5 ms·

I'd like to see maximum lengths too, there may be some unwelcome surprises. The worst password length I've seen recently is Skybet in the UK. It only allows di

by eterm 9y ago

I'd like to see maximum lengths too, there may be some unwelcome surprises. The worst password length I've seen recently is Skybet in the UK. It only allows digits 0-9 and has a maximum length of 5.

minikites 9y ago
I might be mis-remembering but I'm pretty sure I got bitten by PayPal of all places, I couldn't make a password longer than 20 characters.
- robin_reala 9y ago
  Yep, just checked that on their sign-up page and it’s max 20 characters. I guess DB space is expensive.
  - contravariant 9y ago
    Space is only a concern if they store the password in plaintext.
    - robin_reala 9y ago
      It was snark, but regardless I can’t think of a good reason to limit a password to 20 characters.
aussieguy1234 9y ago
Perhaps their passwords are stored in the database as an unencrypted INT
laumars 9y ago
I think it's actually 6 characters rather than 5 but yes, it's fscking terrible. It actually used to be worse, only allowing 4 characters (I'm guessing it was modeled on ATMs as they even refer to it as a "pin").
- eterm 9y ago
  You're right, it's actually 6. When I first read it as "PIN" I assumed it was some kind of quick password alternative for recognised devices and it would need a full password for unknown machines but nope, it's the whole password. It horrifies me that at some point they thought, "A 4 digit pin isn't very secure, 6 should be enough!"
  - deleted 9y ago
    [deleted]
sgift 9y ago
The best ones are pages where the register dialog only allows a max length, silently truncates it and then the login dialog allows every length. And then you start to search why the password you generated ten seconds ago doesn't work anymore. So much fun .. not.
- diggan 9y ago
  This bothers me to no end. Generate a new password, everything seems fine. A week later when I want to login again, suddenly the password doesn't work. After resetting the password and changing it again, I notice the little "max 12 characters length" message but it doesn't warn you, just silently truncates. So nowadays, when I change my passwords, I have to make sure I don't hit the length limit, and after changing the password, confirm that it really changed to what I want to. In the few cases where it doesn't, I need to go through the entire dance to reset my password again...
- JepZ 9y ago
  Speaking of truncating passwords: Do you remember that Amazon security flaw? https://www.reddit.com/r/WTF/comments/f96w7/amazon_security_flaw_wtf/ https://www.reddit.com/r/WTF/comments/f96w7/amazon_security_...
frou_dh 9y ago
In discussions of whether there should be a maximum password length at all, it's funny to introduce the scenario of a user wanting to use a password that is 1GB worth of text.
- sgift 9y ago
  Well, you wouldn't store the original password anywhere, right? Right? So it is at most a RAM problem. Still, interesting talk point. Not very practical, but interesting.
  - leipert 9y ago
    not only interesting, but it is a security consideration [1]. Depending on hashing algorithm, it can take minutes to hash long passwords, so it's not just a RAM, but also a CPU issue. [1]: https://www.helpnetsecurity.com/2013/09/17/too-long-passwords-can-dos-some-servers/ https://www.helpnetsecurity.com/2013/09/17/too-long-password...
  - frou_dh 9y ago
    > right? Right? This is part of why it's funny to bring up. People are so used to focusing on bozos (who store plaintext) vs the initiated (who store salted hashes) that they are taken by surprise by other dimensions.
- Tyrannosaur 9y ago
  I always wondered about that too- I recently came across a discussion somewhere that the password limit should be the max allowed for the POST to that website. Or maybe a bit less, to help prevent DOS attacks. I always thought the password should be hashed client-side. Supposedly that has some problems and it would still need to be hashed server-side as well. So I have a proposal: client-side, hash the password. Can use any hash, although hash selection does limit the password security to its output. That hash is the new password sent over the wires to the server, that does proper password handling, but it is guaranteed a password of (say for SHA-256) 256 bits; if it receives a password that doesn't look like SHA-256 output it can automatically throw it out without even checking. The client can then store the hash-input in his password manager, and it can be literally anything that can be thrown at the SHA hash. Is this feasible?

by eterm 9y ago

I'd like to see maximum lengths too, there may be some unwelcome surprises. The worst password length I've seen recently is Skybet in the UK. It only allows digits 0-9 and has a maximum length of 5.

minikites 9y ago

I might be mis-remembering but I'm pretty sure I got bitten by PayPal of all places, I couldn't make a password longer than 20 characters.

robin_reala 9y ago
Yep, just checked that on their sign-up page and it’s max 20 characters. I guess DB space is expensive.
- contravariant 9y ago
  Space is only a concern if they store the password in plaintext.
  - robin_reala 9y ago
    It was snark, but regardless I can’t think of a good reason to limit a password to 20 characters.

aussieguy1234 9y ago

Perhaps their passwords are stored in the database as an unencrypted INT

laumars 9y ago

I think it's actually 6 characters rather than 5 but yes, it's fscking terrible. It actually used to be worse, only allowing 4 characters (I'm guessing it was modeled on ATMs as they even refer to it as a "pin").

eterm 9y ago
You're right, it's actually 6. When I first read it as "PIN" I assumed it was some kind of quick password alternative for recognised devices and it would need a full password for unknown machines but nope, it's the whole password. It horrifies me that at some point they thought, "A 4 digit pin isn't very secure, 6 should be enough!"
- deleted 9y ago
  [deleted]

sgift 9y ago

The best ones are pages where the register dialog only allows a max length, silently truncates it and then the login dialog allows every length. And then you start to search why the password you generated ten seconds ago doesn't work anymore. So much fun .. not.

diggan 9y ago
This bothers me to no end. Generate a new password, everything seems fine. A week later when I want to login again, suddenly the password doesn't work. After resetting the password and changing it again, I notice the little "max 12 characters length" message but it doesn't warn you, just silently truncates. So nowadays, when I change my passwords, I have to make sure I don't hit the length limit, and after changing the password, confirm that it really changed to what I want to. In the few cases where it doesn't, I need to go through the entire dance to reset my password again...
JepZ 9y ago
Speaking of truncating passwords: Do you remember that Amazon security flaw? https://www.reddit.com/r/WTF/comments/f96w7/amazon_security_flaw_wtf/ https://www.reddit.com/r/WTF/comments/f96w7/amazon_security_...

frou_dh 9y ago

In discussions of whether there should be a maximum password length at all, it's funny to introduce the scenario of a user wanting to use a password that is 1GB worth of text.

sgift 9y ago
Well, you wouldn't store the original password anywhere, right? Right? So it is at most a RAM problem. Still, interesting talk point. Not very practical, but interesting.
- leipert 9y ago
  not only interesting, but it is a security consideration [1]. Depending on hashing algorithm, it can take minutes to hash long passwords, so it's not just a RAM, but also a CPU issue. [1]: https://www.helpnetsecurity.com/2013/09/17/too-long-passwords-can-dos-some-servers/ https://www.helpnetsecurity.com/2013/09/17/too-long-password...
- frou_dh 9y ago
  > right? Right? This is part of why it's funny to bring up. People are so used to focusing on bozos (who store plaintext) vs the initiated (who store salted hashes) that they are taken by surprise by other dimensions.
Tyrannosaur 9y ago
I always wondered about that too- I recently came across a discussion somewhere that the password limit should be the max allowed for the POST to that website. Or maybe a bit less, to help prevent DOS attacks. I always thought the password should be hashed client-side. Supposedly that has some problems and it would still need to be hashed server-side as well. So I have a proposal: client-side, hash the password. Can use any hash, although hash selection does limit the password security to its output. That hash is the new password sent over the wires to the server, that does proper password handling, but it is guaranteed a password of (say for SHA-256) 256 bits; if it receives a password that doesn't look like SHA-256 output it can automatically throw it out without even checking. The client can then store the hash-input in his password manager, and it can be literally anything that can be thrown at the SHA hash. Is this feasible?