I'll take Twitter as an example.
On one hand, when registering on Twitter, the password must contain at least 6 characters.
On the other hand, access token to the API have about 50 characters:
I'm wondering about the security reason behind this difference in length. If the tokens are really long because it improves security, why are short passwords allowed? Please note that I'm not asking why the minimal length is not a given number like 10, 15 or 20 characters, it would still make a great difference compared to tokens.
And while this token is hard to guess because it's random and longer, I can see my own tokens by connecting to the Twitter developers website with my relatively weak password. Why create a secure random token if it's accessible with my password? I know that it's possible to activate the two-factor authentication but the access to the developers website doesn't require it.
So, given the facts that:
- a token allow more or less the same operations than a logged in user though its password,
- accesses to API can be brute-forced as accesses from Internet,
- Twitter can choose the minimal length of a password and the length of tokens,
why are tokens so long? If from Twitter's point of view 6 characters are enough for a password, why use 50 characters for a token?