Claiming that usernames cannot be a source of entropy/security needs foundation.
Back when the whole concept of authentication was new (UNIX) that was true because usernames were quite literally public information, you could see them via a directory listing. With early email (SMTP) that remained true but worse via public directories listings across-computer.
However in this context there's nothing inherent about a username that allows us to ignore its security characteristics. Unless the argument is "over the shoulder" leakage? Which I'd argue itself doesn't have a strong foundation.
Both obscure usernames and obscure passwords can contribute to the overall strength of a system. A system that allows the user to set their own password may gain particularly from pre-selected randomized usernames, as users have proved untrustworthy in the past when picking passwords (e.g. reuse, patterns, common words, etc).
As an aside, scrapping usernames and only having a password isn't inherently problematic, except two users with the same password may clash, and a password recovery scheme may be more difficult to develop. That's essentially what authentication tokens are.
> Generate a random unique password for your user and don’t have a username at all.
Because having an unknown username with an unknown password increases the difficulty of compromise via improved entropy.
> Because having an unknown username with an unknown password increases the difficulty of compromise via improved entropy.
Not necessary. It depends on the characteristics of each. If the username is truely random, sure, but then you are back in the same boat as using one random string.
Further, do some automatic challenge-response thing between the server and yourself so you are authenticated to the server, and the server is authenticated to you. Which the current username/password scheme doesn't do at all.
Our current default state (username/password where both are human-rememberable) is failing us massively. Its arbitrary, historical and currently pointless.
I don't see how relying on haveibeenpwnd can be considered secure. Many people use the same password for different sites. If your site's login credentials are just email+password you are relying on the security and honesty of all other sites that use the email+password combination.
I don't believe this is grounded in evidence. You are basically saying that given two hard to remember strings, most people will write down one hard to remember string and not the other hard to remember string. Why?
> I don't see how relying on haveibeenpwnd can be considered secure. Many people use the same password for different sites. If your site's login credentials are just email+password you are relying on the security and honesty of all other sites that use the email+password combination.
I think you are missing the point of the haveibeenpwnd service. The point is to block people from using ANY password that is listed in the haveibeenpwnd database, thus denying attackers from using that dictionary of known passwords.
Yes, using the haveibeenpwnd service offers some level of protection. But it still allows an attacker to breach a random website like funnycatpictures.com and find the email/password combinations that are not on haveibeenpwnd. Boom, that attacker has access to all those users' tax information.