3 ms·
While on the topic of things to fix: When I was signing up, I hit a 16-character password limit. Now, could anyone explain why you would put a limit of 16 char
by Zirro 14y ago
While on the topic of things to fix: When I was signing up, I hit a 16-character password limit.
Now, could anyone explain why you would put a limit of 16 characters in a password on a modern web-service? Don't the recommendations for a very safe password normally specify more than that?
I see much reason for setting a minimum amount, but not a maximum of less than a hundred characters (to give some room) at least.
- mey 14y agoNoticed this as well, since I use KeePass. Oddly enough there didn't appear to be a restriction the type of characters used.
- Jare 14y agoThis. I just went to try outlook and ran into this with my existing hotmail account, which uses a passphrase and naturally is longer than 16 chars. Horribly disappointed.
- Jare 14y agoEr, wait a second, how is it even possible that they validate my login just typing the first 16 chars of my old (longer) password. Were they clipping passwords to 16 chars before and not telling anyone? That sounds bad, but the alternatives sound much worse.
- fleitz 14y agoProbably so it can reliably store the passwords using lanman hashing.
- renata 14y agoLANMAN v1 limit is 14 characters and is disabled by default on Win 2008 and 7.
- karl_gluck 14y agoI completely agree. It's ridiculous...but that's Microsoft. And I'm not just bashing them here. It seems to be something about how they implement passwords. When I was doing research for Cryptasia, I found that Hotmail/Live was by far the most restrictive of any service out there--and I was examining at hundreds. Only banks (lol) come close.
- thirsteh 14y agoYou should always limit the password length to whatever size at which the underlying storage or scrambling mechanism stops working or loses entropy. Likely, Microsoft uses a shitty hash function to scramble passwords. The common gospel around here is to say "Use bcrypt.", but very few people say (or know?) that its maximum input length is 55 bytes, i.e. 55 ASCII characters, or far fewer unicode characters. Most implementations actually cut off the remainder, which is a very dangerous thing to do since you might have people who use a relatively simple passphrase followed by a strong password which happens to be beyond the maximum length, and is lost. For most other hash algorithms, if you use a hash function with an output size of 256 bits, you will lose entropy if the input contains more than 256 bits of entropy. It is a little hard to measure what the maximum length should be for e.g. passwords, but the length should almost never be unlimited. It conveys a false, and in some cases, e.g. with bcrypt, quite dangerous sense of security.