4 ms·
Unfortunately the silent limits of the password fields are very prevalent. I found out the hard way after I'd started to use Keepass to generate and manage my
by Revisor 15y ago
Unfortunately the silent limits of the password fields are very prevalent.
I found out the hard way after I'd started to use Keepass to generate and manage my passwords.
There are even sites that have different limits for the "Change password" and "Enter password" input fields. Eg change accepts up to 30 characters but enter accepts only 20 chars.
Obviously they don't even know why it matters.
I think the developer just silently presumed that no one would enter such long passwords.
The problem is really prevalent.
- pavel_lishin 15y ago> I think the developer just silently presumed that no one would enter such long passwords. But they had to make a specific decision to forbid long passwords; "lazy developer" or "silent assumption" doesn't explain the extra effort.
- Revisor 15y agoI have often seen password fields that are only limited by their attribute. Eg <input type="password" maxlength=20> You're right, if they actively limit the character set and the length, it must have been a conscious decision.
- rapind 15y agoUsually something like this is just a sanity check. 16 characters is definitely a little stingy though, but I'd wager that a very small percentage of their user's ran into this limit (mostly those pre-encrypting locally like I do), so I think we're overblowing the issue a bit. Those character restrictions are just silly and annoying though.
- fmw 15y agoLimits on password length smell like plain text storage. Hashes tend to make the length of the password irrelevant (although some bad implementations only look at the first n characters of the string and ignore the rest), but when you store it in a relational database row you need to come up with some arbitrary limit.
- georgefox 15y agoI believe Active Directory has a maximum length on passwords: http://msdn.microsoft.com/en-us/library/system.web.security.activedirectorymembershipprovider.changepassword.aspx http://msdn.microsoft.com/en-us/library/system.web.security.... (See ArgumentException.)
- safeaim 15y agoHope you're not right, as Paypal only let's you use up to 22 chars if I'm not mistaken
- fmw 15y agoI'm not saying that this is the only reason why people come up with a limit on password length, but that I can imagine that some programmers who come up with such a limit do so because of plaintext storage in a fixed length database row (which is the only quasi-technical excuse for a limit I can up with).
- keeperofdakeys 15y agoMyspace used to not check the length of passwords on signup, but would on changing password. You could log into the website with a long password, but whenever you tried to logon to the IM client (well, pidgin plugin), it would complain. It was a ten character limit I think.