4 ms·

First National Bank (FNB) in South Africa has adopted every one of these absurd rules, and more: Passwords must contain a mixture of upper and lower case lette

• justinlardinois 10y ago
  > Length between 7 and 33 characters I've never understood why sites limit password length. You're (hopefully) hashing it anyways; the length of what the user enters has no bearing on what you're storing in your database.
  • mhenr18 10y ago
    Exactly. Limits only become reasonable when they're meant to stop you from uploading hundreds of megs worth of data and monopolising resources. A 1kb password or even a 1mb password supplied by a tiny fraction of a percent of users is not going to make an impact on you, but can provide that small group of users with a massively increased piece of mind.
  • logician76 10y ago
    If the password is too short, an attacker can brute force the hash by simply trying all 6 character combinations of allowed password characters, provided that the hashes get leaked or hacked, which happens quite a lot these days. (Or if the website is stupid enough to allow an attacker to brute force try all these combinations without throttling you or stopping you at the xth wrong entry)
    • justinlardinois 10y ago
      I was talking about maximum password lengths, not minimums.
  • nickpsecurity 10y ago
    "I've never understood why sites limit password length. You're (hopefully) hashing it anyways; the length of what the user enters has no bearing on what you're storing in your database." What if they upload a GB or TB binary as password? I've always wondered but nobody told me if there's some inherent cut-off that would prevent such a DoS attack.
    • justinlardinois 10y ago
      33 characters (and I often see less) is a far cry from a gigabyte. I think it's clear I was talking about unreasonably low limits.
      • Freak_NL 10y ago
        Exactly, such anti-abuse limits would start at, say, 256 characters. The amount of banks and services that limit their passwords to 20 characters or fewer is startling.
        • mrec 10y ago
          I've seen even worse than that - for low-importance passwords I normally record them in a mail-to-self memo then paste them into the signup form. I recently encountered one site that silently truncated the pasted password.
          • justinlardinois 10y ago
            While silent truncation is of course bad because it limits the potential entropy of a password, if implemented consistently it's technically not any worse than a limit that's presented to the user. But just wait until the new hire doesn't know about it and implements a form without it, and then all of the sudden users are entering the same "long" passwords they always have and scratching their heads when it fails.
  • Arkaad 10y ago
    Because more than 33 characters would take too much space, duh.
• ravenstine 10y ago
  > The same character cannot be used consecutively Doesn't that drastically lower the number of attempts required to exhaustive-search a password from a hash? Especially if people are using passwords as short as 7 characters. Even if not, that's one of the most moronic password rules I have heard.
  • siberianbear 10y ago
    Well, yes. But consider the opposite case: the company doesn't prohibit these kinds of passwords, and the attacker does an exhaustive search of ONLY passwords that have sequential characters. That attack may be better even though they are only searching through a fraction of the total password space, since users will very often choose passwords that have sequential letters.
• ts330 10y ago
  Then they send you emails (from some random non-official looking domain) with password protected PDFs and ask you use bits of your account details to open it. The opportunity for phishing is insane.