2

I am currently using 9 digit numbers to authenticate writers on two apps. In the first app, this unlocks editing tools for use in making content rich dhtml documents which are stored on the local machine by default. With the second app, it opens up create/edit/delete functionality for content items (meant for low security, non-personal content) stored in a DB. But in this app all changes are versioned, so in the case of a malicious user it is just a question or reverting to the previous good version.

To summarize, I'm using weak credentials for access to limited functionality to two apps meant to be used with fairly open & shared information. And my credential system could always be hardened sometime down the road as the app requirements warrant.

So my question is for those with deep knowledge and experience in computer security: Is this a mistake? What is there to look out for that I'm probably not aware of? Am I going to regret not using stronger credentials later on?

  • 9 digits actually seems fairly decent, if they are truly random numbers. Sure, 9 alpha+symbol characters would be better, but nobody is going to find 9 digit random numbers by guessing or dictionary attack. – O'Rooney Jun 20 at 21:08
5

You need to assess the impact of an attack considering at least three aspects: confidentiality, availability, integrity. Here are some points to consider:

  • Confidentiality: what's the damage if an attacker can see the private data that is protected by your password? Is it personal data? Are there any trade secrets?
  • Availability: can an attacker make the password-protected data unavailable, either temporarily or permanently? What's the damage if that happens? How much time and money are you going to lose to make your service available again?
  • Integrity: can an attacker corrupt the password-protected data so that you won't notice it? Can an attacker harm your reputation by modifying the data, or harm your business anyway? Can an attacker insert malware in your data (that you will end up executing because you trust your data)?
  • Other: are you sure that a stolen password will not lead to further attacks in other areas, for example because of related APIs or services, or password reuse, or social engineering, or other vulnerabilities that would not be exploitable without accessing the private area?

Then ask yourself: what's the cost of adding a few more characters to my insecure passwords? It should not cost you anything. So if you can avoid trouble by making your passwords stronger, then do make them stronger.

That said, strong passwords are not always necessary. For example, you don't need a 16-character random password to protect your Google account. Why? Because Google won't allow bruteforcing the password anyway (they will limit failed attempts, ask for confirmation by sending an SMS, etc.). If you have good protections against bruteforcing, and maybe you also use 2FA, you don't really need a strong password. As long as you don't reuse your password anywhere else, of course. Even the strongest passwords in the universe won't be secure if you are reusing them everywhere.

  • Thank you this answer is just what I was looking for – ControlAltDel Jun 20 at 16:03
1

No, not always. It depends on what will you loose when password is compromised. If the costs are low, there may be no sense to keep passwords too complex. In your case the costs seem to be low and even 9 digits might be superfluous.

It depends also on possibility to brute force passwords. If you lock accounts after a couple of incorrect password, again, too complex password have no sense.

Keeping passwords too complex leads to multiple cases when users forget their passwords or do mistakes entering them (if they don't use password managers). This leads to multiple requests (to your or to your service desk) to reset passwords, which means costs for working time of persons dealing with password resets.

All in all: In your case I would say even 4-5 digits would be sufficient.

1

Building upon what reed wrote:

If your applications are publicly accessible and do not lock out failed attempts, a password cracker could discover your passwords (numbers only?) fairly quickly. Here is a good list of modern password crackers if you'd care to try for yourself: https://resources.infosecinstitute.com/popular-tools-for-brute-force-attacks/

This information might help you determine whether you want to incorporate stronger access control into your applications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.