I'm building a PHP login system that uses a username and password at first to grant the user a token and uses that token to grant the user access to their account.

My original thought was to force the access_token to refresh often, closing the window for potential brute force attacks.

However, after thinking it over, I realize that the access_token may be more secure than a username and password...

If I have a username of 24 characters, and a password of 24 characters, won't a 128 character access_token still be more secure? Let's assume all are using alphanumeric characters.

### Edit

It seems that the above statement was a bit veg. I'll be a bit more specific.

Scenarios

Example A

I have one system with a 24 character alphanumeric username and a 24 character alphanumerics password.

Example B

I have another system with a 128 character alphanumeric token.

Question

If two computers set out to brute force both systems, which system would most likely take the longest?

• Does the token change everytime a user enters their credentials? Jul 7, 2017 at 20:37
• Yes - But that is beside the point. Even if it didn't, wouldn't it be more secure than a username and password? Jul 7, 2017 at 20:38
• Apart from character size, the security would also depend on architecture. If you had a strong token but if an attacker can see it once and use it the next time, its as secure as the password Jul 7, 2017 at 22:39
• Of course Limit, there are a lot of things that need to be considered. Right now I'm focusing on this aspect of the project. Jul 7, 2017 at 22:59
• Fair but a lot of people just rely on the character size so wanted to ensure that you had covered the bases Jul 7, 2017 at 23:38

If you were to judge purely based on character size and wanted to compare a 24 character username and 24 character password system vs a 128 character token system, I would say that the search space would be larger in the token based system.

Obviously, to brute-force a username/password combination, the user needs to find a pair in two n^24 search spaces while in the there are several elements in the n^128 sized token search space that will be valid tokens. As a result, it can happen that your brute-force system does find a token before it can find a valid username/password pair. But finding all valid username/password pairs will take less time than finding all valid tokens.

• Are you saying it is likely that a brute force attack will find a valid token before a valid username and password? Or are you saying it is possible that a brute force attack will find a valid token before a valid username and password? Jul 7, 2017 at 23:57
• @jacobhenning I am saying that it's possible Jul 8, 2017 at 0:17

Tokens are away to provide access to a resource without the need to have a session managed indefinitely. This allows you scale servers and limit overhead pretty effectively by authorizing a client to access a resource directly.