Case in point, I operate a service that uses numeric identifiers. Going by the helpdesk queries, our users are more likely to get their email address wrong than their membership number.
And how often do they forget their numbers (rather than getting them wrong)?
It's amazing the results you get from treating your users like competent human beings rather than idiot cattle.
All this snark just to dodge obvious questions about your approach?
Speculation on the potential scalability of this approach seems absurd given that membership numbers have been successfully used by organisations of every scale for centuries.
The concern is not with the scale of the organization, but with the number of organizations a user is a member of, which has exploded since website accounts appeared.
While I don't disagree that there's a lot of useless account creation, I'm still member of at least magnitude more of useful online accounts that I or my parents ever were offline.
I know that whenever I have to contact a service for which I only have a long numeric number I have some reference handy to make sure that I don't fuck it up.
Right, sure.
That's really not an issue. It isn't much easier to remember that I'm "John28161" on a busy site. Websites have been offering "I forgot my username" functionality for ages, so as long as you remember your e-mail address, you're fine. Also, just let users bookmark their personal profile page (foo.site.com/user/83755567565) easily and it's solved even if cookies are deleted. Apps won't have a problem either way.
Digits are much easier to spell over the phone than a mixture of letters and digits.
People are used to identifying themselves with a sequence of digits. If you're dealing with the tax office, the water company, the electricity company, or whatever, you get asked for your customer number, your meter number, your reference number, and so on, and usually these consist mostly of digits. Sometimes these identifiers are way too long, or several different identifiers are unnecessarily used, or the same sequence of digits is confusingly referred to by several different names ("customer reference", "account number", whatever), but those are separate problems.
It's not a level comparison though. You don't need those numbers often, and when you do, you have all the resources you need with you, and it's not urgent. You generally need those when you call customer service, which you only do when you're at home and have time to spare. But if every email, messaging/social networking app, bank, credit card company, shopping site, etc. required me to go hunting for a 10+-digit number, I wouldn't have any trouble understanding it, but I would get fed up pretty fast.
You have to remember your UUID? Probably it would be more like a file than a string.
100595964940551841549 isn’t exactly usable for that. Even phone numbers, such as 01573 0677867 are much shorter, and they follow a pattern.
And in either case, someone will end up with huge, unwieldy numbers. By using ascii identifiers, they’ll be 3 times shorter, though. Facebook’s number is just "WvN1+8Yd" in base64.
And at that point, why not allow people to choose identifiers? John.Doe.123 is still much more readable than 100001702987293
This gives every 'username' an effectively unlimited space of identifiers via the number suffix, and it trains users to realize that 'person who controls the account with username X' is not necessarily the same person as 'person who I know on other sites as username X'.
0118999881999119725....3
Though yes, i agree that once the nr of accounts start going above 1 or 2 a password manager will be required.
It’s not as good as, say, 1Password but it’s more likely to get used. Combine it with the browser or OS level password manager. It’s good enough for grandma, definitely better than “kitten4” that she’s currently using everywhere.
On a tangent, stereotyping this as “grandma” is a bit unfair. Most of my colleagues are college educated males in their 20s, some of them developers. And their passwords are rubbish, with no password manager, and no 2fa.
(And re: the grandma thing: it's nothing specific to grandmas, it's because the moment you suggest your audience is "college educated developers in their twenties" as in your case, people throw the notion of UI/UX out the window and recommend you suggest they compile their own kernel first. It seems you just can't win.)
For most people, writing (good and unique) passwords down in a notepad is a way more secure system than having the same bad password for every account.
Having a botnet guessing the random "kitten4" password for a random user account, is as likely as having your purse stolen for the passwords on that note. FWIW "m" is almost a secure password on a root account with an SSH that allows password authentication, even if you allow brute force attacks. Imperically speaking, obvisouly it's going to fail in the end but I hope you get my drift.
This is very counter-intuitive. Is the idea that guessing both the username and the password together is much harder than guessing the password when you already know the username?
In the kitten4 example, I would guess most botnets are working from a list of usernames/email addresses that they got from leaks.
> Is the idea that guessing both the username and the password together is much harder than guessing the password when you already know the username?
No, to be clearer no one in the last 6 years has ever tried "m" as a password on my root accounts.
I feel very strongly that there is too much stigma around passwords, kitten4 is a nice password if you use it only once.
That's what my grandpa does. After failing to find his gmail address in it, he went through the "forgotten password" process. Then, after needing it the third time, we found the old password in the notebook, which was now wrong...
I can assure you that the average user wouldn't get above 15 - 20 bits with self selected words. That's often worse than most current passwords.
Is she a Visual Studio Code developer? Does she need to manage Docker containers?
Security does require new hardware because iOS is leaps-and-bounds better than any other system.
There is no other option. Nothing else comes close.
Were you expecting security in broken systems like Android? Instead of forcing security onto a broken system, just avoid that system?
The fist step of security: stop using Android.
And you haven't explained why your grandma is tied to an ecosystem. I'm honestly asking if she's a developer or not?
What is her use case? Why does she need to be on a specific platform?
(Wouldn't the question only make much sense in just one of those cases...? Not sure if I'm missing anything.)
I tried using Google Drive to sync it up, but Drive is useless for this - it doesn't open the file using the right intent on Android ("file type not recognised" or something similar it says, this used to work as well) and the Drive website makes it a pain to upload an updated file even from the desktop using Chrome.
In my case, I use KeePass 2 and KeePass2Android with Google Sync and it works decently well (I would recommend you try this). I would never recommend it to non-technically-minded folks though.
Sync looks to be for Google-domains/business only. In fact Wikipedia says it has been discontinued! I used to sync over owncloud and that worked pretty well, but the provider shut down and I haven't gotten round to setting another up.
If you're on Android, Keepass2Android [1] is an excellent app that implements the input with a special keyboard. This avoids risking your password via the clipboard. It even comes with a no-network-permission version!
[1] https://play.google.com/store/apps/details?id=keepass2androi...
Do you realize how impractical it is for users to remember these numbers for every site? Until we get to the stage where every non-English-speaking user and their grandma finds a password manager convenient, this proposal won't even pass the laugh test.