5 ms·

I've been wondering that too. If possible, it'd be nice to combine username, second-factor, and password, as they all perform different functions that people o

• rothbardrand 9y ago
  Setting up a new device does require three factors: Username, Password and a 2FA on an existing device. But even with a 4 digit PIN most people didn't have PINs set up on their devices, so increasing friction will not result in more security. If you want max security now, you can simply turn off TouchID or FaceID and us a very long alpha numeric password.
• ballenf 9y ago
  Large public systems could do away with usernames if they assigned random, unique passwords to users out of a large keyspace. Usernames allow the keyspace to be smaller and the keys have less entropy making user chosen keys possible. But then we add key minimum entropy requirements (sometimes using only length as a proxy) in order to combat the freedom given. Would be interesting to see whether username-less public systems suffer fewer intrusions. Some users would record their passwords in unsafe places, but they couldn't reuse a password eliminating password stuffing as an attack surface. Of course, if you allow password resets you'd still have a kind of "backup" username presuming a person's email address could be used for the reset. But that wouldn't significantly weaken the security, arguably.