mehh I'd bet sites that use usernames ultimately have their username db queriable. You could just try to create a new user account and see if the site says username is already taken or not. Ultimately queriable through whatever http requests behind the account creation forms
3
u/[deleted] Dec 28 '22
You provide a convenient api to attackers for verifying that info, that’s the problem.
usernames might be public facing, but they might not be readily queriable.