Suppose you have a lock on your door with a keypad 0-9. A person can enter a digit combination of maximum 10 characters. They get three attempts before the door is locked for 1 hour.
If you had that door on your house, how long of a password/code would you choose? 4-digit, 6-digits etc?
When is secure secure enough? What is the lowest one could go and still consider it secure? What does it mean to be secure?
Real world: A client has requested that we minimize the password requirement on a system for users accounts, preferably down to 4 digits digits and have other measures such as ratelimits/account lockout etc but it feels that a 1 / 10000 chance of entering a correct password is too high of a probability even if they only get X(few) attempts per day. What is the lowest / simplest one could go with additional measures in place and still consider it secure, assuming that an attacker gets three attempts before the account is locked?
- The service is a Skype-like service
- The lockout would work like no new logins would be allowed for the duration of the lockout
- If a correct password is provided upon a login when a lockout has occurred in the past, an SMS would be sent to the user with a second token that they would need to enter to login
- Any client that is already logged in wouldn't be logged out during a bruteforce of their account, hence the chance of them having to go through the SMS secondary validation is slim