Back

@davidbisset
It may not be real, but the Danish national ID system had a similar one at the beginning.

To prevent brute force attempts, they would lock a user account after N failed login attempts (even though brute forcing should be impossible with one time codes), so all you needed to lock someone elses account was their username and a wrong password - and it's easy to guess a wrong password

The solution they chose was to tell people not to tell anyone their username, but when I went to create mine, I was told that the username I wanted was already taken.

So I had both someone elses username and a reason to want to lock them out (they took the username I wanted). I didn't, but I easily could have.