5 ms·

Or when a password that is generated by my password manager is rejected with a message "Password should be 12 characters maximum". Why???

• Natsu 10y ago
  That always makes me think there's probably a Password char(12) in the Users table somewhere.
• pwg 10y ago
  This very heavily implies that the database column which stores "passwords" is typed as "char(12)" and that the site is storing unhashed plaintext passwords in that column. Why: Because if they were (at least) hashing the password, then the output of the hash would be a fixed size token unrelated to the length of the input plaintext password, and no such arbitrary short limit would be necessary on the plaintext password itself.
  • deleted 10y ago
    [deleted]
• lstamour 10y ago
  Or they want to make passwords "easy to remember" and read somewhere in the early 2000s that form validation matters. If you can do it, why not? :/
• sbuttgereit 10y ago
  Ha! If only! Probably more than 50% of the sites I visit that have a maximum length that my password manager exceeds... give me an unrelated error message. Some times they tell me I haven't met the minimum length (100 chars, really?), sometimes they tell me that I've not met complexity requirements (I use upper/lower/numbers/special chars), etc. It's as though the developer only ever thought of how people wouldn't meet their minimum requirements, wrapped it all in a case or switch and let the default be whatever they hadn't checked in previous conditions.... not thinking that anyone would exceed their requirements. Very annoying and sloppy.
  • tempestn 10y ago
    You default to 100 character passwords? Doesn't that make it extremely inconvenient on the rare occasions when you need to type a password out? I figure 14 characters is going to be effectively unbreakable, but still possible to manually copy in under a minute.
    • nucleardog 10y ago
      Yeah, basically this. In theory every time I need a password I can copy and paste. In reality, sometimes I'm on someone else's computer or something else comes up that I need to open my database up on my phone and type it in by hand. For instance, I can't imagine trying to enter a 100 character password with a PS3 controller to log myself back into Netflix... If I'm already at "it's going to take 100 quintillion years to break this hash, even if they're only using MD5", then I really don't see any security benefit to using a longer password... But there's a definite loss of usability.
      • pixl97 10y ago
        It would take less time than you think with MD5 because of hash collisions. A 100 char pass is longer than the hash it outputs and is truncated.
    • zAy0LfpBZLC8mAC 10y ago
      Depends on where you have to type it, but usually, if people have long "passwords", it's because they use passphrases, which tend to actually be easier to type on real keyboards, but which are long because of the low entropy per character.
    • sbuttgereit 10y ago
      It depends on your needs. Clearly in my case: nope, not a problem. Otherwise I would have changed. And I think your use of the word "default" is appropriate; what I do most of the time is not what I do 100% of the time... there are exceptions. In those cases where I might need to manually enter a passphrase and I can't rely on the password manager functionality, I use a pass-sentence that is both long and includes some random characters thrown in. That can still get me to 100 characters pretty easily. But those cases a fairly rare for me. I'm also only very, very rarely using a device that I don't own (ok, I do access systems I don't own frequently, but using my device... ssh, etc). Most of the time my 100 character default doesn't give me any greater security than your 14 characters (assuming they're well constructed or random passwords) and things like multi-factor auth are often times much more important anyway. There are some times it can be useful; sometimes I can remember a 14 character password just by looking at it, even if it's random and not mine. 100 characters I can't. Since password managers can rely on things like cut and paste, rarely, but occasionally, I might accidentally paste a password somewhere I don't mean to: at 14 characters I might not notice, but at 100 I more likely will (or overrun the field and lose a piece of it anyway). At the end of the day, I have a password manager and I'm going to turn it to 11 and let it run. My personal practices are not necessarily my recommendations in this area, but they suit my needs. Either way, my point still stands: if you build software that takes passwords and you limit the length (or can't take longer passwords), provide meaningful feedback if your requirements are exceeded... makes me wonder what else I might be able to do if you didn't expect me to exceed your password length and respond properly.
• userbinator 10y ago
  Even 15, 16, 31, or 32 (all of which I've seen before) would make more sense. 12 is "odd".
  • wishinghand 10y ago
    I haven't tried to see if they've updated their requirements to be more secure, but Wells Fargo is 14 characters.
  • flukus 10y ago
    Unless they are trying to pack multiples of 2 at a row level. It's 12 so the can squeeze a char(2) somewhere else.