Lets go further: [username, password] is obsolete entirely. Have a large-entropy key, that is your account key. You know, like a Swiss bank account number? Use

Lets go further: [username, password] is obsolete entirely. Have a large-entropy key, that is your account key. You know, like a Swiss bank account number? Use that to log in, and ... that's it. You want human-readable renderings? Decorate the account with (optional) annotations like 'owner name' and address and so on. But that absolutely has no place in identifying or authenticating access to the account. Go further: If somebody logs in with a key you've never seen, then just give them a blank account. So you don't leak even the existence of an account, which is another security hole. My server for an IoT system is, you don't have a key? Give me an email, I'll mail you one. That's it for security, done, fini.