I am tasked with implementing a web-based gambling system that's operated on site. The requirements given to me by the company co-founder and designer for user login give red flags in regards to security, which surprises me because all of the other roles are required to be secure (cashier, site owner, admin, etc. all have usernames and passwords).
Here is how users are supposed to log into this system:
- User goes to cashier, registers, and pays money for credits.
- Cashier creates user, gives their account credits, and gives them their user ID.
- The user ID is only seven characters.
- The user ID is only digits.
- The user ID is shown in plain text on the screen to the cashier.
- The user ID is printed on a receipt given to the user.
- There is no password. The user ID alone is used to log in.
- User goes to a terminal at a site, logs in with user ID, and plays games.
The user ID is made to appear as a password because, when the player goes to a terminal to log in, they are presented on screen with a number pad and the digits they enter are masked.
What are all of the ways this system can be compromised? I suggested to him that 7 digits was insecure as it could be guessed, but he said that users don't want to have to enter long numbers to log in and that there could be max 2,000 users per site.