As an App Founder, What Do I Need to Know about Passwords?

Posted on January 26, 2023 | updated: March 23, 2023

Passwords are an essential part of any application or website security system and one of the most important security measures they can take to protect their app. They provide a layer of protection that prevents unauthorized access to your software and its data. Passwords also help to protect user data from being accessed by the wrong people. This can include credit card information, addresses, and other private information that could lead to malicious activity including identity theft. Furthermore, passwords are a way to validate user identity to tools and services such as your SMTP Credentials on AWS SES, and to ensure that only authorized users can access an application and its data. Hence, the best passwords should be strong, unique, and regularly changed.

In this article, we will answer the following questions:

How long and difficult should a password be?

The longer and more intricate a password is, the harder it will be to figure out and subsequently break into a system. The following are commonly recommended guidelines regarding length and complexity of passwords and includes some practices that will also keep your passwords safe:

Create passwords that are at least 8 characters long. Ideally, a password should be 12 characters or more.
Use a combination of upper and lower case letters, numbers, and special characters.
Avoid using personal information in passwords. That includes names, birthdates, or addresses.
Avoid using common words, phrases, or sequences, as they can easily be guessed.
Avoid using the same password for multiple accounts.
Use a different, unique password for each online account and app. This will prevent unauthorized access to multiple accounts if one password is compromised.
Don’t write down your passwords.
Use a password manager for secure storage of complex passwords.

More characters, capital letters, numbers, and a special character or two can greatly increase the difficulty related to determining what a password is. Below is a chart showing exactly how longer and more intricate passwords greatly increase the amount of time it will take a computer to figure out a password.

Infographic: How Safe Is Your Password? | Statista

How often is it recommended that users change passwords?

Passwords should be regularly changed, especially after major changes or updates to a website or app. It is also frequently recommended that passwords be changed every 3-6 months. Some businesses that deal with sensitive information and a number of government agencies require numbers to be changed every 30 days. Why? Passwords can be exposed over time, either through malicious activities or because of password reuse. By changing passwords, it ensures that if passwords were obtained, the person who acquired it cannot use it for any extended amount of time. Also, if passwords are reused on multiple accounts, changing the password regularly helps to ensure that if one account is compromised, other accounts are not also at risk.

What types of businesses require a higher level of password security?

While all businesses, organizations, and institutions should be concerned with password security, some are obviously at more risk for breaches than others:

1. 1. Banks and financial institutions. They store and manage customers’ financial information including credit card and Social Security numbers. Therefore, strong password security is essential to protect against data breaches and unauthorized access to this sensitive info.
  2. Health apps. They often store highly sensitive medical information including medical records, insurance information, and prescription information. In addition, they are subject to the HIPAA law that states that no sensitive patient info can be disclosed without the patient’s consent or knowledge. Strong password security is necessary to ensure that information is kept confidential and to protect against potential data breaches.
  3. Retailers. Online businesses often retain their customers’ personal information. This information includes credit card numbers, home addresses, and phone numbers. Strong password security is necessary to protect the information from unauthorized access and potential data breaches.
  4. Government Agencies. Such entities often store and manage sensitive information including national security information, tax records, and other confidential information. Strong password security is needed to protect against unauthorized access to the information and data breaches.

What features can be added to my app to increase password security?

An app founder has many options to choose from to increase their app’s security:

Requiring a minimum password length. This is done by setting a minimum character limit to passwords.
Requiring a combination of letters, numbers, and symbols in a password.
Requiring users to change their password every 3-6 months, possibly more regularly depending on the nature of the business.
Two-factor authentication. This adds a second layer of security, such as a code sent to a user’s email or phone. It helps to ensure that only the intended user gains access to an account. It also prevents hackers from accessing an account, even if they have obtained the user’s password.
Allowing users to utilize a password manager. This helps users generate strong, unique passwords that are unique for each of their accounts. It also helps to prevent users from using weak and easily guessable passwords that can easily be cracked.
Logging failed password attempts and locking out users after a certain number of failed attempts.
Adding Captchas to login requirements. A Captcha is a challenge response test that is required as part of the login process. This helps to make certain that the one logging in is human.
Requiring one-time passwords when registering with an app. One-time passwords are temporary passwords that are only valid for a single use and are used to authenticate users on websites or applications.
Adding biometric authentication. Biometric authentication uses a user’s physical characteristics such as fingerprints or voice recognition to verify their identity.

An app founder may want to discuss the different features that will increase app security with their app developer to determine what features would make sense for their app.

What are negative consequences of setting password standards too low for my website or app?

When you choose low standards for passwords on your website or app, you or your users may encounter a number of negative consequences:

You and your users are at an increased security risk because you make it easier for hackers to guess passwords and to gain access to accounts. This could potentially lead to a security breach, which would put the website or app at risk of having user data exposed or stolen. It can also result in identity theft and financial loss for the app’s users.
It may create a false sense of security for the app’s users. If users are allowed to set weak passwords, they may believe that their account is secure when, in reality, they are vulnerable to attack.
It can lead to a poor user experience. Weak passwords are often easy to remember, but it could also lead to users forgetting their passwords or having to reset them frequently. This can result in frustration and a decreased desire to use the app.
If a website or app has weak password standards, it could lead to a loss of reputation. This can be damaging to the brand, as users may be less likely to trust the website or app if they know their data is not secure.
If a website or app does not adhere to the industry standards for password strength, it could be subject to fines or other penalties from regulatory authorities. This could be especially damaging for businesses or organizations that rely of their website or app for their operations and income.

Matraex is a premier app developer located in Boise, Idaho. Do you have a question about app development? Matraex would like to be your go-to place for answers. You can leave us a question on our Google Business Profile, contact us through our website, or leave a question via our chat feature on the website. Let us help you become more informed so you can make decisions that will best suit you.

Sign up to receive answers to your questions delivered directly to your inbox!