2 deleted 84 characters in body
source | link

Wanted to just add a comment but can't (new user) so have to post answer, sorry.

I would present the argument to the boss using simple maths. Suggest to him that the user ID and password could each be two digits and ask (show?) him to calculate the number of permutations to guess a valid combination (assuming only one exists in the system).

With the separate login / password approach, you have a 1:100 chance of getting the correct login, and then another 1:100 of getting the correct password, so it is a 1:200 chance of getting the correct login / password combination.

Contrast this with the 1:10,000 combinations for the combined login / password approach then extrapolate.

Hell, if it comes down to it, write a simple program and make him try it. Unless he really doesn't want to protect your data (so why password it?) he has to be made to understand the basic maths associated with the two step approach and how this will affect the security.

Frankly, I wouldn't use a site that used a two step approach for this basic reason, unless some other factor (two-step...) was involved.

Wanted to just add a comment but can't (new user) so have to post answer, sorry.

I would present the argument to the boss using simple maths. Suggest to him that the user ID and password could each be two digits and ask (show?) him to calculate the number of permutations to guess a valid combination (assuming only one exists in the system).

With the separate login / password approach, you have a 1:100 chance of getting the correct login, and then another 1:100 of getting the correct password, so it is a 1:200 chance of getting the correct login / password combination.

Contrast this with the 1:10,000 combinations for the combined login / password approach then extrapolate.

Hell, if it comes down to it, write a simple program and make him try it. Unless he really doesn't want to protect your data (so why password it?) he has to be made to understand the basic maths associated with the two step approach and how this will affect the security.

Frankly, I wouldn't use a site that used a two step approach for this basic reason, unless some other factor (two-step...) was involved.

I would present the argument to the boss using simple maths. Suggest to him that the user ID and password could each be two digits and ask (show?) him to calculate the number of permutations to guess a valid combination (assuming only one exists in the system).

With the separate login / password approach, you have a 1:100 chance of getting the correct login, and then another 1:100 of getting the correct password, so it is a 1:200 chance of getting the correct login / password combination.

Contrast this with the 1:10,000 combinations for the combined login / password approach then extrapolate.

Hell, if it comes down to it, write a simple program and make him try it. Unless he really doesn't want to protect your data (so why password it?) he has to be made to understand the basic maths associated with the two step approach and how this will affect the security.

Frankly, I wouldn't use a site that used a two step approach for this basic reason, unless some other factor (two-step...) was involved.

1
source | link

Wanted to just add a comment but can't (new user) so have to post answer, sorry.

I would present the argument to the boss using simple maths. Suggest to him that the user ID and password could each be two digits and ask (show?) him to calculate the number of permutations to guess a valid combination (assuming only one exists in the system).

With the separate login / password approach, you have a 1:100 chance of getting the correct login, and then another 1:100 of getting the correct password, so it is a 1:200 chance of getting the correct login / password combination.

Contrast this with the 1:10,000 combinations for the combined login / password approach then extrapolate.

Hell, if it comes down to it, write a simple program and make him try it. Unless he really doesn't want to protect your data (so why password it?) he has to be made to understand the basic maths associated with the two step approach and how this will affect the security.

Frankly, I wouldn't use a site that used a two step approach for this basic reason, unless some other factor (two-step...) was involved.