4 ms·

Maximum length tops my list of favorite restriction, because it strongly suggests that they're keeping my password in the clear somewhere - or they used to, and

Maximum length tops my list of favorite restriction, because it strongly suggests that they're keeping my password in the clear somewhere - or they used to, and just never got around to changing it. The concept of illegal characters is tied for second. If you're handling it right, there should be no such thing - yet so many sites continue to set arbitrary limitations for reasons that aren't clear even to them. Kind of wish I could just generate private keys for each site and not think about it anymore. (Yes, I know there are some convoluted ways to do this, but they're not particularly usable.) THe best part is that even so many new and/or modern sites enforce the same arbitrary requirements.

TheAceOfHearts 11y ago
I totally get what you mean, but setting an upper limit on fields is generally a good idea. Setting the limit too low sucks, but you don't really want to accept, e.g. 1MB passwords.
- nicwolff 11y ago
  Why not, since you're only storing a fixed-length hash of the password?
  - Someone 11y ago
    Some browsers might not want to send the password in a POST request. Effect could be that you can change your password from browser X, but cannot login later from a different browser or after you upgraded that browser. If you are really unlucky, the browser you change it from chops off characters from the password. Also, chances are users will not type their 10MB password into an input field, but try and paste it in. Again, the browser may silently discard a few MB of that string, or beep while you have your sound muted. That's no reason to set max length at something small, but setting it to 1024 or so shouldn't limit anybody as long as it allows for more entropy in the plaintext password than will be in the hash you store.
    - smellf 11y ago
      Shouldn't the password be hashed on the frontend anyway...?
      - recursive 11y ago
        No. If you do that, then the password hash becomes the real password, and the exercise of hashing it serves no security purpose.
        eru 11y ago
        You can, of course, play some zero-knowledge tricks on the front end.
profinger 11y ago
I agree and was just complaining about this to a coworker. I tried to use a passphrase somewhere, I think paypal? and it made me make my password between 6-10 characters...
- smellf 11y ago
  A few months ago I set up an account with American Express. I was able to log in to their website from a desktop, but the Android app wouldn't let me log in. Eventually I would up talking with their tech support, having been elevated twice, and I learned that their passwords are limited to 20 characters, as well as NO UPPERCASE CHARACTERS! For some reason, I had been able to make my long, uppercase-filled password on the desktop site, but the app was lower()ing and truncating my password. To add insult to injury, when I tried to tell the gentleman on the line what an egregious security lapse this was, he cut me off with a terrifying and patronizing explanation: "strong passwords don't matter anymore, because nowadays we have _encryption_". American Express, get fucking real.

TheAceOfHearts 11y ago

I totally get what you mean, but setting an upper limit on fields is generally a good idea. Setting the limit too low sucks, but you don't really want to accept, e.g. 1MB passwords.

nicwolff 11y ago
Why not, since you're only storing a fixed-length hash of the password?
- Someone 11y ago
  Some browsers might not want to send the password in a POST request. Effect could be that you can change your password from browser X, but cannot login later from a different browser or after you upgraded that browser. If you are really unlucky, the browser you change it from chops off characters from the password. Also, chances are users will not type their 10MB password into an input field, but try and paste it in. Again, the browser may silently discard a few MB of that string, or beep while you have your sound muted. That's no reason to set max length at something small, but setting it to 1024 or so shouldn't limit anybody as long as it allows for more entropy in the plaintext password than will be in the hash you store.
  - smellf 11y ago
    Shouldn't the password be hashed on the frontend anyway...?
    - recursive 11y ago
      No. If you do that, then the password hash becomes the real password, and the exercise of hashing it serves no security purpose.
      - eru 11y ago
        You can, of course, play some zero-knowledge tricks on the front end.

profinger 11y ago

I agree and was just complaining about this to a coworker. I tried to use a passphrase somewhere, I think paypal? and it made me make my password between 6-10 characters...

smellf 11y ago
A few months ago I set up an account with American Express. I was able to log in to their website from a desktop, but the Android app wouldn't let me log in. Eventually I would up talking with their tech support, having been elevated twice, and I learned that their passwords are limited to 20 characters, as well as NO UPPERCASE CHARACTERS! For some reason, I had been able to make my long, uppercase-filled password on the desktop site, but the app was lower()ing and truncating my password. To add insult to injury, when I tried to tell the gentleman on the line what an egregious security lapse this was, he cut me off with a terrifying and patronizing explanation: "strong passwords don't matter anymore, because nowadays we have _encryption_". American Express, get fucking real.