5 ms·

Was there ever a reason why a limit like this was a good idea?

by pietroglyph 8y ago

gruez 8y ago
legacy systems
- pietroglyph 8y ago
  I understand that, but I'm looking for something more specific... Hashes aren't length-limited by design; I suppose storage size or database limitations could be an issue, but a 6-character password in ASCII with 1 million users is 6 megabytes.
  - deleted 8y ago
    [deleted]
  - mitchty 8y ago
    Hashes aren't limited, but the os might be limited in its implementation. ref: https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/com.ibm.zos.v2r1.ikjc500/ikj2l2_LOGON_command_operands.htm https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/... And I quote: If you are RACF-defined, you must enter the password defined in the RACF® data set as the value for password. The new password specifies the password that is to replace the current password. new_password must be separated from password by a slash(/) and, optionally, one or more standard delimiters (tab, blank, or comma). new_password is 1 to 8 alphanumeric characters long. This operand is ignored for non-RACF defined users. (Printing is suppressed for some types of terminals when you respond to a prompt for a password.) With z/OS® V1R7 or later, the password and new_password can be in mixed case, if your installation has enabled RACF mixed case password support.
  - shakna 8y ago
    Some of these systems originate from the era when a 5mb hard drive was an incredible amount of space, even at enterprise level. They pre-date personal computing.
- Scoundreller 8y ago
  Do the other banks still have the same limitations at their root, but just take a numeric hash of whatever you enter, compare against a 6 digit integer and pray you don't find a collision?
turingcompeteme 8y ago
Not a 'good idea', but it's partly because the same password is used for telephone banking. And people seem to have trouble with typing long passwords on numerical keypads.

Was there ever a reason why a limit like this was a good idea?

gruez 8y ago

legacy systems

pietroglyph 8y ago
I understand that, but I'm looking for something more specific... Hashes aren't length-limited by design; I suppose storage size or database limitations could be an issue, but a 6-character password in ASCII with 1 million users is 6 megabytes.
- deleted 8y ago
  [deleted]
- mitchty 8y ago
  Hashes aren't limited, but the os might be limited in its implementation. ref: https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/com.ibm.zos.v2r1.ikjc500/ikj2l2_LOGON_command_operands.htm https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/... And I quote: If you are RACF-defined, you must enter the password defined in the RACF® data set as the value for password. The new password specifies the password that is to replace the current password. new_password must be separated from password by a slash(/) and, optionally, one or more standard delimiters (tab, blank, or comma). new_password is 1 to 8 alphanumeric characters long. This operand is ignored for non-RACF defined users. (Printing is suppressed for some types of terminals when you respond to a prompt for a password.) With z/OS® V1R7 or later, the password and new_password can be in mixed case, if your installation has enabled RACF mixed case password support.
- shakna 8y ago
  Some of these systems originate from the era when a 5mb hard drive was an incredible amount of space, even at enterprise level. They pre-date personal computing.
Scoundreller 8y ago
Do the other banks still have the same limitations at their root, but just take a numeric hash of whatever you enter, compare against a 6 digit integer and pray you don't find a collision?

turingcompeteme 8y ago

Not a 'good idea', but it's partly because the same password is used for telephone banking. And people seem to have trouble with typing long passwords on numerical keypads.