4 ms·
Why a max char count for password?? The max of 12 is awfully small. Edit: The app is quiting when I try to scroll through Ars Technica in List view.
by godinaa 8y ago
Why a max char count for password?? The max of 12 is awfully small.
Edit: The app is quiting when I try to scroll through Ars Technica in List view.
- meteor333 8y agoThanks for pointing it out. Let me check and increase the limit. Edit: Its fixed now. Increased to 128
- michaelbuckbee 8y agoThank you for that. Note: the trouble is that if you use a password manager it will create arbitrarily long and very secure passwords for you that _far_ exceed what you would expect for a "normal" limit.
- meteor333 8y agoSorry didn't think about that. Can you tell me what is generally accepted limit for password managers or in general?
- LyndsySimon 8y agoWhy have a limit at all? You should be comparing against a hash anyhow, which is fixed length. I generally use 128-char passwords by default, and only use shorter ones when a service requires it.
- meteor333 8y agoJust the db limit, but yes increasing to 128 shouldn't be an issue. Edit: Passwords are stored with bcrypt hash. That's right password limit shouldn't matter.
- usmannk 8y agoDoes this mean that you are storing plaintext passwords in the db? The hashes should be the same length regardless of the password length.
- deleted 8y ago[deleted]
- LyndsySimon 8y agoYikes. Yeah, you should be storing the password hashes in the DB, not the passwords. The hashes are going to be the same length regardless of the password's length. If you wanted to get real fancy, hash the password once on the client side (reducing it to a known length), then again on the server. You should also be using a per-user salt to prevent a rainbow table from being generated if your DB is leaked.
- meteor333 8y agoyup it is stored with bcrypt hash and per-user salt.
- egypturnash 8y agoLastPass currently caps its generated passwords at 100 but it used to be more like 1000.
- d-jo 8y agoLast Pass generates up to 100 characters. In addition, the OWASP authentication cheat sheet says a typical max is ~128 characters. https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Password_Length https://www.owasp.org/index.php/Authentication_Cheat_Sheet#P...
- signal11 8y agoNIST's 2017 guidelines say: 5.1.1.2: "Verifiers SHALL require subscriber-chosen memorized secrets to be at least 8 characters in length. Verifiers SHOULD permit subscriber-chosen memorized secrets at least 64 characters in length." [1] [1] https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html or https://doi.org/10.6028/NIST.SP.800-63b https://doi.org/10.6028/NIST.SP.800-63b
- meteor333 8y agoThank you. That helps.
- rabboRubble 8y agoI use a common password manager and its max generated password length is 64, so it's in agreement with NIST. That said I am able to manually add characters to increase beyond 64.
- drusepth 8y agoWhy is there a limit at all? When you hash the password, it should be a fixed size no matter the password length. Make sure you're not just storing the password on its own.
- infogulch 8y agoI recently discovered that some password hashes take time proportional to the length of the password times the number of rounds. E.g. if bcrypt work factor is set to 16 and you have a 1M byte password then the time is proportional to `1000000 * 2^16` Why it doesn't first hash the password so it's `1000000 + len(hash) * 2^16` is beyond me, and something a crypto expert will have to answer. In practice this means that setting an arbitrarily high limit on password size would open you up to a DOS attack via (effectively) quadratic time password hashing.