5 ms·

Why no longer than 12 ?

by reacweb 10y ago

dfox 10y ago
That is valid question to ask authors of systems that do not allow passwords longer than 12 characters (or 8, which is another popular upper limit, which can have some vaguely meaningful technical reason for legacy systems).
- zo1 10y ago
  Or 10, which is the maximum password length my bank requires in order to log in to my bank account. Oh, but they have a 4-digit pin, too! That makes it oh so much more secure.
  - nommm-nommm 10y ago
    My old bank required an exactly 5 character password. They had two factor authentication though, with a phone call or SMS. What happened if you forgot your password? Well you had to reset it, using only phone call/SMS, of course!
  - vacri 10y ago
    Banks are more willing to eat the fraud costs involved with real-world compromised PIN codes than to deal with the customer support for forgetful users.
jacobr1 10y ago
Often that is the size of the DB column and the password is stored in plaintext (or was and the size restriction remained).
- jsingleton 10y ago
  This is usually the case but there are frequently short length restrictions even when it's hashed. Sometimes only on the client side too, so you can just remove the attribute from the input.
  - pavel_lishin 10y ago
    As I understand it, those restrictions are typically due to having an interface with some legacy system where those restrictions can't be removed.
gambiting 10y ago
Our HR management system at work, that manages all payslips and tax returns only allows passwords between 8 and 9 characters, they have to start with a letter, they have to contain one of the following "@", "_", "-", "$", but no other special characters are allowed. It has to contain one number. It's the most bizzare password requirement I have ever seen and I am pretty sure it's not secure. Have I mentioned it only works in IE and uses ActiveX controls?
- mikestew 10y ago
  only allows passwords between 8 and 9 characters Inclusive, I hope.
swang 10y ago
because a lot of companies have no technical expertise at all. american express use to enforce insane limits on passwords back in 2010[0]. 6-8 characters for passwords, no special character and had to have 1 letter, 1 number and it wasn't case sensitive. unfortunately _I_ had an amex card. that page i linked to also has a reply from amex support who shows little knowledge about the difference between passwords and website encryption. they eventually started expanding that limit from 6-8 characters to 8-20 characters around 2012? 2013? [0] http://securitywatch.pcmag.com/e-commerce/284119-amex-password-policies-declared-brain-dead http://securitywatch.pcmag.com/e-commerce/284119-amex-passwo...

Why no longer than 12 ?

by reacweb 10y ago

Why no longer than 12 ?

dfox 10y ago

That is valid question to ask authors of systems that do not allow passwords longer than 12 characters (or 8, which is another popular upper limit, which can have some vaguely meaningful technical reason for legacy systems).

zo1 10y ago
Or 10, which is the maximum password length my bank requires in order to log in to my bank account. Oh, but they have a 4-digit pin, too! That makes it oh so much more secure.
- nommm-nommm 10y ago
  My old bank required an exactly 5 character password. They had two factor authentication though, with a phone call or SMS. What happened if you forgot your password? Well you had to reset it, using only phone call/SMS, of course!
- vacri 10y ago
  Banks are more willing to eat the fraud costs involved with real-world compromised PIN codes than to deal with the customer support for forgetful users.

jacobr1 10y ago

Often that is the size of the DB column and the password is stored in plaintext (or was and the size restriction remained).

jsingleton 10y ago
This is usually the case but there are frequently short length restrictions even when it's hashed. Sometimes only on the client side too, so you can just remove the attribute from the input.
- pavel_lishin 10y ago
  As I understand it, those restrictions are typically due to having an interface with some legacy system where those restrictions can't be removed.

gambiting 10y ago

Our HR management system at work, that manages all payslips and tax returns only allows passwords between 8 and 9 characters, they have to start with a letter, they have to contain one of the following "@", "_", "-", "$", but no other special characters are allowed. It has to contain one number. It's the most bizzare password requirement I have ever seen and I am pretty sure it's not secure. Have I mentioned it only works in IE and uses ActiveX controls?

mikestew 10y ago
only allows passwords between 8 and 9 characters Inclusive, I hope.

swang 10y ago

because a lot of companies have no technical expertise at all. american express use to enforce insane limits on passwords back in 2010[0]. 6-8 characters for passwords, no special character and had to have 1 letter, 1 number and it wasn't case sensitive. unfortunately _I_ had an amex card. that page i linked to also has a reply from amex support who shows little knowledge about the difference between passwords and website encryption. they eventually started expanding that limit from 6-8 characters to 8-20 characters around 2012? 2013? [0] http://securitywatch.pcmag.com/e-commerce/284119-amex-password-policies-declared-brain-dead http://securitywatch.pcmag.com/e-commerce/284119-amex-passwo...