4 ms·
The worst is when they accept your long password only to truncate it silently so the password doesn't work when you use it to login.
by runamok 4y ago
The worst is when they accept your long password only to truncate it silently so the password doesn't work when you use it to login.
- gibolt 4y agoI've had a site let me sign up with a 128 char password, but the input on the sign-in page was capped at 30. Edited the form element to log in, pinged them about the issue, and got it fixed
- shortcake27 4y agoThis is why I default to 16 alphanumerical chars. This is more than strong enough for random internet accounts but has less risk of truncation and easier to type if the need arises. Only if the account is super important will I bump up the entropy.
- Semaphor 4y agoIt’s far more often that I need mixed casing, or special characters. Length limits happen maybe 1 out of 10 times, not enough for me to change my defaults.
- fomine3 4y agotype=password + maxlength = disaster
- emsixteen 4y agoForgive my ignorance as I've never set up anything like this, but how do you then deal with the potential for extremely long passwords? Can that be detrimental on the back end?
- hnbad 4y agoIt's reasonable to put measures in place so users can't transmit excessively large amounts of data where they are not expected, login forms being one example. But there is a lot of wiggle room between maxlength=8 and allowing people to upload the source code of DOOM as their password.
- nibbleshifter 4y agoYou don't store the password. You store a cryptographic hash of the password, which will always be a fixed length. This makes the actual password length irrelevant to back end storage.
- nzach 4y agoPassword length isn't a problem because you never store the actual password in the database. What you do is use a hashing function[0] in the provided password and you store this result in the database. And these hashes tend to have a fixed size output. So it doesn't matter if your original password had 10 or 200 characters, the resulting hash will have the same size. [0] - https://www.authgear.com/post/password-hashing-salting https://www.authgear.com/post/password-hashing-salting
- pprotas 4y agoI know this is anecdotal, but this has never happened to me in my life. Is this a common problem? Which sites do this?
- alias_neo 4y agoHappened to me half a dozen times or so over the years. It's also happened where sites have updated their password policy, e.g. to set an upper length limit after I signed up and now I can't login because it won't let me enter my longer password.
- zeeZ 4y agoLast time I saw this was the Sophos XG web interface some time ago. User changed their password and couldn't sign in, turned out it got truncated somewhere.
- hnbad 4y agoI've had this happen to me with PayPal a few years ago. I think they simply truncated the input though, but didn't enforce a maximum length during signup.
- LoganDark 4y agoEven worse when it does work to login, but you're logged out on the next navigation because the login cookie does not support passwords longer than 16 chars (don't ask me how this is possible)
- WirelessGigabit 4y agoBank of America comes to mind...