3 ms·
Any site which has low upper bounds for password lengths is not to be trusted.
by Tloewald 14y ago
Any site which has low upper bounds for password lengths is not to be trusted.
- 16s 14y agoCertainly, I agree, but half the web is still that way. Many banking sites even.
- cheald 14y agoI think it's a bit hyperbolic to call it half the web. Only a small handful of sites cap password lengths. They might happen to be sites you use, but it's not nearly as common a practice as you seem to think.
- DanBC 14y agoAre they actually using all that password length, or are they just allowing people to enter long passwords and truncating them?
- carey 14y agoI've used a system at work that truncates passwords when setting them, but not when checking them. It doesn't fill me with confidence.
- natrius 14y agoI don't think you're correct. Anyone who's storing a password in plaintext is probably going to use a fixed-width field to do so. I'd bet half the internet stores plaintext passwords. A lot of the web is one-off e-commerce systems that no one should trust anything with.
- darkarmani 14y agoMy bank caps at 12 chars -- silently. I couldn't login until i only typed the first 12 chars.
- jlgreco 14y agoThe problem is that sites can truncated your password without telling you. Hard to make the call not to use a site if you don't know it is doing that.