hornbyp wrote:
timo_w2s wrote:
...surely not knowing the username OR password makes it even harder to guess the correct combination?
Correct!
A username/password "combination" of, say, 10 + 10 characters each is just a combination of 20 characters
so guessing 10+10 is no more secure than guessing 20...
i.e. admin/12345678901234567890 vs. frank/123456789012345
If you don't know the Username the password relates to, it's of no use to you at all.
How would you know a password without a username ? Obviously, you could, but give an example of how it might come about?
Changing the 'Administrator' username as a security precaution, was something I learned in about 1983
Well, assuming the same number of characters in each combination (like above) it's not. It only provides the abilityto differentiate between users.
from the Vax/VMS Security Manual.
Maybe Vax only allowed a limited password length or they assumed people would not use long passwords.
Clearing out the last used Username on a Windows logon, is a recommended practice (set via Group Policy).
That's because in Windows, usernames are used to differentiate users - so if you know "Jim" is the user, you know who your target is, making reconnaisance easier. Also, windows now uses PINs (optionally) which can be very short.
In reality, people won't use long/secure passwords, so a different username does effectively 'extend' the unknown factor length, but that wasn't the point being made. Given a fixed username, a longer password will be as secure than a shorter one with a different username.
