Should your username be more like a password?
Everyone Leo Notenboom here
for Askleo.com, let's dive right into the question.
Wouldn't it make sense to have usernames, follow the same rules as passwords?
Wouldn't that make things even more secure
if the hackers couldn't guess the usernames as easily as I assume they can?
I'm surprised no one's done this.
So I actually have run into at least one scenario where this does happen.
I'll explain that in a minute.
It's pretty obscure,
but it's an interesting question and it's one that I do get asked from time to time.
It's not a silly question at all.
The problem really boils down to that...
It's not always practical.
And even if it were, it doesn't really get you as much security as you might think.
First, it's not always an option. We, of course,
are at the mercy of the various services and sites that we sign up with.
We do what they need us to do, right?
We either use a username or an email
address to identify ourselves or sometimes both.
But the bottom line is it's up to them what they want.
Very often the username is preassigned,
so we actually don't have a choice in the matter.
And it just isn't something that's in our control.
They could switch. I get that.
But as we'll see, there's not a lot of point to it.
One of the reasons there's not a lot of point to it is it's often recoverable.
Consider that if you have a username, be it complex or simple and you forget it.
If your account has an email address
associated with it, well, not unlike a password, you can recover it.
In fact, it's not uncommon at all
for sites to have both a forgot your username and a forgot your password link
if they happen to use both in addition to your email address.
The biggest issue, at least from my perspective,
is that your username is going to be discoverable in breaches.
We often see that email addresses and other information about your account
is discoverable in breaches, but your password is not.
Security, when done properly means
that a hashed version of your password is stored and not your actual password.
The username, on the other hand, much like all the other information,
is stored in clear text because there's no appreciable security
benefit to making it, to securing it, some other way.
Now, that being said, you're certainly more than welcome to do it.
By all means, if if using a long,
complex username, remember a different one for each site.
Makes you feel better, makes you feel more secure.
Go for it.
It does indeed add
a little bit of security for the very reasons that you suggest,
where it's done, where it's possible and where it's stored, perhaps safely,
it is making your account a little bit harder to discover.
And of course, in order to remember all
of these different usernames with all of these different passwords,
you're going to need something, right?
You're going to need to use a password vault to remember it all for you.
That's actually what would make this possible.
In fact, if we switched today to complex
usernames as a requirement, most password vaults would not need to change.
They're recording your username, whatever it might be.
So there's at least that working in your favor.
There's another argument that says instead
of having complex usernames, should we at least have
different usernames for different accounts, for example?
And
to be totally honest, I do this, but only for a couple of key accounts.
I do it, for example, with my Amazon account,
my username on my Amazon account, which needs to be an email address,
is a slightly different email address than my quote unquote, real one.
I do this not for the additional security.
I do this because
if I ever get email on that email address that isn't related to my Amazon account,
I know something's wrong.
I know I need to do something. I don't know what it is.
It depends on the situation.
But I just know that I need to do something.
That's what I use it for.
It's not giving me any extra security.
It's not particularly less discoverable, but it is allowing me a little bit more
granularity about understanding what's going on when I get an email.
Now, there are scenarios where random usernames
are valuable. There are two of them, actually.
One is if you're trying to be anonymous,
in other words, you're setting up a new
anonymous email account on Outlook, Dotcom or Yahoo!
Or whatever, and you want a username that doesn't leak information.
Right. It doesn't leak any information about
who you are, how you think any of that kind of stuff, then absolutely.
Picking a random username, potentially even using a random password
generator restricted to only letters and numbers might be a way to go.
The other, and we see this all the time, is spam, which, when you think about it,
is really sort of a subset of the anonymous case.
Spammers are trying also not to necessarily be findable,
so they end up sometimes using completely random usernames as email addresses.
Now, I mentioned that there is one place,
one case where I'm actually forced to do this, and it's Amazon Web Services
when a program is given access to do
things with Amazon Web Services, for example, I might have a file transfer
program that I would configure to be able to access my storage at AWS.
I have to go online and I get what boils
down to a unique user ID and a unique password.
My assumption is that is
for the additional security, but the way that usernames and passwords
get used and passed around and potentially are discoverable,
this additional level of security at the API level for something as
important as Amazon Web Services actually makes a certain amount of sense.
They didn't have to do it, but it's how they've done it since day one.
So for each of those situations where I'm
using Amazon Web Services, I end up having to go in and not just
get that information, but in most cases, I'm actually creating that information
and setting up appropriate security restrictions on the account that I'm
creating so that, for example, the only thing it can do is is is access,
say, the online storage offered by Amazon Web Services or
or access only the computing equipment that's available on Amazon Web Services.
But that's the only scenario.
That's certainly the only place where I've actually seen it truly and actually happen
for the rest of the time, for the average user,
for even the professional user, for computing professionals.
A regular old username.
Is plenty as long as you have a long,
strong, unique password and by unique, I'm saying you're using a different
password for every site if you want to add security.
Beyond that,
the thing to do is add two factor authentication.
If it's available on the service you're trying to sign into,
that adds you significantly more security than choosing a random username.
Hope that helps.
Hope that helps clarify, like I said, this is a very honest, very obvious, very,
very common question and it it kinda sorta makes sense on the surface.
But it's one of those things where when
you dig down deep into it, it's not getting you as much as you think.
And there are, like I said, Two-Factor authentication types of solutions that are
simpler and get you a lot more security from the get go
for updates, for links related to the article on which this video is based.
For comments and more, visit askleo.com/131745.
I'm Leo Notenboom.
This is Askleo.com.Thanks for watching.