Hacker News Reader

Comment by rokkamokka | Hacker News Reader

I'd argue that the really old custom of providing the user a fixed username (e.g. user ID) upon registration, and requiring that for login, provides complete protection vs credential stuffing. It has other drawbacks of course, which is why you rarely see it in use anymore...

View on HN

Do you mean a username that is distinct from email or phone number?

If so, why does that provide protection against credential stuffing? A username can be reused across different applications.

What am I missing?

> Do you mean a username that is distinct from email or phone number?

No, he means a unique user id, generated by the server when you sign up for the service. Then for every login attempt, you provide the username/email + user id + password.

Thanks.

Would love to hear from other folks who have implemented this on how it affects the user experience. Seems to me it'd be high friction.

How does providing a predictable username protect against anything at all?

Because credential stuffing relies on the user reusing a username + password from another site. If you provide the user with a username they don't select, it won't be reused.

But then they have to remember the username AND the password? This doesn't help with users already having the password re-use problem. This would only work for those with a password manager, but then they are also less likely to re-use a password.

Also, wouldn't this prevent lost password recovery? if you can't identify a user by their email?

> But then they have to remember the username AND the password?

The commenter already acknowledged that the solution has drawbacks. The only claim made was that it solves credential stuffing, not that it doesn't inconvenience the user.

> This would only work for those with a password manager

It would also work for those without a password manager, because they'd have no choice.

> Also, wouldn't this prevent lost password recovery? if you can't identify a user by their email?

They're not mutually exclusive. You can have both. A compulsory unique user ID to login, and an email based password recovery mechanism.

Yes, there are clear ergonomic reasons why we don't do this "assign a username" thing. But it would stop password stuffing.

You'd presumably do username recovery the same way you do password recovery, so it would only be accessible to an attacker who compromised the user's email.

I haven't used it for 45 years, but my CompuServe user ID was [72175,1425]. I like that they assigned it themselves with no input from me. (I'm cursed with a good memory for useless things.)

https://en.wikipedia.org/wiki/CompuServe

Reply on news.ycombinator.com