8 ms·

I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Mic

by lhecker 11y ago

I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...

WhitneyLand 11y ago
This sounds a little obsessive. How often are hackers brute forcing a random 16 character hash?
- dagss 11y ago
  Point is you can use passphrases that are easier for humans to remember, but you then need to measure entropy as numbers of words and size of dictionary and 16 characters is too little. https://xkcd.com/936/ https://xkcd.com/936/
  - lhecker 11y ago
    Yep exactly that. It would be great if I could just use some whole words as the password for accounts which I need to use often or are really important and thus IMHO make password stores impractical (e.g. desktop login, Gmail, …)
    - eru 11y ago
      Add second factor authorization for these, in any case. Google Authenticator app on the phone works reasonably well, or perhaps even get a physical token.
    - freehunter 11y ago
      I use a passphrase on my Gmail account in the manner of "This is the password I am using for Gmail". Works just fine.
  - WhitneyLand 11y ago
    Pass phrases can be a problem because they are attacked using dictionaries just like words are. Choose carefully.
- amalcon 11y ago
  One other issue is that this indicates a site doing something they should not be. The best practice for password storage is to use a secure password hash like bcrypt, and not store the actual password at all. If one actually does this, the length of the password becomes almost irrelevant to the server. You might want to reject 10MB passwords or something, to prevent someone from taking up all your RAM during login, but the difference between 16 characters and 1024 (or 72, the max for bcrypt) is irrelevant.
Karlozkiller 11y ago
No, the most annoying thing is when they don't tell you the rules in advance, and you start typing a password that fits most standard rules. Now either you get through but don't know if you could've used a better password. Or your password will be denied and you have to make adaptions or change completely.
- dannib 11y ago
  No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.
  - qb45 11y ago
    Sounds so insane I guess it must have really happened. I had similar issue with paypal once. Their bank account number field expected to get N digits without spaces, so it was hard limited to N characters. Of course they didn't bother telling about that. When I pasted my number with some K space separators tossed between digits, the last K digits have been silently truncated. Boom, account locked.
    - IanCal 11y ago
      > Sounds so insane I guess it must have really happened. That happened to me on either "verified by visa" or the mastercard equivalent. I had to reset my password a few times before I figured that one out. For those that haven't used this it's an extra password protected step that comes up sometimes when purchasing things with your card.
    - Someone 11y ago
      Happened to me this week. "Luckily", they also implemented the "feature" where they can send you your password by email directly after you set it, so when I couldn't get in with the password I set, I reset the password, got a mail with a new password, logged in, changed the password to a new random long string, and this timeasked them to send the password to me. The password they sent was chopped off. That told me their limit, so I could set my password a third time to get something maximally secure.
jordanpg 11y ago
Whenever I see this maximum password length nonsense, I realize that whoever is in charge of security at this company apparently doesn't know or care about password managers. And that speaks volumes to me.
- pwg 11y ago
  It is also a 'code smell' that suggests that the relevant company is storing passwords in plaintext. Reason: If they were hashing the password, the hash output would be fixed length, independent of the input length, so there would be no need for an external, user visible, maximum length restrictions.
  - mkobit 11y ago
    That's an interesting and plausible take on it. Why do you think new companies still go the route of not allowing special characters (like <>;"()' and the other SQL injection types)? I would think that new companies would know better by now, but I guess not?
harryf 11y ago
> I'd probably sacrifice my firstborn Secret question: what was the name of your first born?
- deleted 11y ago
  [deleted]
deleted 11y ago
[deleted]
deleted 11y ago
[deleted]

by lhecker 11y ago

WhitneyLand 11y ago

This sounds a little obsessive. How often are hackers brute forcing a random 16 character hash?

dagss 11y ago
Point is you can use passphrases that are easier for humans to remember, but you then need to measure entropy as numbers of words and size of dictionary and 16 characters is too little. https://xkcd.com/936/ https://xkcd.com/936/
- lhecker 11y ago
  Yep exactly that. It would be great if I could just use some whole words as the password for accounts which I need to use often or are really important and thus IMHO make password stores impractical (e.g. desktop login, Gmail, …)
  - eru 11y ago
    Add second factor authorization for these, in any case. Google Authenticator app on the phone works reasonably well, or perhaps even get a physical token.
  - freehunter 11y ago
    I use a passphrase on my Gmail account in the manner of "This is the password I am using for Gmail". Works just fine.
- WhitneyLand 11y ago
  Pass phrases can be a problem because they are attacked using dictionaries just like words are. Choose carefully.
amalcon 11y ago
One other issue is that this indicates a site doing something they should not be. The best practice for password storage is to use a secure password hash like bcrypt, and not store the actual password at all. If one actually does this, the length of the password becomes almost irrelevant to the server. You might want to reject 10MB passwords or something, to prevent someone from taking up all your RAM during login, but the difference between 16 characters and 1024 (or 72, the max for bcrypt) is irrelevant.

Karlozkiller 11y ago

No, the most annoying thing is when they don't tell you the rules in advance, and you start typing a password that fits most standard rules. Now either you get through but don't know if you could've used a better password. Or your password will be denied and you have to make adaptions or change completely.

dannib 11y ago
No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.
- qb45 11y ago
  Sounds so insane I guess it must have really happened. I had similar issue with paypal once. Their bank account number field expected to get N digits without spaces, so it was hard limited to N characters. Of course they didn't bother telling about that. When I pasted my number with some K space separators tossed between digits, the last K digits have been silently truncated. Boom, account locked.
  - IanCal 11y ago
    > Sounds so insane I guess it must have really happened. That happened to me on either "verified by visa" or the mastercard equivalent. I had to reset my password a few times before I figured that one out. For those that haven't used this it's an extra password protected step that comes up sometimes when purchasing things with your card.
  - Someone 11y ago
    Happened to me this week. "Luckily", they also implemented the "feature" where they can send you your password by email directly after you set it, so when I couldn't get in with the password I set, I reset the password, got a mail with a new password, logged in, changed the password to a new random long string, and this timeasked them to send the password to me. The password they sent was chopped off. That told me their limit, so I could set my password a third time to get something maximally secure.

jordanpg 11y ago

Whenever I see this maximum password length nonsense, I realize that whoever is in charge of security at this company apparently doesn't know or care about password managers. And that speaks volumes to me.

pwg 11y ago
It is also a 'code smell' that suggests that the relevant company is storing passwords in plaintext. Reason: If they were hashing the password, the hash output would be fixed length, independent of the input length, so there would be no need for an external, user visible, maximum length restrictions.
- mkobit 11y ago
  That's an interesting and plausible take on it. Why do you think new companies still go the route of not allowing special characters (like <>;"()' and the other SQL injection types)? I would think that new companies would know better by now, but I guess not?

harryf 11y ago

> I'd probably sacrifice my firstborn Secret question: what was the name of your first born?

deleted 11y ago
[deleted]

deleted 11y ago

[deleted]

deleted 11y ago

[deleted]