samedi 28 mars 2015

Login Credetials: Why not drop the username?

I was just about to write my hundredth login form when a thought crossed my mind: Why do I need a username?


A while ago my dad had to change his e-mail-address, and he still didn't figure out, why he can't log into various websites with his new address. I'm also not a huge fan of individual per-site usernames. And wouldn't it be easier to remember only a password?


What are usernames good for? You obviously need some unique string to identify a user by. If you had just the password, that would work until a user picks a taken password and you would have to tell him “Sorry, 'GreatPassword123' already belongs to another user” — bad idea.


So part of the password needs to be unique. My idea: Predetermine the first three characters! You could choose from lower- and uppercase letters and digits, providing (26+26+10)^3 = 373,248 unique prefixes. At registration, the user would get a dialog, telling him that he only needs a password, and it starts with “N0i” for example, he has to pick the rest (“deaWhy” comes to mind). He can then log in with his password only, being “N0ideaWhy”, not knowing (or caring) that “N0i” actually is a unique username.


I see the following pros and cons:


Pros



  • independence from e-mail-addresses

  • user needs to remember just one string

  • might reduce password reuse

  • safe from leaked lists

  • faster login through fewer keystrokes


Cons



  • need to split the password-string and submit the first three characters unencrypted while hashing the rest

  • scalability comes to a dead stop at 373,248 users (or 26.8 million if you use four characters)

  • users might be skeptical / unexperienced / thrown off by not being able to reuse their standard password


I'm really wondering why nobody else did this so far? Are there any concerns that I missed?





Aucun commentaire:

Enregistrer un commentaire