4 ms·

You could use a username too, right? Because <unique username> + <any password> should be unique.

• mistercow 13y ago
  Not quite. Say user "fortunate_sonar" uses "arkansas" for a password, and "fortunate_son" uses "kansas" as a password. You can use a delimiter to reduce the chances of that happening, but it's not strictly unique.
  • fnayr 13y ago
    You mixed the passwords up.
  • phaer 13y ago
    Well, if you use a delimiter which you forbid in usernames and Passwords it should be okay, no?
• gabemart 13y ago
  Not really. A username of 8 characters and a password of 8 characters ensures no more entropy than a password of 16 characters and not bothering with a username. It might even provide less, given that the user is more likely to share their username with others than they are to share half their password.
  • rch 13y ago
    How about a long-ish memorable phrase and password, encrypted with scrypt? Hit the output with base64 and use the first N characters of the, possibly hashed, result (haven't tried it, so I'm not sure what stage of the output would be most memorable). The results should be about as easy to remember as a routing number + bank account, which is something my friends and I all do.
  • phaer 13y ago
    I meant that you can enforce uniqueness for usernames more easily than for passwords.