in reply to diana 🏳️‍⚧️🦋🌱

@dianea
I worked on a project where they toyed with keying user accounts on username-password, so multiple users could have the same username but remain distinct because their passwords would be different.

Lead dev was really excited about the idea until I suggested "error: that username-password combination is already in use"

in reply to Mx. Eddie R

in reply to Jonathan Lamothe

@me @dianea @silvermoon82
Because if you don't think about that problem, it sounds like a good idea.

If you have many users, usernames don't work very well. Think about real life names. Who is Peter? We have 245 of those. Ok, who is Peter Smith? 67 of those. How about Peter Smith on East Road? Which county?

In real life, we just keep asking for more information until we have a unique match. Computers want a unique id up front, and nobody thinks that asking users to enter their full address (including Country, there are also several Peter Smiths in Germany) every time they log in is a good idea

Some people try using email addresses as usernames, but that creates more problems than it solves.

But if you have good passwords, two people with the same name should be unique if we identify them with username-password. And tech people understand good passwords, and forget that most users don't.

For Dave in development who uses uuidgen to create is passwords, and Dave in ops who let's his password manager generate a 16 character random string, this scheme works perfectly. But for Peter in marketing and Peter in HR, who both recently learned about character substitutions from the same IT 101 class, and both ended up with P@ssw0rd, it will never work.

This website uses cookies. If you continue browsing this website, you agree to the usage of cookies.