How simple a password could be when the only account data is the email address?

Question

I have a case where the only data stored on the user account is his email address. My client wants to avoid complicated passwords because the audience is young. Some of my colleagues still want to apply good security rules for the password. But anyway the login requires the email address/password combination (no username).

I mean: what are the benefits to highly secure an account which contains only the user's email address when the user needs to provide his email address to login anyway?

Thanks for your thoughts! Marion.

Answer 1

Perhaps the best way to think about this is, if an unauthorized user figured out a username and password and logged in, how bad would it be? If your statement is true:

the only data stored on the user account is his email address.

then this implies that once you are logged in, the entire site is read-only. In other words, authenticating gives you access to certain content that is otherwise not available to the public. If that content became public, would you lose sleep over it? If not, then it probably isn't a big deal from a security standpoint of your site to allow simple passwords, since you have nothing to protect.

That being said, here are some reasons you shouldn't allow easy passwords even if it meets the above criteria:

1. Above I specifically emphasized the security "of your site" because your site may be safe, but you also want to protect your users. If an attacker is able to guess a user's easy password, they have possibly learned something about the user. Perhaps the person uses that same password on another website, or as the password for their phone, etc. This information in the hands of an attacker could potentially harm the user. Note you can get around this problem by creating passwords for them instead of letting them choose their own.
2. If an attacker doesn't know any email addresses, having simple passwords makes it easier to guess an email/password combination, and thus discovering email addresses. (This is the exact reason why website login errors should not say "The email address was not found", but rather, "The email/password combination was not found". You want to protect against attackers trying to mine emails.)
3. What if in the future you decide to add functionality to the website? For example, you may want to allow people to post comments or "like" something. Then you would be storing data specific to a person and you'd have more to protect, and it could be a hassle to change your password system once the site is rolled out and used by many people.

In summary, I agree with crovers. I'd also recommend using strong passwords or a different authentication method.

Answer 2

Rather than doing passwords, consider other options - like one-time-use emailed links to the email. You are leveraging the protection of the email system, saving yourself from having to properly store passwords, saving your users from having to remember one (or, worse yet, reusing one with you).

Other options include Twitter, Facebook or Google integrations, with OpenID or OAuth.

If you are unhappy with passwords, use a different option. But if you're going to use passwords, use strong ones.