A 4-digit PIN is not a login.
A crew app showed door codes, alarm codes and customer addresses to anyone who typed a four-digit PIN. The PIN was shared across the whole crew and had not changed in a long time. It was easy to type and easy to pass along.
Four digits means ten thousand combinations. With no lockout, anyone can try them all. With a shared PIN, you cannot tell who looked at what, or remove one person without changing it for everyone.
The data behind it is not trivial. Door codes and addresses are exactly what you do not want to leak. You can fix most of this without replacing the app.
What to do
- Give each person their own login, even if it is still a short code. A shared PIN has no audit trail.
- Add lockout. After a few wrong tries, block that account for a while and tell the owner.
- Show codes only for the job assigned to that person today. Hide the rest.
- Log every time a code or address is viewed: who, what and when. Check the log now and then.
- Make removing a person a one-minute task, so it actually happens when someone leaves.
- Change the codes themselves on the doors after anyone with broad access departs.
When not to
If the app only holds public information, such as a job time and a first name, a simple code is fine and none of this is worth the effort. Match the protection to what is behind it. And if the app cannot do lockout or logging at all, the choice is a different app, not stronger wishes.