets information ...
0
votes
1answer
96 views

Username visibility on network

People in the security world recommend changing the hostname of a computer to something that is not connected to the user. For example: "don't name it: MacbookPro Erica." This way IT staff and '...