In the theme song for the old television sitcom "Cheers," the Boston bar was the place where "everybody knows your name." To prove it, every time the character Norm walked into the establishment, everyone inside shouted out, "Norm!"
But the Internet isn't "Cheers." On the Internet, it's not always advisable to let everyone know your real name.
While it may not be a person's official legal name, a username makes an individual user recognizable within online communities. A username can be just as much a part of a person's identity as the name on his or her birth certificate.
"Having the same username everywhere will negatively impact the limited amount of anonymity there is on the Net," said Roel Schouwenberg, principal security researcher with anti-virus software maker Kaspersky Lab. "It will open people up to more directed attacks."
The exposure of a person's username may not sound very risky, but it can trigger a cascade of security failures, each of which opens the door to account hijacking, identity theft or financial damage.
The user database of the photo-sharing mobile app Snapchat was breached this past December, and usernames and mobile-phone numbers of 4.6 million Snapchat members — a small fraction of the total number of users — were posted online.
No passwords or email addresses were taken from Snapchat. Nonetheless, security experts advised all Snapchat members — regardless of whether they were on the breach list — to change their usernames, as well as any passwords associated with those usernames on other websites.
An online criminal wouldn't know John's password right away from the Snapchat breach. But he would know that many people use obvious passwords, such as "password," "letmein" or "123456." He could use the 100 or 1,000 most common passwords to try to break into John's accounts.
But even if a criminal can't break into any of a user's accounts directly, there are still indirect ways to get in and take over.
If a username is based on a real name, a criminal can guess the user's real name and then use that to learn as much as possible about the person.
In the case of jksmith456, the criminal could run through common names beginning with "J." He could leverage the cellphone number leaked with the Snapchat username, cross-referencing the area code with potential J.K. Smiths, or even call the cellphone to see if a man or woman picks up.
Most people plan to keep their mobile phone numbers for a long time; unlike a home address or land-line number, a cellphone number often doesn't change with a move across the state or country.
A criminal could use social media and public records to figure out when John K. Smith was born, where he grew up, what his parents' names were, and where and when he went to high school.
After that, it would be easy for the criminal to answer many of John's password-recovery questions, such as "What was your mother's maiden name?"
Having seized control of John's email account, the criminal could reset John's email password or, better yet, have copies of all John's email messages secretly forwarded to another email address while John unsuspectingly continues to use the account.
Once an account is hijacked, it can be used for fraud. John's friends may get emails saying that John was mugged in London and needs money wired to him immediately. John's Twitter feed may send out links to ads or malware.
John's email contacts, Facebook friends and LinkedIn connections would be at risk of becoming victims of cybercrime themselves as soon as the criminal used John's accounts to learn their names, email addresses, locations, telephone numbers and professions.
"That knowledge — the profile that can be created of a target — can then be used in a directed attack," Schouwenberg said. "This attack could then take place over the phone, or the phone number could be used to give a phishing message more credibility."
The next step would be to use different usernames for different types of accounts — one name for gaming platforms, another name for social media sites, and yet another for online forums.
The code must be used to log in to the account, and if an identity thief doesn't have your phone, he can't get in.
If you take all of these steps, you'll have a lot of email addresses, and even more passwords, to manage. How can you keep track of them all?
To manage many email addresses, set up the least-used ones to automatically forward new messages to email addresses you use more frequently. You'll get the messages on time, and then can log in to the seldom-used email accounts to send replies.
Don't assume that these risks are abstract, or that this will never happen to you. In late 2013 alone, more than 200 million email addresses — many listed with real names, usernames and telephone numbers — were stolen from Adobe Systems and Target Corporation.
Once your information is in criminal hands, there's not a whole lot that can be done. The best remedies are prevention and vigilance.
Follow us @tomsguide, on Facebook and on Google+.
