Naming convention for databases and database users for access by a web application

database-administrationweb-applications

When installing a web application where a single user is used to talk to a single database (say MySQL, but this could apply to other RDBMSes also), you often have a sequence of events such as this:

CREATE DATABASE wordpress CHARACTER SET utf8;
GRANT ALL PRIVILEGES ON wordpress.* TO 'wordpress'@'localhost' IDENTIFIED BY 'hunter2';

Some guides suggest using a different username to the database name, where others suggest using a different name, such as 'appuser' for the user, and 'app' for the database name.

Are there any obvious technical downsides to using the same name? Is there anywhere you're likely to create confusion by doing this?

Edit: I'm aware that this is questionable security practice, and you should name your databases fhqwhgads and your user flobadob; however, (a) obscurity is a questionable tool, and (b) this is the example every webapp gives in their documentation.

Best Answer

The downside of using the same user name as the database name is simply that it's far too obvious. If you have a look at access logs you will see attackers regularly try that combination and if you get the name right you're already part way in. Other than that it makes little difference what name you use, although there is something to be said for not using dictionary words either.