6 ms·

I rarely use Paypal, but was forced to use it recently for something with no other payment option. Whilst there I decided to change my password, and was horrifi

I rarely use Paypal, but was forced to use it recently for something with no other payment option. Whilst there I decided to change my password, and was horrified to find that they limit passwords to 20 characters. It got me thinking about the standard assumption that any system limiting chars in a password must be storing passwords in plaintext and not hashing them, else there would be no logical reason to do so (since hash length is constant regardless of input length) - with the only exception being placing a really large limit (say 1024 chars) just to avoid performance issues with hashing really massive passwords. But.. I refuse to accept that's what's happening here. It simply can't be the case that Paypal is storing plaintext passwords, can it? So there must be another explanation - but what is it? The only thing I can think is that perhaps they are encrypting passwords, instead of hashing them, or started out doing this in the early days and have since switched to hashing passwords, but there were by then so many layers of validation cruft and/or dependent systems that somehow relied on the 20 char limit being enforced, that they were unable to remove the limit without breaking everything, and they've decided the tradeoff of just sticking with a 20 char limit is worth it. Does anyone know of or can think of a better explanation for this?

ethbro 7y ago
> Does anyone know of or can think of a better explanation for this? Mainframe.
- brobdingnagians 7y ago
  Could you elaborate a little bit on this? I'm not familiar with mainframes, but genuinely curious what specifically would cause this?
  - chrisdew 7y ago
    Some financial systems, a large number of which run on mainframes, have databases where all fields are fixed length. (A database with fixed-length records is trivial to access randomly.) One of my credit cards lists my name as "Christophe" rather than "Christopher" as they have a fixed-length 10 character field for first names. Customer support said it was unfixable. It only takes one such system, in a complex web, to impose that limit on all systems.
    - brownbat 7y ago
      It's possible, but this explanation still implies they're storing the passwords, not the hashes.
      - winkeltripel 7y ago
        Think more along the lines of "they once had a mainframe in their infrastructure which stored passwords instead of hashes, which caused their requirements to limit the length of passwords to 20 characters, even if that system is no longer in use, or now uses hashes."
        Thorrez 7y ago
        Sure, but that means that currently there's no reason to have the limit, except that they don't want to invest any effort to change it.
    - astura 7y ago
      At least American Express automatically changes "Christopher" to "C" so your first name is abbreviated rather than just cut off.
      - Thorrez 7y ago
        Names are expected to be stored in a database, passwords are not (only the hash should be stored).
    - mclehman 7y ago
      A similar thing happens to me when I fly. My boarding passes usually truncate the middle name field which in my case (typically) results in the name of a religious figure rather than an uncommon or obviously truncated name. This has never been an actual issue (or even commented on), but another middle name discrepancy has. Back in high school, there were some issues with my name on my state ID not exactly matching the school's entry for me.
- gdfasfklshg4 7y ago
  This is a very likely answer. Strange that it is downvoted.
  - ethbro 7y ago
    Eh. No worries. I expect a relatively small minority of the HN crowd have exposure to decades-old mainframe systems. It seemed a plausible rationale, given the state of the world ~2000 when PayPal was ramping up was very different. Especially in the financial sector, I can see partners and/or requisite systems to interface with being heavily mainframe-based. And now, even if PayPal is following best practices, it's possible one of their counterparties is stuck in the 1980s. People forget that "building Fort Knox around a private line from X DC to Y DC" is sometimes cheaper than "rewrite COBOL system of record that no one alive worked on."
    - rs23296008n1 7y ago
      My experience with multiple identity systems matches the mainframe or mainframe era explanation. Old systems had to draw a line. So they did. And those lines still ripple like waves through modern systems even now.
  - Thorrez 7y ago
    "Mainframe" doesn't seem like an actual answer to me. Why can't mainframes handle passwords longer than 20 characters? Are mainframes incapable of doing password hashing? Can't modern databases have text fields with a max of 20 characters, why is that problem unique to mainframes?
iaml 7y ago
Honestly, I see this kind of a stupid decisions happen when some analyst makes them and not actual developers.
scrollaway 7y ago
They've very slowly been getting better at various ridiculous UI issues. For example, they finally have a proper TOTP system (rather than their old security key that nobody used). But yes 20 character password is infuriating. My guess is that, at some point, it's extremely hard to change the password character limit and make sure it's correctly updated everywhere at once. Passwords are used in several places and they're afraid of missing a few. That's my most generous reading of the situation. I still think Paypal is pathetic. Their country locking is the most awful shit: you can't use a foreign phone number, it has to be one of the country you registered with Paypal. If you move country, tough fucking luck, you have to close your account and open a new one and that's "standard procedure".
- sunderw 7y ago
  Your explanation seems very likely. My supermarket has different websites (for their card or online shopping), and one has a X-characters limit while the other does not. It has been a BIG hassle to get rid of all the problems I had (and still occassionnaly have some trouble). So while having a password character limit makes customers angry, it is better than breaking everything.
- katsura 7y ago
  It is not just foreign phone number, but IBAN too (last time I checked). I live in Spain, and wasn't able to add my German bank account.
viraptor 7y ago
I don't know where the low password limits come from, but everyone has some kind of limit. I guess people just choose a "nobody will use a password longer than X" number. This is completely unrelated to the backend storage and hashed passwords are commonly limited this way.
- kibwen 7y ago
  A limit as low as 20 absolutely has its roots in insecure prehistoric password storage policies, even if the implementation happens to have been updated at some point in the past two decades to no longer store passwords in plaintext. As you say, everybody has some kind of limit, if only to prevent DoS attacks, but that limit should be closer to 1000 bytes than 20 bytes.
  - viraptor 7y ago
    It doesn't have to be an old decision. I've seen new systems applying the same rule without any technical reasoning. Google "(framework) signup form" and you'll find lots of examples. Third link for rails: https://stackoverflow.com/questions/31105996/ruby-on-rails-what-is-the-best-way-to-make-a-registration-form-using-a-bootstra https://stackoverflow.com/questions/31105996/ruby-on-rails-w... - written in 2015, has artificial limit 8-20 characters without any technical reason.
    - saltminer 7y ago
      Yep, just look at the CTA's Ventra system, which came online in 2013. 20 character password limit, but implemented in the worst possible way: only on the web UI, and they don't tell you about it. Basically, I generated a 32 character password in my password manager, pasted it in, got no errors when I made my account, and could login in Chrome successfully. However, I couldn't login on the mobile app. I tried manually typing, copy/pasting, nothing worked (it doesn't even seem like they auto-lock accounts after 15 failed login attempts...). So I went to change my password on my desktop and noticed it stopped accepting anything after 20 characters. The field silently truncated my password. So I typed the first 20 into the mobile app, and was able to login. The worst part about this system is that since the mobile app doesn't respect the limit (not sure if there is a limit in the app, I was able to do 64 characters successfully), you can make your account inaccessible from web browsers with a >20 character password (meaning it's not a DB restriction, it's just an arbitrary client-side restriction, and it's even not implemented consistently). I reported this bug last week and got a generic email response, so it probably still works for now.
pteraspidomorph 7y ago
I know the "logic" behind modern low password length limits for services like Paypal. Too many of their users are literally incapable of remembering their passwords and call/e-mail them bitching about how they're entering the right password and their account won't let them in and now they can't get to their money and bogus threats of legal action. So they encourage weak passwords and try to handle security on their side by flagging accounts for any reason and using 2FA. Recently they started requiring one number or special character in passwords, which puts them about 15 years behind the times when it comes to password policies.
- katsura 7y ago
  If you forget your password then there is basically no way of contacting them. I lost my 2FA phone number, and wanted to know if there is anything I can do to get my account back? There is no contact form, no customer chat/phone number, and their issue tracker is only available if you log in. Finally, I found an email address on some other website, contacted them, then I got an email saying they answered my issue, and if I'm satisfied with their answer? Of course, I never was able to see their answer because I cannot log in to open the issue tracker. So, in the end I just gave up.
  - pteraspidomorph 7y ago
    Oh, I remember having that problem a long time ago! It's still like that? I'm pretty sure this was more than 10 years ago for me. I just abandoned that account.
- jeromegv 7y ago
  Their 2FA policy is awful, SMS or nothing. At least that's the case in Canada (I heard it might be different in other regions).
  - Thorrez 7y ago
    Just now I (in the US) added TOTP (Google Authenticator) 2FA, and removed my old SMS 2FA. It does seem a bit laggy but I was able to do it and log in.
lukeschlather 7y ago
bcrypt is has long been regarded as the "best" secure hashing function, and it limits input passwords to 50-72 bytes. Assuming utf-8 input a character can plausibly be 4 bytes, which turns 72 bytes into 18 characters max. It looks like Argon2 is newer and doesn't have a max length but still it's likely most sites are using bcrypt. There's also a kind of handwavy "more than 20 characters is likely to be malicious input." Which is a little bit of a cop out but also probably true in general.
torgoguys 7y ago
There's basically a 0% chance that it is because they don't hash passwords and they're a limit on a table column or something. Paypal has faults, but they're not that incompetent. The more charitable logic for this policy goes like this: 1) for those who want security, 20 digits of random characters using a password manager is plenty 2) for those who actually remember and type a password (i.e., just a regular password), requiring them to keep it less than 20 characters increases the odds that they can actually type it in correctly (think elderly or more easily confused people here) and that reduces calls to customer service to complain that their password doesn't work. Reason #442 to use a password manager.
- leddt 7y ago
  A passphrase can easily exceed 20 characters and be memorable. They are usually considered a good security practice for people not familiar with (or not willing to use) password managers.
maemilius 7y ago
The rules surrounding financial institutions (in the US, at least) are weird and some of their information "security" rules are laughably out of date/ineffectual. I'm not particularly familiar with those security rules (even less with the rules of other countries) so I wouldn't be surprised if this isn't a rule in one of the countries PayPal operates in that they just decided to use everywhere to make it easier.
ken 7y ago
When I changed my password there, not too long ago, it was worse. The "change password" page (I later discovered) silently cropped the long random password I pasted, while the "log in" page required the saved (truncated) password exactly. I don't know how they expected anyone to figure that out. I suspect the answer to your question is that what we know as "Paypal.com" is a collection of 57 different legacy systems that were hacked together over a period of 20 years. It's not that a designer sat down one day and spec'd out the design we see. It's more like it used to be much worse, and then they fixed 173 bugs (sometimes is an overly conservative way), and we're seeing the result of that. Unless a software team is very careful, what the users see is software archaeology, not UX design.
- Marsymars 7y ago
  This is true. For a good example, look at the process if you want to purchase something in a foreign currency on Paypal without Paypal taking an extra ~3.5% cut: https://www.gamedealscanada.com/2018/06/27/changing-paypals-default-currency-conversion-option/ https://www.gamedealscanada.com/2018/06/27/changing-paypals-...
- epicalex 7y ago
  >When I changed my password there, not too long ago, it was worse. The "change password" page (I later discovered) silently cropped the long random password I pasted, while the "log in" page required the saved (truncated) password exactly. I don't know how they expected anyone to figure that out The British Airways site does exactly the same thing, took me about 5 attempts at resetting my password before I realised what was going on...
slondr 7y ago
My PayPal password is along the lines of thirty-two characters, so this comment confuses me a lot.
- Thorrez 7y ago
  I just now went to paypal and tried to change my password to something long. It said "Try another password. It must be less than 20 characters."
tikiman163 7y ago
The reason for the limit is actually quite stupid. PayPal does store the hashed version of your password as is required of any user database that is part of a payment processing system. However, because PayPal has been around so long your password is transmitted to the server using a two-way encrytion scheme so that the server side can consistently apply hashing without requiring client side code to do so which makes things much harder and requires more bandwidth to be delivered. Bandwidth concerns finanlly brings us to the reason that paypal limits the password size to 20. PayPal uses an authentication scheme that stores the encrypted password client side and requires it to be resent with every request (or at least used to). Because the password isn't hashed before being transmitted, and is present with every request, they limited the size. All of this was designed and implemented more than 10 years ago and even though both the bandwidth concerns and the need to send the password with every request are both outdated and paypal has likely updated to newer systems that remove these concerns entirely, companies rarely re-examine these kind of hard coded limitations unless they are legally required to.

ethbro 7y ago

> Does anyone know of or can think of a better explanation for this? Mainframe.

brobdingnagians 7y ago
Could you elaborate a little bit on this? I'm not familiar with mainframes, but genuinely curious what specifically would cause this?
- chrisdew 7y ago
  Some financial systems, a large number of which run on mainframes, have databases where all fields are fixed length. (A database with fixed-length records is trivial to access randomly.) One of my credit cards lists my name as "Christophe" rather than "Christopher" as they have a fixed-length 10 character field for first names. Customer support said it was unfixable. It only takes one such system, in a complex web, to impose that limit on all systems.
  - brownbat 7y ago
    It's possible, but this explanation still implies they're storing the passwords, not the hashes.
    - winkeltripel 7y ago
      Think more along the lines of "they once had a mainframe in their infrastructure which stored passwords instead of hashes, which caused their requirements to limit the length of passwords to 20 characters, even if that system is no longer in use, or now uses hashes."
      - Thorrez 7y ago
        Sure, but that means that currently there's no reason to have the limit, except that they don't want to invest any effort to change it.
  - astura 7y ago
    At least American Express automatically changes "Christopher" to "C" so your first name is abbreviated rather than just cut off.
    - Thorrez 7y ago
      Names are expected to be stored in a database, passwords are not (only the hash should be stored).
  - mclehman 7y ago
    A similar thing happens to me when I fly. My boarding passes usually truncate the middle name field which in my case (typically) results in the name of a religious figure rather than an uncommon or obviously truncated name. This has never been an actual issue (or even commented on), but another middle name discrepancy has. Back in high school, there were some issues with my name on my state ID not exactly matching the school's entry for me.
gdfasfklshg4 7y ago
This is a very likely answer. Strange that it is downvoted.
- ethbro 7y ago
  Eh. No worries. I expect a relatively small minority of the HN crowd have exposure to decades-old mainframe systems. It seemed a plausible rationale, given the state of the world ~2000 when PayPal was ramping up was very different. Especially in the financial sector, I can see partners and/or requisite systems to interface with being heavily mainframe-based. And now, even if PayPal is following best practices, it's possible one of their counterparties is stuck in the 1980s. People forget that "building Fort Knox around a private line from X DC to Y DC" is sometimes cheaper than "rewrite COBOL system of record that no one alive worked on."
  - rs23296008n1 7y ago
    My experience with multiple identity systems matches the mainframe or mainframe era explanation. Old systems had to draw a line. So they did. And those lines still ripple like waves through modern systems even now.
- Thorrez 7y ago
  "Mainframe" doesn't seem like an actual answer to me. Why can't mainframes handle passwords longer than 20 characters? Are mainframes incapable of doing password hashing? Can't modern databases have text fields with a max of 20 characters, why is that problem unique to mainframes?

iaml 7y ago

Honestly, I see this kind of a stupid decisions happen when some analyst makes them and not actual developers.

scrollaway 7y ago

They've very slowly been getting better at various ridiculous UI issues. For example, they finally have a proper TOTP system (rather than their old security key that nobody used). But yes 20 character password is infuriating. My guess is that, at some point, it's extremely hard to change the password character limit and make sure it's correctly updated everywhere at once. Passwords are used in several places and they're afraid of missing a few. That's my most generous reading of the situation. I still think Paypal is pathetic. Their country locking is the most awful shit: you can't use a foreign phone number, it has to be one of the country you registered with Paypal. If you move country, tough fucking luck, you have to close your account and open a new one and that's "standard procedure".

sunderw 7y ago
Your explanation seems very likely. My supermarket has different websites (for their card or online shopping), and one has a X-characters limit while the other does not. It has been a BIG hassle to get rid of all the problems I had (and still occassionnaly have some trouble). So while having a password character limit makes customers angry, it is better than breaking everything.
katsura 7y ago
It is not just foreign phone number, but IBAN too (last time I checked). I live in Spain, and wasn't able to add my German bank account.

viraptor 7y ago

I don't know where the low password limits come from, but everyone has some kind of limit. I guess people just choose a "nobody will use a password longer than X" number. This is completely unrelated to the backend storage and hashed passwords are commonly limited this way.

kibwen 7y ago
A limit as low as 20 absolutely has its roots in insecure prehistoric password storage policies, even if the implementation happens to have been updated at some point in the past two decades to no longer store passwords in plaintext. As you say, everybody has some kind of limit, if only to prevent DoS attacks, but that limit should be closer to 1000 bytes than 20 bytes.
- viraptor 7y ago
  It doesn't have to be an old decision. I've seen new systems applying the same rule without any technical reasoning. Google "(framework) signup form" and you'll find lots of examples. Third link for rails: https://stackoverflow.com/questions/31105996/ruby-on-rails-what-is-the-best-way-to-make-a-registration-form-using-a-bootstra https://stackoverflow.com/questions/31105996/ruby-on-rails-w... - written in 2015, has artificial limit 8-20 characters without any technical reason.
  - saltminer 7y ago
    Yep, just look at the CTA's Ventra system, which came online in 2013. 20 character password limit, but implemented in the worst possible way: only on the web UI, and they don't tell you about it. Basically, I generated a 32 character password in my password manager, pasted it in, got no errors when I made my account, and could login in Chrome successfully. However, I couldn't login on the mobile app. I tried manually typing, copy/pasting, nothing worked (it doesn't even seem like they auto-lock accounts after 15 failed login attempts...). So I went to change my password on my desktop and noticed it stopped accepting anything after 20 characters. The field silently truncated my password. So I typed the first 20 into the mobile app, and was able to login. The worst part about this system is that since the mobile app doesn't respect the limit (not sure if there is a limit in the app, I was able to do 64 characters successfully), you can make your account inaccessible from web browsers with a >20 character password (meaning it's not a DB restriction, it's just an arbitrary client-side restriction, and it's even not implemented consistently). I reported this bug last week and got a generic email response, so it probably still works for now.

pteraspidomorph 7y ago

I know the "logic" behind modern low password length limits for services like Paypal. Too many of their users are literally incapable of remembering their passwords and call/e-mail them bitching about how they're entering the right password and their account won't let them in and now they can't get to their money and bogus threats of legal action. So they encourage weak passwords and try to handle security on their side by flagging accounts for any reason and using 2FA. Recently they started requiring one number or special character in passwords, which puts them about 15 years behind the times when it comes to password policies.

katsura 7y ago
If you forget your password then there is basically no way of contacting them. I lost my 2FA phone number, and wanted to know if there is anything I can do to get my account back? There is no contact form, no customer chat/phone number, and their issue tracker is only available if you log in. Finally, I found an email address on some other website, contacted them, then I got an email saying they answered my issue, and if I'm satisfied with their answer? Of course, I never was able to see their answer because I cannot log in to open the issue tracker. So, in the end I just gave up.
- pteraspidomorph 7y ago
  Oh, I remember having that problem a long time ago! It's still like that? I'm pretty sure this was more than 10 years ago for me. I just abandoned that account.
jeromegv 7y ago
Their 2FA policy is awful, SMS or nothing. At least that's the case in Canada (I heard it might be different in other regions).
- Thorrez 7y ago
  Just now I (in the US) added TOTP (Google Authenticator) 2FA, and removed my old SMS 2FA. It does seem a bit laggy but I was able to do it and log in.

lukeschlather 7y ago

bcrypt is has long been regarded as the "best" secure hashing function, and it limits input passwords to 50-72 bytes. Assuming utf-8 input a character can plausibly be 4 bytes, which turns 72 bytes into 18 characters max. It looks like Argon2 is newer and doesn't have a max length but still it's likely most sites are using bcrypt. There's also a kind of handwavy "more than 20 characters is likely to be malicious input." Which is a little bit of a cop out but also probably true in general.

torgoguys 7y ago

There's basically a 0% chance that it is because they don't hash passwords and they're a limit on a table column or something. Paypal has faults, but they're not that incompetent. The more charitable logic for this policy goes like this: 1) for those who want security, 20 digits of random characters using a password manager is plenty 2) for those who actually remember and type a password (i.e., just a regular password), requiring them to keep it less than 20 characters increases the odds that they can actually type it in correctly (think elderly or more easily confused people here) and that reduces calls to customer service to complain that their password doesn't work. Reason #442 to use a password manager.

leddt 7y ago
A passphrase can easily exceed 20 characters and be memorable. They are usually considered a good security practice for people not familiar with (or not willing to use) password managers.

maemilius 7y ago

The rules surrounding financial institutions (in the US, at least) are weird and some of their information "security" rules are laughably out of date/ineffectual. I'm not particularly familiar with those security rules (even less with the rules of other countries) so I wouldn't be surprised if this isn't a rule in one of the countries PayPal operates in that they just decided to use everywhere to make it easier.

ken 7y ago

When I changed my password there, not too long ago, it was worse. The "change password" page (I later discovered) silently cropped the long random password I pasted, while the "log in" page required the saved (truncated) password exactly. I don't know how they expected anyone to figure that out. I suspect the answer to your question is that what we know as "Paypal.com" is a collection of 57 different legacy systems that were hacked together over a period of 20 years. It's not that a designer sat down one day and spec'd out the design we see. It's more like it used to be much worse, and then they fixed 173 bugs (sometimes is an overly conservative way), and we're seeing the result of that. Unless a software team is very careful, what the users see is software archaeology, not UX design.

Marsymars 7y ago
This is true. For a good example, look at the process if you want to purchase something in a foreign currency on Paypal without Paypal taking an extra ~3.5% cut: https://www.gamedealscanada.com/2018/06/27/changing-paypals-default-currency-conversion-option/ https://www.gamedealscanada.com/2018/06/27/changing-paypals-...
epicalex 7y ago
>When I changed my password there, not too long ago, it was worse. The "change password" page (I later discovered) silently cropped the long random password I pasted, while the "log in" page required the saved (truncated) password exactly. I don't know how they expected anyone to figure that out The British Airways site does exactly the same thing, took me about 5 attempts at resetting my password before I realised what was going on...

slondr 7y ago

My PayPal password is along the lines of thirty-two characters, so this comment confuses me a lot.

Thorrez 7y ago
I just now went to paypal and tried to change my password to something long. It said "Try another password. It must be less than 20 characters."

tikiman163 7y ago

The reason for the limit is actually quite stupid. PayPal does store the hashed version of your password as is required of any user database that is part of a payment processing system. However, because PayPal has been around so long your password is transmitted to the server using a two-way encrytion scheme so that the server side can consistently apply hashing without requiring client side code to do so which makes things much harder and requires more bandwidth to be delivered. Bandwidth concerns finanlly brings us to the reason that paypal limits the password size to 20. PayPal uses an authentication scheme that stores the encrypted password client side and requires it to be resent with every request (or at least used to). Because the password isn't hashed before being transmitted, and is present with every request, they limited the size. All of this was designed and implemented more than 10 years ago and even though both the bandwidth concerns and the need to send the password with every request are both outdated and paypal has likely updated to newer systems that remove these concerns entirely, companies rarely re-examine these kind of hard coded limitations unless they are legally required to.