In reply to Kimberly.

If your password is as complex as "dX5A!w3Qfr2p", then it doesn't make any difference if an attacker knows your username. It's not adding any real security to make the username complex too.

Security is only as good as the weakest link, and that link is invariably the person sitting behind the keyboard. You're already asking them to remember a complex password, if you suggest that they remember a different complex username, then you lead to the sticky-post-on-the-monitor syndrome. "Pretend" security measures often lead to decreased security because of unforeseen consequences such as these.