> Do you mean a username that is distinct from email or phone number?
No, he means a unique user id, generated by the server when you sign up for the service. Then for every login attempt, you provide the username/email + user id + password.
No, he means a unique user id, generated by the server when you sign up for the service. Then for every login attempt, you provide the username/email + user id + password.
If so, why does that provide protection against credential stuffing? A username can be reused across different applications.
What am I missing?