11 ms·
Fittingly, attempting to change my password to a 32-character random string generated by 1Password returns an error that the password "cannot contain my email o
by Arubis 10y ago
Fittingly, attempting to change my password to a 32-character random string generated by 1Password returns an error that the password "cannot contain my email or username", regardless of the contents of that random string (I tried several).
It does, however, _happily_ accept `passwordpassword` and cheerily move along to confirming that my recovery email account from 2003 is still valid.
- duaneb 10y agoGonna guess that's a bad message for a password length violation or something else. Not that it's much better. Is it so hard to allow 50 character passwords?
- bagacrap 10y agoI'm guessing it detected an @ symbol?
- divanvisagie 10y agohas anyone tried password@password ?
- AsyncAwait 10y agoif the password is stored properly, (i.e. bcrypt), the number of characters shouldn't matter at all, be it 50 or 5000.
- deleted 10y ago[deleted]
- drodgers 10y agoIf the password is stored properly, (i.e. bcrypt) then there does need to be some length limit or it becomes too easy to DoS a service by sending it hundreds of megabytes of password to bcrypt. There's no reason for that length limit to be less than 100 characters though.
- dogma1138 10y agoYou are going to be limited by the max http request size way before that. To upload 100s or even more than a few megs you need a multipart message, a password form won't accept MP http requests.
- patates 10y agoOn the back-end there usually is a naive POST handler which happily accepts anything it can parse, unless a mature framework with sane defaults is used.
- cookiecaper 10y agoYep, people who've run marginally popular sites have dealt with this before. Give someone a text box and watch them try to stuff 4GB of content in it. There has to be a cutoff somewhere, but as you note, it should be well outside of the realm of reasonable password lengths (hundreds of characters).
- jsjohnst 10y agoGitHub is the only website I can think of off the top of my head that doesn't limit to an arbitrarily small number (aka <100). Do you name any other "major" websites that allow 100 character passwords?
- snowpanda 10y agoAmazon.com allows 128 characters: https://www.amazon.com/gp/help/customer/display.html?nodeId=10412241 https://www.amazon.com/gp/help/customer/display.html?nodeId=...
- amichal 10y agoAnything built with the popular rails gem devise allows 128 by default [1] https://github.com/plataformatec/devise/blob/88724e10adaf9ffd1d8dbfbaadda2b9d40de756a/lib/generators/templates/devise.rb#L157 https://github.com/plataformatec/devise/blob/88724e10adaf9ff...
- sk5t 10y agoIt sort of does matter for bcrypt, surprisingly: http://security.stackexchange.com/questions/39849/does-bcrypt-have-a-maximum-password-length http://security.stackexchange.com/questions/39849/does-bcryp... In the interests of hewing closest to cryptographic reality, I design not to allow a password longer than the algorithm can usefully use.
- Dylan16807 10y agoThat's just a bug. Truncation invalidates the 'stored properly' part of the statement.
- mannykannot 10y agoCould you expand on that? I did not think bcrypt was responsible for storing the resultant hash. The limit appears to be in calculating the hash.
- sk5t 10y agoBcrypt spits out a string, that the caller must store, somewhere. I presume the parent post means that Bcrypt "stores" in its output string a value that, for all practical purposes, varies reliably with the same salt but different plaintext.
- Dylan16807 10y agoThe original phrasing was "stored properly, (i.e. bcrypt)". That's including the hashing as part of the 'storing'. Bcrypt has a size limit, but a size limit is not the same thing as truncating. It's broken code on the front end that truncates instead of doing something like sha512.
- dlubarov 10y agoI think it's best to allow longer passwords for those who use long phrases. It's easier to remember the full phrase than a truncated version. You could show a warning that the extra chars beyond 50-55 will be ignored.
- chrischen 10y agoIt's probably a naive substring detection check.
- raverbashing 10y agoJust leave it at passwordpassword, it will be leaked eventually anyway Strong passwords that need to be memorized shouldn't be wasted on security bozos
- contravariant 10y agoI can kind of understand that reasoning, but one of the nicer things about strong passwords is that there are a lot of them. In some sense that's what makes them strong passwords.
- rovr138 10y agoHe doesn't need to memorize it. He mentioned he used 1Password to generate it. I'd assume he's storing it there too.
- raverbashing 10y agoAt the very least you need to memorize the 1pw password, but I do memorize some others as well
- _ao789 10y agoI've always wondered when 1Password is going to get hacked..
- oddevan 10y agoWon't do much; AFAIK everything is encrypted client-side with your master password. So a hacker could, in theory, get my encrypted database, but by the time they crack my strong password, I will, at the very least, have changed all those passwords.
- developer2 10y agoThat's not what a hack against 1Password, LastPass, or similar product will look like. When it happens, it will be because someone manages to commit to the VCS repository of one or more of their client applications (iOS, Android, desktop, etc.). All it takes is a few lines of code to dump the unencrypted contents on the device itself, and post them to some API endpoint or email address. One commit to a VCS by a disgruntled employee, or an attacker who social engineers credentials to the VCS, and the client applications themselves - which must be trusted to decrypt the contents locally - will be compromised. This is the problem with proprietary password managers, where the client applications are provided by the company. You cannot vet that software which is running on your device today, let alone all the app updates coming down the pipeline.
- dbg31415 10y ago* Defending Against Hackers Took a Back Seat at Yahoo, Insiders Say - The New York Times || http://www.nytimes.com/2016/09/29/technology/yahoo-data-breach-hacking.html http://www.nytimes.com/2016/09/29/technology/yahoo-data-brea... Time to update that article from September. Hooray for Yahoo, they made it 76 days without a 500M+ user security breach. (No, I don't know the actual dates... just making a joke.)
- dmckeon 10y agoI hit this on the last Yahoo hack go-round, and it seemed that having a name in the form 'F Lastname' (for example) disallowed use of the letter F in the password. I say "seemed" as I did not go through the exercise of testing with multiple combinations of name, initial, and password.
- late2part 10y agoJust follow NIST guidelines and never change it. That way when the servers in Utah crack your password, they don't have to recrack it later.
- syntheticnature 10y agoI've run into off-by-one issues in password length requirements in the past, so if 32 characters is the stated maximum it might only be capable of 31 on the validation side.
- KMag 10y agoThat asymmetry in length support strongly suggests they're storing passwords in plain text.
- johnchristopher 10y agoLast time I tried changing my Yahoo password it took me days before it accepted something (and I had password generator scripts and my brain). Now it's back to something along the lines of `letmein`.
- mianaezat 10y agoStay at home mom Kelly Richards from New York after resigning from her full time job managed to average from $6000-$8000 a month from freelancing at home… This is how she done ,,,,,,,,,,,,,,, http://www.ebiz3.com http://www.ebiz3.com
- ajanuary 10y agoI tried to change it to a 64 character random 1Password string with numbers, characters and symbols. It complained it was too easy to guess. I submitted the exact same password and it accepted it.