From 82aff74fc24531b9b9d4da070c39934db2566657 Mon Sep 17 00:00:00 2001
From: Johannes Zellner <johannes@cloudron.io>
Date: Wed, 26 Feb 2020 17:19:24 +0100
Subject: [PATCH] Make app passwords stronger

---
 src/users.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/users.js b/src/users.js
index de2acdabc..472e74dbd 100644
--- a/src/users.js
+++ b/src/users.js
@@ -710,7 +710,7 @@ function addAppPassword(userId, identifier, name, callback) {
 
     if (identifier.length < 1) return callback(new BoxError(BoxError.BAD_FIELD, 'identifier must be atleast 1 char'));
 
-    const password = hat(8 * 4);
+    const password = hat(16 * 4);
     const hashedPassword = crypto.createHash('sha256').update(password).digest('base64');
 
     var appPassword = {