15

In some (web) applications there is a minimum length for usernames, usually there is a restriction for a minimum of 6 characters length.

For example, free gmail accounts and miiverse (Nintendo social network).

Why is there a minimum username length? And why a minimum of 6 characters?

RockPaperLz- Mask it or Casket
  • 3,114
  • 21
  • 50
ilazgo
  • 2,743
  • 4
  • 12
  • 10
  • A guess would be that they want to reserve some special ones for themselves, admin@, root@, owner@, domen@. Or they just don't want to deal with many many collisions that would happen. I wonder if there are more "valid" reasons. – domen Dec 12 '13 at 13:08
  • First off I don't want nor need a mommy to watch over my accounts. I can handle them quite well. I wish to use my FCC legal amateur radio call sign as my email name(5 characters). It was issued to me and, to me only. Anyone found using it any form of communication, without my permission, is in direct violation of the FCC rules and subject to a very large fine if they persist. I find this argument of small names are more likely to be spammed to hold no merit. I get tons of spam with longer names. The spammers can glean out the email addresses extremely easy. Many sites are setup to look legitim –  Feb 03 '16 at 20:39

3 Answers3

11

Frankly, I find such limits quite silly; any claim that a minimum length on the username has any security merit is ridiculous. Usernames are supposed to be public, they're not secret information (in the vast majority of cases). This is even more silly in systems where the usernames are used as communication handles and you're encouraged to share yours.

Some service providers believe that longer usernames are better to combat spam targeting auto-generated email addresses. Here's Google's take on this one

We've discovered that short usernames at popular domains receive significantly more spam since they're easy to automatically generate. Gmail's requirement that all usernames be at least six characters in length is meant to keep spam out of your inbox.

Hayden Schiff
  • 105
  • 4
Adi
  • 43,808
  • 16
  • 135
  • 167
  • Your comment seems to assume that everyone's goal in IT is the same. While its true that in some services usernames @ domains become people's e-mail address, this is certainly not the case everywhere, such as in large enterprises. Its more the case at Universities and ISPs. Usernames are certainly not always supposed to be shared with others. – deltaray Dec 12 '13 at 16:29
9

I agree that having a longer or shorter username should not be a point for making your account more or less secure. That's what the password or any other proof of identity should be doing. The username is just a way of addressing you and it's totally public.

The only requirement is that it be unambiguous - you can't have two people using the same username.

I will say that there's probably a value to starting the number of required characters at some minimum limit as a way of resolving contention over very short, very easy to remember usernames. Forcing everyone to go with at least 6 characters is a good way to keep users trying to set up their usernames from thrashing through all possible < 6 character options only to find that all of the have been taken. Cutting down the frustrated users is a big deal on a large scale system like Google - which is also why you see suggested usernames to help you try to find something that's available that you can live with.

I'd believe them when they say that spam is an issue on short usernames - the smaller the address space, the easier it is to cover, and I would not be surprised to find that spammers can cover the < 6 character username space pretty efficiently. I'm not sure I believe the "it's for your own good" line - I think it's for Google's own good. If they can simply deny ALL email that comes in for a username that is less than 6 characters, that's a nice chunk of traffic to be able to flat out deny without further matching needed. The more clever your spam filters, the more resources they can take to execute, so being able to flat out deny any chunk of your username space has got to be a win.

I'd agree that in a small userbase - like a private domain or a small company - it's probably less valuable as you have neither the large size user base nor the huge level of traffic/storage requirements of a social networking site.

bethlakshmi
  • 11,606
  • 1
  • 27
  • 58
  • 2
    As an extreme example of the "contention over very short, very easy to remember usernames", I offer http://arstechnica.com/security/2014/01/picking-up-the-pieces-after-the-n-twitter-account-theft/ in which someone stole the Twitter handle @N by holding the rightful owner's domains hostage. According to the original owner's article (linked from the above), the handle was valued at $50,000 at one point. – Mike McManus Feb 03 '16 at 23:43
3

Ok, first things first..

As we know from basic security theory the most common way to crack a password is by using all possible entries (brute force). A password's strength is computed by the complexity of the characters it contains. So supposing that all the alphanumeric are 62, the complexity of a brute force attack for a 6-length password(without special characters), would be 62^6= 56,800,235,584 possible combinations.

Now for a mail-site , like gmail or hotmail, creating a mail with less than 6 characters would be very possible to be generated by a spam mail algorithm. So to avoid getting spammed, email-sites prompt you to use more than 5 characters.

Finally, my guess, on a common site a user could use 5 or less characters long username, but on a site with many users, that would be extremely difficult to find a username that doesn't already exist.

Jack
  • 71
  • 1
  • 7
  • Interesting point. You'd still be vulnerable to dictionary spamming though. – domen Dec 12 '13 at 13:10
  • there is always an attack that can get you disposed. I guess the whole meaning is just to minimize the possibility an attack has to succeed. – Jack Dec 12 '13 at 13:47
  • gmail also allows to enter dots anywhere in the name. therefore this not only reduces spam but also to prevent hitting duplicate usernames too often (as they can't differ with the dots). not known gmail from the inside so can't say if that really is an issue, but this could be a consideration as well. `maxor` `m.axor` `ma.x.or` - the chance to have the same five characters (without the dots) is higher than having the same six characters. – hakre Jun 09 '22 at 16:16