A user ID uniquely identifies every single user, a password doesn't. A password is an authentication mechanism,...
not an identifier. Every user accessing your system should have a distinct, and individual, user ID. No two should be alike. Since passwords are secret, two different users – with different user IDs – could conceivably pick the same password, and the system wouldn't be compromised. Why? Because despite having the same password, the two users still have their own unique IDs and therefore, couldn't access each other's accounts.
On the other hand, if users are allowed to change their IDs at will, a malicious user could create a phantom account, meaning one user with two IDs: an open one for legitimate uses and a covert one with unauthorized access to the system for underhanded purposes.
This isn't immediately intuitive. If allowing frequent password changes makes the login credentials more secure, shouldn't the same be true for frequent user name changes? Not exactly. Again, think about the difference between the two. Although they're used together, they're very different. One is an identifier (the user ID), the other an authenticator (the password).
Therefore, a good rule of thumb for updating login credentials is to allow password changes, but not user ID changes.
Related Q&A from Joel Dubin
After a server room door has been compromised, finding a more secure solution is of utmost importance. Learn how to choose a server room door that ...continue reading
In the IAM world, what's the difference between access control and identity management. This IAM expert response explains how the two relate as well ...continue reading
When working with PeopleSoft and Unix, which single sign-on (SSO) vendors offer the most effective products? Learn how to choose an SSO product in ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.