I'm building a PHP login system that uses a username and password at first to grant the user a token and uses that token to grant the user access to their account.
My original thought was to force the access_token to refresh often, closing the window for potential brute force attacks.
However, after thinking it over, I realize that the access_token may be more secure than a username and password...
If I have a username of 24 characters, and a password of 24 characters, won't a 128 character access_token still be more secure? Let's assume all are using alphanumeric characters.
It seems that the above statement was a bit veg. I'll be a bit more specific.
I have one system with a 24 character alphanumeric username and a 24 character alphanumerics password.
I have another system with a 128 character alphanumeric token.
If two computers set out to brute force both systems, which system would most likely take the longest?