MyBB Community Forums

It would be harder to hack an account if you didn't know their username.

We already have plans to include a more powerful username management system (for example, a moderation queue of name change requests) so there would be little advantage to be gained in this respect.

From a security standpoint I don't think it is that significant either, if the password was obtained via phishing then they would have their login name too and brute force attacks are pretty much unfeasible with the current measures (ie. timed account lockout after having too many incorrect password guesses). Plus, you could just make your password twice as long and it would be just as effective as having a separate login name in terms of protection against a brute force attack.

I'll be adding to Tim B; you can even create a separate low profile account that has access to the ACP rather than your public "admin" account.

Not a bright idea as the others mentioned.

(2011-07-08, 08:46 AM)iDude Wrote: [ -> ]I'll be adding to Tim B; you can even create a separate low profile account that has access to the ACP rather than your public "admin" account.

Not a bright idea as the others mentioned.

Could already be done through permissions and all that.

So basically the same kind of system SMF use.

(2011-07-07, 09:49 PM)Darth Stabro Wrote: [ -> ]It would be harder to hack an account if you didn't know their username.

This is probably the main argument for doing it.

Even with that argument, I still can't see a reason to use this over logging in with your email, which I think would be a much better feature.

That's the other solution if you can login with your email.

It makes more sense logging in with your email, rather than a username/display name system.

I'm thinking we might have a setting in the registration options to choose between using emails or usernames for logins, that should be pretty easy to implement.