People often ask me what single thing matters most for improving security. After 20 years working across IT security, my answer is usernames, not passwords. Passwords get all the attention, but usernames are the overlooked half of the problem, and they're arguably the more dangerous one.

Passwords Get the Blame, Usernames Get Overlooked

Passwords are insecure, and we need to get rid of them. But usernames, "human manageable credentials" in the formal sense, are often overlooked entirely, and that oversight is dangerous.

There's another popular but faulty assumption worth addressing directly: that "something you are," human biometrics, can simply replace the dreaded password on its own. It can't, not the way most people assume. To see why, it helps to take a fresh look at a process most people think they already understand: authentication.

Two Steps People Treat as One

Authentication, login, logon, sign-in, whatever you call it, actually consists of two very different steps.

Identification is, in a real sense, the more important of the two. It's the moment the system pulls up the specific account and prepares to check it, and here's the problem: just asking for a username is already insecure. The moment a username is produced, the system is effectively half-open. The verification factors tied to that specific account are now exposed and ready to be examined, and potentially abused.

Why Biometrics Can't Replace Identification

The growing popularity of biometric verification, fingerprints and, more recently, facial recognition, on personal devices has created a genuinely wrong assumption: that biometrics alone can handle the entire authentication process, rather than just the verification step. On a personal mobile device, this illusion holds up because the device is single-user, so the identification stage gets quietly skipped altogether, there's only ever one person it could be.

That assumption breaks down completely at scale. In a system with millions or billions of users, the false-positive and false-negative rate biometrics would need to serve as reliable identification, rather than just verification, is a threshold current biometric technology rarely achieves. Used for identification at that scale, biometrics alone become an unacceptably unreliable solution.

The Only Feasible Way to Identify Someone

The only workable way to properly identify a user, before moving on to one or more verification steps, is something that user has. That "something" needs to be genuinely secure, and just as important, if it's ever lost or stolen, the process for revoking it and reassigning identification to a new device needs to be well-defined, secure, and convenient, not an afterthought bolted on after the fact.

For top-secret government work, that thing might reasonably be a dedicated token: a card, a bracelet, a dongle, loaded with every security enhancement available. For the rest of us, we already carry the necessary device everywhere we go: our smartphone. For how that principle translates into a working system, see How WWPass Works.

Where Verification Actually Fits

Once a user has been properly and securely identified, additional factors, something you know, something you are, where you are, even what time it is, can be layered on as part of verification, if the situation calls for it. That's the correct order: identify first with something you have, then verify with everything else. For a closer look at what that layered verification can look like in practice, see MFA: Why Quality Beats Quantity.

FAQ

What's the difference between identification and verification in authentication?
Identification is the moment a user claims who they are, typically by entering a username, which tells the system which account to examine. Verification is the step that confirms that claim is actually true, through a password, PIN, or biometric. Most systems conflate the two, but treating them as genuinely separate steps is what makes secure authentication possible.

Why is asking for a username considered insecure on its own?
Because the moment a username is submitted, the system has already narrowed in on a specific account and exposed its verification factors to be examined, and potentially attacked, before any actual verification has even happened.

Can biometrics replace usernames and passwords entirely?
Not for identification at scale. Biometrics work well as a verification factor once a user is already identified, which is why they work fine on a single-user phone. Used to identify one specific account out of millions or billions of users, current biometric accuracy isn't reliable enough.

What should replace a username as the identification step?
Something the user has: a smartphone for most people, or a dedicated hardware token for higher-security contexts. It needs strong built-in security and a clearly defined, secure, convenient process for revoking and reassigning it if it's ever lost or stolen.

The Bottom Line

If there's one single change worth making to your IT systems, your corporate security, and the experience of your employees, users, and customers this year, it's this: eliminate usernames for good. Passwords get replaced eventually either way. Usernames are the step nobody's fixing yet.