I read everywhere (and see in practice) that usernames should not be changeable. When I ask why, 'security' is given as a reason.
I've been searching for a definitive answer as to why changing a username is insecure, but I can't seem to find the answer.
Could any of the security experienced people here answer this question?
Note: if you do not know the answer, please refrain from speculation. I've thought of a number of reasons myself, but I don't know the actual answer, hence the question.
1: By userId I meant to refer to some sort of unique identifier, be it a database record id or some other unique id. I've been told several times that changing the username is bad for security, even if the username is not the primary/unique identifier for the system itself.
2: I do allow users to change their 'public name'. This is the name that is used to identify the user to the other (non-privileged) users. for example:
public name: John Jameson
3: As pointed out by Jason and The Rook, consistency seems the only good reason. I've the feeling this 'best practice' might be a leftover from somewhere in the past when usernames where actually used within the system to uniquely identify users.