5 ms·

Sorry to reply with an off topic question but do you still work at AOL? If so, do you think there’s any chance AOL would consider allowing passwords longer than

Sorry to reply with an off topic question but do you still work at AOL? If so, do you think there’s any chance AOL would consider allowing passwords longer than 16 characters? I only use AOL for junk/spam mail but even in that instance would prefer to use a strong password. When you see the “password too long” error message it’s easy to worry that the password is being stored plain text in some space constrained column.

andybak 9y ago
Unless you're using a very constrained character set then 16 characters is pretty strong in my books. What's your threat model?
- dredmorbius 9y ago
  NIST guidelines are for a minimum length of 8 characters and a maximum length of no fewer than 64 characters. What is your basis for suggesting anything less than those guidelines is sufficient? https://pages.nist.gov/800-63-3/ https://pages.nist.gov/800-63-3/ https://qz.com/981941/the-us-standards-office-wants-to-do-away-with-periodic-password-changes/ https://qz.com/981941/the-us-standards-office-wants-to-do-aw...
  - th1nkdifferent 9y ago
    You should try plotting ease of recall vs the size of password. You will quickly realize there is a long tail beyond 16 characters.
    - _e 9y ago
      Diceware will solve that problem of easy recall + secure password: http://world.std.com/%7Ereinhold/diceware.html http://world.std.com/%7Ereinhold/diceware.html
    - Zarel 9y ago
      "correct horse battery staple" doesn't fit in 16 characters, and has has much better recall than basically all similarly-secure passwords that do. Longer passwords let you optimize passwords for ease of recall and security, rather than fitting in arbitrary requirements.
      - dancodes 9y ago
        Even though that phrase password is 16 characters long, it has the same entropy as a 9-10 letter long alphanumeric random password (according to KeePass' generator). I agree that it's easier to recall, but it's half as secure as a properly random 16 character one.
        dredmorbius 9y ago
        I've used Debian's xkcdpass to generat 50 sets of 100 million passwords, then then checked for duplicates. The algorithm uses six words and a large dictionary, but otherwise resembles the xkcd original. There were no duplicates in any of the 50 sets. (About a week's runtime on a fairly modest Intel processor.) Given that 100m accounts is a fair fraction of the world's active computer users, that's a pretty good start. (There are further reasons for finding passwords alone insufficient for security, but at least these are strong, and yet potentially memorable, passwords.)
    - sundvor 9y ago
      Recalling passwords? That's so yester-year. EDIT: Well, with the exception of your password manager one, if not using biometrics.
    - Larrikin 9y ago
      I consider it a good thing that I currently only know about 3-4 passwords and the rest are just unknown asterisks that get pasted in by my password manager.
    - nathanaldensr 9y ago
      You seem to think recalling passwords is a good idea--it's not. The desire to recall passwords leads to selecting very few passwords (if not just one) for many identities, which is very insecure. We should be encouraging people to select passwords that they can't rememeber so that they are then encouraged to generate them with a tool (my favorite being KeePass).

andybak 9y ago

Unless you're using a very constrained character set then 16 characters is pretty strong in my books. What's your threat model?

dredmorbius 9y ago
NIST guidelines are for a minimum length of 8 characters and a maximum length of no fewer than 64 characters. What is your basis for suggesting anything less than those guidelines is sufficient? https://pages.nist.gov/800-63-3/ https://pages.nist.gov/800-63-3/ https://qz.com/981941/the-us-standards-office-wants-to-do-away-with-periodic-password-changes/ https://qz.com/981941/the-us-standards-office-wants-to-do-aw...
- th1nkdifferent 9y ago
  You should try plotting ease of recall vs the size of password. You will quickly realize there is a long tail beyond 16 characters.
  - _e 9y ago
    Diceware will solve that problem of easy recall + secure password: http://world.std.com/%7Ereinhold/diceware.html http://world.std.com/%7Ereinhold/diceware.html
  - Zarel 9y ago
    "correct horse battery staple" doesn't fit in 16 characters, and has has much better recall than basically all similarly-secure passwords that do. Longer passwords let you optimize passwords for ease of recall and security, rather than fitting in arbitrary requirements.
    - dancodes 9y ago
      Even though that phrase password is 16 characters long, it has the same entropy as a 9-10 letter long alphanumeric random password (according to KeePass' generator). I agree that it's easier to recall, but it's half as secure as a properly random 16 character one.
      - dredmorbius 9y ago
        I've used Debian's xkcdpass to generat 50 sets of 100 million passwords, then then checked for duplicates. The algorithm uses six words and a large dictionary, but otherwise resembles the xkcd original. There were no duplicates in any of the 50 sets. (About a week's runtime on a fairly modest Intel processor.) Given that 100m accounts is a fair fraction of the world's active computer users, that's a pretty good start. (There are further reasons for finding passwords alone insufficient for security, but at least these are strong, and yet potentially memorable, passwords.)
  - sundvor 9y ago
    Recalling passwords? That's so yester-year. EDIT: Well, with the exception of your password manager one, if not using biometrics.
  - Larrikin 9y ago
    I consider it a good thing that I currently only know about 3-4 passwords and the rest are just unknown asterisks that get pasted in by my password manager.
  - nathanaldensr 9y ago
    You seem to think recalling passwords is a good idea--it's not. The desire to recall passwords leads to selecting very few passwords (if not just one) for many identities, which is very insecure. We should be encouraging people to select passwords that they can't rememeber so that they are then encouraged to generate them with a tool (my favorite being KeePass).