Yes, there are clear ergonomic reasons why we don't do this "assign a username" thing. But it would stop password stuffing. You'd presumably do username recov

Yes, there are clear ergonomic reasons why we don't do this "assign a username" thing. But it would stop password stuffing. You'd presumably do username recovery the same way you do password recovery, so it would only be accessible to an attacker who compromised the user's email.