How much username information should be available?

Earlier today I accidentally googled my email address (rather than the email provider) and the first result was a website listing all the hacks it had been in with the opportunity to view the data for $4 worth of bitcoin. Scary stuff.

The alarm was apparently raised and they chose not to address it, up to them to say why.

Star use or use of identifiers that aren't also valid for login would be two ways to address it while preserving the part of the functionality that doesn't involve telling people by "name" what someone else is doing.

Mitigations can include checks of passwords against dictionaries of common passwords to make password guessing attacks harder but that won't work in the case stevio described. That risk can be partly addressed by comparing IDs and the hashes of the passwords with the hashes of passwords from recent attacks. Hashes for this because I assume that they aren't foolish enough to store actual passwords anywhere on their systems and their systems are new enough to have implemented this basic security measure. Locations of login attempts and client browser properties can also be used as a risk of compromise indicator, perhaps combined with delay in allowing use of a new account for withdrawing and assumption that the email address may also have been compromised.

Non-financial places have a role to play in financial site security as well, by never storing actual passwords on their systems. If not stored they can't be taken and tried at financial sites. We can help with this by using different email addresses and other login details so that compromised details won't work. I use different email addresses for roughly every firm and person I provide email addresses to outside work. Places like Gmail let you add a modifier to your base email address to create new ones every time.

If a base Gmail address is abc@gmail.com all of these forms are also automatically valid to get mail to that address: a.bc a....bc abc+somewebsite a.b.c+someotherwebsite. So you can just add something after the + that is different for each place. The base email address is always known but the after + variation used for different places isn't and that will be sufficient to block email address reuse in logins. Humans or clever tools may be able to guess the suffix so a bit of care is needed by high value target individuals but most attacks will just use the unmodified compromised email address from one place in the attempts at others.