New answers tagged security
As a developer creating an application for capital markets, I do not want to verify email addresses as valid by checking against any third party email providers even if they are good ones. I dont even allow anyone to sign up on their own. An admin signs them up, gives them a username. The login page itself is also an https. This is just because all banks, ...
There are a lot of good things up here, but it misses one key point: you can't use an email address for a password reset, because it's not secure enough, and you don't use an email sign up. Those are the two key reasons why almost every online service has an email address associated. Without them, there's no reason not to use a username instead.
I can speak from the bank accounts I know in europe: You don't even need an email address to have an online banking account, as registration usually happens offline - you get Pin and everything via postal mail. Since you don't need an email to use the account, it does not make sense to use email as username.
There are a number of reasons: It prevents someone causing someone elses account to be locked maliciously (if I know your email address and you bank with Barclays I can lock you out of your account by repeatedly attempting wrong passwords). As @AlexFritz indicated it makes it harder to try hacked username and password combinations from other sites on the ...
Email is less secure than online banking (I hope) so maybe the thinking is that since people tend to use the same passwords for everything, using email instead of username for bank login would create a vulnerability in the case of email passwords leaking, the thief could go around and try that email password combination a bunch of places, and probably ...
My experience from local government, where money was involved, is that user-names provide another level of security beyond an email address. It was the generally held opinion that someone could relate an email address to an individual but a user-name could be unique to that site. It's a fairly arbitrary measure, but it's a measure.
My favourite is the 2-step verification by Google. It requires you to perform a second step of verification by entering a code after having entered your password. By default the code is required for: every time for any new device you're using to access your account every 30 days for any device you didn't mark as trusted device The code gets generated by ...
Top 50 recent answers are included