7 ms·

Password restrictions are the worst. Office365 doesn't support passwords > 16 characters in length. WTF.

Spooky23 9y ago
I think has something to do with older Outlook clients and how they pass credentials. You can bypass the limit with ADFS.
gruez 9y ago
serious question: what's the issue? 16 characters alphanumeric = 95 bits of entropy, which is enough for most purposes.
- YSFEJ4SWJUVU6 9y ago
  With password generation, nothing really. If you want to choose the password yourself, it limits your options (for no good reason for the user).
  - mediumdeviation 9y ago
    Yes - for instance it makes the Correct Horse Battery Stapler passphrase strategy[1] difficult to apply, because now you can only pick words up to ~4 letters long. [1]: https://xkcd.com/936/ https://xkcd.com/936/
  - jwilk 9y ago
    Right. Human-memorable passwords have low entropy density, likely less than 2 bits per character. 32 bits of entropy doesn't sound very appealing.
- exikyut 9y ago
  A long passphrase can be easier to remember than a 5h0rt 5tr1ng. On the mental side, it can take more internal *pointers to remember the latter than the former.
- psergeant 9y ago
  A common reason to limit the length of a password — and doubly so to a power of 2 — is that they’re being stored or passed around as plaintext
- shakna 9y ago
  95bits of entropy for a computer, but for an actual user? Humans are bad at remembering most things. The more entropy there is, the more difficult it tends to be for us to remember. The way for increasing password entropy, whilst lowering the human bound, tends to be by utilising things humans find easy to remember, but computers find difficult to randomly/brute-force solve. That usually requires a longer password. You can sort-of bypass the human memory problem by using password managers, but they have their own set of problems (mostly usability), and assuming people actually use them is an assumption too far in most cases.
- JohnStrangeII 9y ago
  It's a restriction without any reason other than decreasing security. (Unless they plan to store plaintext passwords, which should be prohibited by law.)
- deedubaya 9y ago
  I use a password manager with auto-generated password length "turned up to 11" (64 characters). It probably doesn't matter, but I am decreasing the secruity of my password because of their limitation.
deleted 9y ago
[deleted]
scrollaway 9y ago
Paypal passwords are 20 characters max. Also Paypal doesn't support any form of secure OTP. Also, Paypal forces security questions on the user. In other news, my Hearthstone account has better security than my money.
- shawnz 9y ago
  I've been locked out of my Hearthstone account for the last few weeks because I lost my 2fa authenticator and they've refused to remove it due to my driver's license being expired.
  - scrollaway 9y ago
    BTW, Battle.net Authenticators look nonstandard at first glance, but they are actually 8-digit TOTP. I wrote a Python library and command line utility which can create new Battle.net authenticators as well as generate codes and QR URIs: https://github.com/jleclanche/python-bna https://github.com/jleclanche/python-bna See the README for usage :) This should help you to have a backup next time you get locked out!
    - stryk 9y ago
      This just saved my ass. I only play Diablo 3 occasionally, but Blizzard doesn't offer their client on Windows Phone, which would have been great to know prior to switching over from Android. Fortunately I didn't have the same issues getting it taken off of my account as the parent comment , but I was stuck using SMS as a 2FA after that, which is no beuno. I just used your python script, imported the 'secret' into Microsoft Authenticator via the generated QR code, and now it is working just as if I was using one of their auth dongle doohickies. Fantastic, thank you sir/madam!
      - scrollaway 9y ago
        Glad it helped!
    - ZoFreX 9y ago
jsjohnst 9y ago
Up until about 2010, Amex Corporate Card website required passwords at minimum 6, but not more than 8, with minimum one upper/one lower/one number each, and zero anything else (aka no punctuation or non-basic ascii letter).

I think has something to do with older Outlook clients and how they pass credentials. You can bypass the limit with ADFS.

gruez 9y ago

serious question: what's the issue? 16 characters alphanumeric = 95 bits of entropy, which is enough for most purposes.

YSFEJ4SWJUVU6 9y ago
With password generation, nothing really. If you want to choose the password yourself, it limits your options (for no good reason for the user).
- mediumdeviation 9y ago
  Yes - for instance it makes the Correct Horse Battery Stapler passphrase strategy[1] difficult to apply, because now you can only pick words up to ~4 letters long. [1]: https://xkcd.com/936/ https://xkcd.com/936/
- jwilk 9y ago
  Right. Human-memorable passwords have low entropy density, likely less than 2 bits per character. 32 bits of entropy doesn't sound very appealing.
exikyut 9y ago
A long passphrase can be easier to remember than a 5h0rt 5tr1ng. On the mental side, it can take more internal *pointers to remember the latter than the former.
psergeant 9y ago
A common reason to limit the length of a password — and doubly so to a power of 2 — is that they’re being stored or passed around as plaintext
shakna 9y ago
95bits of entropy for a computer, but for an actual user? Humans are bad at remembering most things. The more entropy there is, the more difficult it tends to be for us to remember. The way for increasing password entropy, whilst lowering the human bound, tends to be by utilising things humans find easy to remember, but computers find difficult to randomly/brute-force solve. That usually requires a longer password. You can sort-of bypass the human memory problem by using password managers, but they have their own set of problems (mostly usability), and assuming people actually use them is an assumption too far in most cases.
JohnStrangeII 9y ago
It's a restriction without any reason other than decreasing security. (Unless they plan to store plaintext passwords, which should be prohibited by law.)
deedubaya 9y ago
I use a password manager with auto-generated password length "turned up to 11" (64 characters). It probably doesn't matter, but I am decreasing the secruity of my password because of their limitation.

deleted 9y ago

[deleted]

scrollaway 9y ago

Paypal passwords are 20 characters max. Also Paypal doesn't support any form of secure OTP. Also, Paypal forces security questions on the user. In other news, my Hearthstone account has better security than my money.

shawnz 9y ago
I've been locked out of my Hearthstone account for the last few weeks because I lost my 2fa authenticator and they've refused to remove it due to my driver's license being expired.
- scrollaway 9y ago
  BTW, Battle.net Authenticators look nonstandard at first glance, but they are actually 8-digit TOTP. I wrote a Python library and command line utility which can create new Battle.net authenticators as well as generate codes and QR URIs: https://github.com/jleclanche/python-bna https://github.com/jleclanche/python-bna See the README for usage :) This should help you to have a backup next time you get locked out!
  - stryk 9y ago
    This just saved my ass. I only play Diablo 3 occasionally, but Blizzard doesn't offer their client on Windows Phone, which would have been great to know prior to switching over from Android. Fortunately I didn't have the same issues getting it taken off of my account as the parent comment , but I was stuck using SMS as a 2FA after that, which is no beuno. I just used your python script, imported the 'secret' into Microsoft Authenticator via the generated QR code, and now it is working just as if I was using one of their auth dongle doohickies. Fantastic, thank you sir/madam!
    - scrollaway 9y ago
      Glad it helped!
  - ZoFreX 9y ago

jsjohnst 9y ago

Up until about 2010, Amex Corporate Card website required passwords at minimum 6, but not more than 8, with minimum one upper/one lower/one number each, and zero anything else (aka no punctuation or non-basic ascii letter).