Credential stuffing is a huge problem. I am not sure if allowing users to use non-email addresses as a user-name helps solve that problem, though. I would be i

Credential stuffing is a huge problem. I am not sure if allowing users to use non-email addresses as a user-name helps solve that problem, though. I would be interested in reading research on the subject.