Yes, there are clear ergonomic reasons why we don't do this "assign a username" thing. But it would stop password stuffing.
You'd presumably do username recovery the same way you do password recovery, so it would only be accessible to an attacker who compromised the user's email.
> But then they have to remember the username AND the password?
The commenter already acknowledged that the solution has drawbacks. The only claim made was that it solves credential stuffing, not that it doesn't inconvenience the user.
> This would only work for those with a password manager
It would also work for those without a password manager, because they'd have no choice.
> Also, wouldn't this prevent lost password recovery? if you can't identify a user by their email?
They're not mutually exclusive. You can have both. A compulsory unique user ID to login, and an email based password recovery mechanism.
Re:Credential Stuffing
by anonymousiam on Friday October 17, 2025 @02:02AM
(#45613711)
I haven't used it for 45 years, but my CompuServe user ID was [72175,1425]. I like that they assigned it themselves with no input from me. (I'm cursed with a good memory for useless things.)
Also, wouldn't this prevent lost password recovery? if you can't identify a user by their email?