Bitwarden: Generate a Username

[8organicbits]

They don't mention it, but there's a privacy benefit to generating usernames. Most users are predictable/lazy and will use the same username on every website. However, tools exist for finding accounts across services that have the same username. Generating a unique username and storing it in your password manager would make it easy to evade these tools.

https://github.com/topics/username-search

I use different usernames per-site, but I tend to take a couple seconds to think of something (hopefully) clever.

[logifail]

> I use different usernames per-site

Do you also use a different email address on each site, or do all the unique usernames ultimately link back to one email?

[kurthr]

It seems like most websites use your email address as the username, which makes this more difficult. You could use + addressing, which makes it unique, but doesn't really make it private... really need hidemyemail or something similar!

I do wish this was easy and automated.

[shaky-carrousel]

I generate a unique username for every website I register on, and an unique email too. What I have been doing is using the passphrase generator in Bitwarden as an username generator.

[soheil]

And you're so sure they're being lazy and not because they purposefully want to maintain the same handle across different platforms? The hubris...

[mcjiggerlog]

Seems pretty limited to be honest - the usernames aren't going to be unique enough for anything where they have to be globally unique. Unless you include numbers on the end that is, but that's just ugly.

LastPass's username generator is much better: https://www.lastpass.com/username-generator. With "lowercase" only and "Easy to say" turned on, the suggestions are really good. This is my go-to when I need a username, and that's as a Bitwarden user!

[AdmiralAsshat]

How useful is this, though, for just a username?

I would think the purpose here would be that you would use unique aliases per service to limit your own risk in the event of a site breach. However, the vast majority of websites these days require a username and an email address. In which case, if I've got 50 unique usernames but they're all tied to a single email, how much am I really protecting myself if the email address gets included in the breach?

[woojoo666]

One very slight benefit I see is (better) standardization of username generation. If everybody has their own method of generating usernames (eg long string of numbers vs 2 random words), then it's possible to differentiate usernames based on the style. Now that generation is automated via lastpass or bitwarden, there are two standard styles and makes it harder to fingerprint users based on it

[slaymaker1907]

I agree on uniqueness. I think you really want at least 40 bits of entropy (so no expected conflicts up until about a million usernames).

[fybs]

in the source code: var k=r.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED lol. also ;e.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED" (edit) (https://bitwarden.com/framework-17fddc626c2ea4ff0e8c.js)

[tbassetto]

That's from React: https://github.com/facebook/react/blob/a724a3b578dce77d427be...

[dandare]

Best design of a documentation page I have seen in ages.

Large font, clear hierarchy, great use of color and font weight.

[zitsarethecure]

I keep wanting to switch to bitwarden from keepassxc, I created an account and installed the apps, but I just can't bring myself to actually upload all my passwords to someone else's computer. Am I just too paranoid?

[vaylian]

Interesting. Related: Source code for docker container name generation: https://github.com/moby/moby/blob/master/pkg/namesgenerator/...

[jonaslejon]

This was quite funny:

if name == "boring_wozniak" /* Steve Wozniak is not boring */ { goto begin }

[neogodless]

This will save me some typing, as I already do the "catch-all" based emails exactly like this!

EDIT: See note below - this is for the Add Login dialog where it detects the domain you're signup for. (My initial tests were in the generic Generator function, which don't have the full functionality.)

> Website Name is limited to the Add/Edit screen on browser and desktop as it requires knowledge of the login's URI, in other locations the username generator will default to Random.

[calvinmorrison]

Fastmail + 1Password have quite a similar feature, the difference being that you can control it all from your normal email address (the feature is built into fastmail, using JMAP, so that 1password basically calls out to FM and implements a few API calls to generate a random secret email.)

Very cool, glad to see more people doing so!

[lvass]

>Select this type to use your email provider's sub-addressing (aka "plus addressing" or "aliasing")

Anyone knows which providers do this?

>e.g. [email protected])

If this pattern becomes popular enough, it won't take long until services strip out the + part entirely.

[michaelhoffman]

Worse, I have used services where they changed the email validation code years after setting up my account and then I could no longer log in because my email address had a + in it. So I don't do this anymore.

Sneakemail, which lets you do it with hyphens, works pretty well, though.

[up6w6]

They said that integration with Firefox Relay and SimpleLogin was also coming [1], which will probably match 1Password's Fastmail integration.

[1] https://www.reddit.com/r/Bitwarden/comments/ucd9d2/new_exten...

[nannal]

I am unclear of the benefits of doing this as opposed to just using the password generator prompt and using it for a username. Seems fairly pointless as a feature to me.

In addition, in the extension I can't use pass-phrase like generated responses for my username but I can for the password?

[purerandomness]

1) Web site's user names are typically much more restrictive than passwords.

2) You typically want your user name to be recognizable by the community you're registering at.

[crenwick]

For one, its built right into the UI so you can generate a name and save it in the bitwarden username field in the same motion.

Also, the password generator isn't configured to work for the use cases here (adding your email or a catchall, using less characters, no special characters, etc.). That way you can still sign up for accounts that require email verifications.

[neogodless]

Have you done a signup where the email address is used as a username?

Or email address is required? The email address username generation is useful for those cases (assuming you use unique email addresses for each signup.)

[growt]

I agree, right now I mostly use <servicename>@<mycatchalldomain>.com as usernames, that way I can directly see when something arrives at <servicename>@ that should not. I don't see the benefit of "randomizing" the <servicename> part.

[gpa]

I'm not a security expert, but possibly being able to change my username in addition to changing my password due to safety concerns gives an extra layer of security.

[AnonHP]

Interesting feature, but it looks like this has some rough edges. I saw this option a little while ago today from the browser extension (latest version of Firefox on Windows) when I created a new item and wanted to generate a password for it (I didn't want to generate the username since it was assigned by the service), but it wasn't possible to select either of the radio buttons to choose between username and password and the regenerate button also didn't seem to work. I didn't have time to dig in further, and so I chose to generate a passphrase and use that.

[ghostly_s]

I just wish it would auto-fill my normal email in the username field...

[plaguepilled]

This is a big step up in usability for me. Big thanks to the Bitwarden team for identifying a problem and coming up with an unintrusive solution.

[mihau]

Nice! Having a deeper integration with services like AnonAddy or SimpleLogin would be even better.

[pedro2]

FYI SimpleLogin joined the Proton family

[wcrossbow]

Fastmail can generate [email protected] email addresses that go straight to your mailbox. Really useful for throaway accounts and low value services. It apparently has an integration with 1password but I can't vouch for it as I haven't used it.

[dempedempe]

I think this is useful for any service, not just throwaway accounts or "low value" services. It provides another layer of anonymity, and makes credential stuffing impossible as a hacker would have no idea that two auto-generated emails address belong to the same person.

1password integration is nice, because you don't have to open up Fastmail to generate a new masked email.

I just use catch-all with custom domain, though. That way, I'm not tied to a particular provider, and I can make new "masked emails" on the fly however I want (usually, just using the name of the app/website I'm signing up for). The downside is that you loose the previously mentioned anonymity since a hacker could link your various addresses by domain name. But it's still way better than using the same email address everywhere!

[solidr53]

I can recommend a free alternative https://10minutemail.com/

It wont forward to your inbox though and is only suited for temporary usage.

[frou_dh]

How do you know that a geek has a system where they use a unique variation of their email address for each place they sign up?

Answer: Don't worry, they'll tell you about it.

[dspillett]

I'll be that guy: don't knock it, it saves a whole pile of junk mail when companies leak (or sell) your details and you can just turn off that address.

[account-5]

I've been doing this for years with Keepass(xc) with the inbuilt password generator. Random alphanumeric username every time. Is this solution better?

[1970-01-01]

     Why use Plus Addressed Email?

     Plus addressed emails allow you to filter your email for all the junk mail you get when signing up for a new service. Signing up for a service with the username [email protected] will still send emails to [email protected], but you can easily filter emails that include +rnok6xsh to prevent them from clogging up your inbox.

In this example, just make rnok6xsh your username and let spam filters do their job. Please stop embedding email addresses in usernames. It rubs GDPR and privacy in a bad way.