6 ms·
> I don't think is necessarily the case Back then, when they enforced a maximum 16 character password, I saw enough security. Are they storing them in plaintex
by darumderum 5y ago
> I don't think is necessarily the case
Back then, when they enforced a maximum 16 character password, I saw enough security. Are they storing them in plaintext or what? Btw, I think they increased the limit to 32 now
- kenniskrag 5y agosome hashing algorithm don't allow longer passwords. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#:~:text=bcrypt%20has%20a%20maximum%20length,be%20enforced%20when%20using%20bcrypt https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor....
- darumderum 5y agoWell, 72 bytes is still far away from 16 characters. Also, nearly every website is able to allow passwords longer than 16 chars, so it is definitely possible somehow!? This limit is ridiculous
- kenniskrag 5y agoalso in unicode? (4 byte * 19 chars)
- darumderum 5y agoNo, but they don't support it anyways
- TomSwirly 5y ago1. Unicode has no idea of "bytes" at all. 2. Only in the UTF-32 encoding, which no one uses, are all characters represented by 4 bytes. Most sites today use UTF-8 where most characters on a standard keyboard are 1 byte, and almost all characters from any language take 3 bytes. 3. Even 19 characters is a lot better than 12.
- deleted 5y ago[deleted]
- thih9 5y agoIs this is a good reason to reject long passwords? If that kind of hashing algorithm is a must, why not use first X bytes of the password input?
- jfrunyon 5y agoBecause then people find out that it ignores a bunch of your password and people's "password12DHpS*yoCTV44cAmg$gJj" is matched by "password123". Or "correct horse battery staple i have the most brilliant password ever" is matched by "correct horse battery staple".
- mikestew 5y agoIn other words, a modern version of Microsoft LAN Manager: https://en.wikipedia.org/wiki/LM_hash https://en.wikipedia.org/wiki/LM_hash Save-ya-a-click: basically what jfrunyon describes, along with a whole lot of other insecurity goodness (and to be fair, LANMan was a long time ago).
- thih9 5y agoGood point, that was too simplistic. Then again, I guess longer passwords could be preprocessed with another hashing function, one that returns a string of X bytes? My point is that throwing a "password too long" error, especially for 32 characters or less, feels like a wrong approach to me; no matter the circumstances or the amount of backward compatibility that has to be kept.
- kenniskrag 5y agoI understand your point but then password shucking can be problematic: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...
- thih9 5y agoWhat do you mean by problematic? The source links to YT and I can’t view a YT link. I assume “problematic” here means “difficult but possible”. If problems arise then I guess it’s a matter of priorities; but I think that not inconveniencing the user with password length limits should be high priority.