9 ms·
What technical reasons are there to have low maximum password lengths?
- zdw 14y agoThe usual one I've seen is that it's hardcoded into a system in some way that, while changeable, nobody wants to touch for fear of collateral breakage, which is a variant on the "don't touch the ladder" argument given by the first response. This is usually something like a fixed width database or file field that works with code written a long time ago... Does it suck? Yes. In nearly all cases, Authentication, Authorization, and Access should be separated in ways where they don't interact/overlap other than at an absolute minimum.
- drivebyacct2 14y agoThe only way "fixed width database field" makes any sense is if they're storing in plaintext, which is stupid all on its own.
- cpeterso 14y agoWouldn't a password hash, possibly truncated, fit into a "fixed width database field"?
- drivebyacct2 14y agoWhy would you truncate it? My point was simply thus: if one is hashing a password... every password will be the same length (strlen(sha1("a")))==(strlen(sha1("somereallybigstring"))). Thus, the column would be the right size for the hash always and would be completely unrelated to the user's inputted password. Not sure I interpreted your message correctly, but either way, the DB field should be unrelated to the length or limit of length put on the user password. It should only be correlated to the length of the hash produced. (Truncating seems like it would narrow the space for collisions, those bits are there in the hash for a reason).
- anon987 14y agoAs mentioned in the link I've seen it mostly due to modern web-apps that have to interact with legacy systems. Also, I just did some Googling and it wasn't until 2009 that HP/UX supported passwords >8 characters!
- lovehashbrowns 14y agoDoes Paypal still do this? It said my password was too long when I first set it. I really really hate that.
- danielrm26 14y agoI'd say there are three main reasons: 1) Legacy systems not supporting special characters, 2) The desire to keep support overhead down, and use of the system up, by keeping users' passwords actually rememberable. In other words, if you let users make and use paswords they can't remember, they will, and as a result they'll either annoy you about it or stop using the site due to the hassle, and 3) Developers not wanting to have to worry about parsing special characters from untrusted users, which could potentially be dangerous. In the past the top reason was probably the lack of ability to support the passwords (#1), and today it's probably the lack of desire to support them--mostly from #2, but partially from #3.
- ianterrell 14y agoIt's amazing how all the comments so far have entirely missed that it's the top answer that was really submitted, not the question.
- harkenthus 14y agoI think it may be a problem with the link itself. In the past I've seen SO links that auto scroll to the answer of interest, however this one just loaded to the top of the page.
- Bill_Dimm 14y agoSubmitter should have used the "share" link that appears at the bottom of the answer, although that scrolls the question off the top of the page, which may also cause confusion.
- niggler 14y ago"The Internet is full of chimpanzees." I am reminded of Egor Homakov and his various exploits, especially in the Rails community. Someone points out a problem and the community collectively decided to ignore him.
- iaw 14y agoI loved the analogy, it's sad that more people didn't read it.
- deleted 14y ago[deleted]
- zheng 14y agoIt doesn't look like it still does, as the link is to ".../questions/33470/..."
- vinhboy 14y agolol, check out his other works: http://security.stackexchange.com/questions/9487/how-can-paypal-spoof-emails-so-easily-to-say-it-comes-from-someone-else/9498#9498 http://security.stackexchange.com/questions/9487/how-can-pay...
- ChikkaChiChi 14y agoIn today's world, password length is like zombo.com: The only limit is your imagination.
- fruchtose 14y agoThere's one reason I haven't seen mentioned yet: Because the developer is storing passwords in plaintext, and he wants to save database space. Now, this is not a good reason, but it is a reason nevertheless. Please note that you should never, ever, ever, ever store passwords in plaintext.
- obiterdictum 14y agoBecause the developer is storing passwords in plaintext, and he wants to save database space. This seem far fetched, not sure what thought process would lead anyone to come to this conclusion. Even if you have a million users, you have ~8MB worth of passwords. I'd imagine even developers who are not competent in cryptography realise that.
- bjourne 14y agoSome developers love that kind of micro optimizations. Even smart ones. I've had my varchar(256) columns changed to a more modest varchar(30) because I was "wasting space." Those people dont like being wrong either so there's no point arguing it either and instead concentrate on the bigger issues.
- btilly 14y agoI've seen that, but once the internal format is actually explained, varchar(256) generally survives. For those who don't know, for varchar(1) through varchar(256) the internal database representation in sensible databases is one byte to say how long the varchar is, followed by the actual data. There is therefore absolutely no difference between the representation of varchar(30) and varchar(256) - it is just an arbitrary restriction on what data is allowed to fit in there. But databases that support varchar(257) need 2 bytes in front for it.
- edanm 14y agoThanks for the explanation, didn't know that. Is this true in most modern DBs? (I'm thinking MySQL and Postgres particularly).
- tlrobinson 14y ago"Because it's hard enought remember 12 characters already" -my bank's tech support
- sliverstorm 14y agoThis could be translated to, "Because we estimate the added costs of supporting users will increase by X due to more users forgetting their password due to length"
- logn 14y agoIt's more complex than that. Banks are also liable for security breaches, not consumers. Additionally, banks invest in a variety of security mechanisms that ordinary companies, even major ones, do not invest in. Passwords are only one part of their overall security. I think all of this outrage over banks having poor password practices, while sometimes valid, is made by people not fully informed. It's like complaining that the bank vault has weak points that could be attacked. That's not all that's keeping your money secured.
- INTPenis 14y agoTypically bank tech support have no idea about the inner workings of their website. My bank uses 2 stage auth to login which works really well. However, they have a sort of shortcut service where you can activate and pick a password and then use that password to do quick stuff online or in their mobile app. The quick stuff still let's you transfer away all your money to someone else so it's basically a gaping hole. That password has the wildest restrictions I've seen. It allows only a-zA-Z0-9 and it must consist of exactly 6 characters. No restriction on containing at least one digit or anything like that. I've e-mailed them several times about this but their response is that this particular service has been out sourced to one of the many companies they out source things to, so they have no control at all over it. And it's rather funny because you can tell that when you use this service, you're taken to a completely different server farm than the rest of the internet site. Fucking scary is what I call it.
- 14y ago
- saadazzz 14y agoBefore you comment, read the top answer!
- manojlds 14y agoMy bank limits my password to 8. When I questioned while creating my account, they asked me to visit the login page - in the login page you are asked for the answer of the security question and also presented with 8 input boxes - one for each of of the password characters - but having to enter only randomly selected few from the password ( for preventing key loggers from getting password, of course ). This seemed like a valid technical reason to limit passwords to 8.
- cbhl 14y agoMay I ask what bank you bank with?
- benjiweber 14y agoNatwest do exactly this. They also require two factor authentication for all actual money transactions via a chip-and-pin card reader they ship to all customers. You only authorise one transaction for a specific amount/destination at a time.
- lucaspiller 14y agoAll UK financial institutions I have used do this: Nationwide, Barclay's, Natwest (RBS).
- keithpeter 14y agoWhich is one of the reasons I do not use online banking!
- vidarh 14y agoI don't know your bank, but in my case (Barclays) as mentioned above, I'd think their tellers or credit card authorization would both be a weaker spot for attacks than their online banking. They don't allow you only log in with two characters from your password like that, you also need a passcode or a one time pad generated with a chip and pin reader, and for transfers to accounts you haven't previously transferred money to and indicated you want to save for future use, you also need to enter your pin, amount and target account into the reader to get a code to enter into online banking to do the transfer.
- mattchamb 14y agoI work for a company that does the banking websites for several major banks (not going to mention any names here). We have a few customers who have quite low password length limits. There isn't any technical reason for this. We provide a configuration option that the bank can set to limit password lengths. So from my experience, the limits have less to do with technical reasons, and are instead arbitrary "business logic" limits.
- andreasvc 14y agoWhy don't you just tell them that for technical reasons, the lowest you "can" limit it to is 12 characters?
- mattchamb 14y agoI'm just not part of any of those discussions. Besides, the code around passwords and their configuration has barely changed in the last decade; and the people who wrote it are now the ones discussing security with the banks.
- Qantourisc 14y agoI.m.o incompetence. If not I'd love the "guilty" ones to explain this annoying ting once and forever.
- andreyf 14y agoI could swear learning somewhere that it's because forcing short/simple passwords makes it harder to recognize the password in keystroke logs, which is the attack vector banks face the most. Can't find any sources to back that up, though... has anyone else head this explanation?
- andreasvc 14y agoI'd expect that the attack vector banks face most is that oblivious users simply give away passwords through phishing schemes. And banks with reasonable security don't rely on passwords (alone), but on some kind of token generator, in which case such a phishing scheme which directly transfers money to the attacker is the only option (any keystrokes captured are useless after x minutes).
- geuis 14y agoRemember that until the early-mid 90s, file names were limited to 8 characters. Lots and lots of enterprise financial software was written in those days, and a lot of it still runs. We're talking about tremendously complicated systems that support trillions of dollars in transactions a day. You don't change level of interleaving complication fast nor easily. With that said, the rest is just my own guess. Banks are slow moving. They're built on these old systems that run well, but would be prohibitively expensive to rebuild from scratch with modern principals. We see the edges of these systems when it comes to things like passwords.
- lucaspiller 14y agoI believe that is true for a lot of cases. People seem to overlook this, but I'd guess that is the reason for a lot of cases. 90s though? I think you need to go further back a couple of decades. Royal Bank of Scotland still has COBOL/IMS powering their core system [0]. [0] http://ovum.com/2012/06/27/rbss-core-system-meltdown-assessing-the-implications/ http://ovum.com/2012/06/27/rbss-core-system-meltdown-assessi...
- alxndr 14y agoDiscover (the credit card company) doesn't allow non alphanumeric characters in their passwords. I harangued them until I got a reason why: that way, they got fewer people bothering customer support with password problems. (I wonder if they got any other people besides me bothering them because of that rule...)
- rbirkby 14y agoWhy does a site limit password lengths at all? Because at some point, some other limit will be exceeded. For example, HTTP POST size or even working-set size. But the question is specifically about low maximum password lengths. This boils down to hashing vs encrypting. Hashing (with or without salt) will produce a fixed-length output. The size of storage for this hash output is pre-determined. For example a varchar(20) for SHA1. For encryption, you have to take the plaintext bytes and produce a ciphertext of a maximum number of bytes to store. Now we have both a limit on the number of input characters, but also on which characters are permissible. Let's say a site allows the Euro symbol, passes that UTF8 byte stream through an encryption algorithm, base64 encodes the result and stores it in a varchar field. The trouble is that the Euro symbol is composed of a 4-byte multi-byte UTF8 sequence - F0 A4 AD A2. If a password system didn't take account of this, they could easily overflow the storage limit and potentially expose internal details via an error message to the user. The simple answer is just to hash+salt and then to limit the input length to some large value to prevent blowing HTTP POST or process vm limits.
- mayneack 14y agoI used a small regional bank until recently and they had both a small (might be 8, I can't remember) character limit and stored them in plaintext. When I was emailed my current password after having to reset it, I left.
- keithpeter 14y agoPrimo Levi, The Periodic Table, Chromium, tells a similar story of something that was done once for a good reason, but then became 'just what you do'.
- dsego 14y agoWhy does paypal limit the password to 20 characters?
- drostie 14y agoI vaguely also remember typing a password into Paypal and it said, "hey! no spaces are allowed!" and I definitely lost a significant chunk of confidence in their process.
- luma 14y agoWhenever you see a password field that is limited to 8 characters you'll often also see a notice that the minimum value is 6 characters. Why? IBM. CICS[1] had this specific restriction on password length until the 4.2 release in 2011[2]. CICS is hugely popular in the banking industry, which is why you'll see this kind of thing most often with banks. [1]http://en.wikipedia.org/wiki/CICS http://en.wikipedia.org/wiki/CICS [2] http://pic.dhe.ibm.com/infocenter/cicsts/v4r2/index.jsp?topic=%2Fcom.ibm.cics.ts.whatsnew.doc%2Fpassphrase%2Fdfhe4_overview.html http://pic.dhe.ibm.com/infocenter/cicsts/v4r2/index.jsp?topi...
- NateDad 14y agoI don't really get the "legacy" systems bit. Are you passing around the person's password to every back end server? Why? Just auth once and pass around the user id. You should trust your internal systems, not require each system to reauth. Security around the perimeter, once you're in, you're in. Though to be fair, when's the last time you heard about a bank's password database getting stolen?
- csomar 14y agohttp://skeptics.stackexchange.com/questions/6828/was-the-experiment-with-five-monkeys-a-ladder-a-banana-and-a-water-spray-condu http://skeptics.stackexchange.com/questions/6828/was-the-exp... Funny that the experiment was mentioned many times in different occasions, and it's not clear if it was ever conducted. Still Bears around the Internet believed it and just kept repeating it in every opportunity ;)
- throwaway125 14y agoFor how much people like to repeat the "Use bcrypt!" mantra I'm amazed no one has mentioned the password length limit of bcrypt. The hash output of bcrypt stops changing after 72 characters but almost all bcrypt documentation mentions a 55 character limit. I'm not quite sure what that is about, can anyone clarify?
- shanelja 14y agoI'm unsure of why it is but I don't see why the algorithm can't just handle it like this: check string length if longer than 55, remove first 55 or less characters up to end of string, store in array repeat until string is empty encrypt each item in the array, append them all on to each other as such EncryptedText[0] . EncryptedText[1]... etc Seems like a simple way to handle this. You could impose your own restrictions to stop a server DDoS by encryption requests on long strings, but to be honest if you're allowing a 100,000 character password, you're doing it all wrong.
- mistercow 14y agoThat is potentially problematic, but it's far from the atrocity that is a bank website limiting you to a 10 character password.
- thurn 14y agoBrute-forcing a 55-character password is a transcomputational problem (http://en.wikipedia.org/wiki/Transcomputational_problem http://en.wikipedia.org/wiki/Transcomputational_problem), i.e., it's impossible to accomplish using a computer the size of the earth within the expected lifetime of the earth. So I wouldn't worry too much about it.
- throwaway125 14y agoTo clarify I never meant that the limit is a security issue, just that it's a valid technical limitation to limit the length of a password.
- mistercow 14y agoI actually emailed my credit union, pleading for them to increase their 10 character limit to something reasonable, and got a response saying that the way their database handles passwords made it impossible. Needless to say, I found that to be even more disconcerting than the existence of the character limit.
- qiemem 14y agoCHAR(8)
- mistercow 14y agoWorse yet, it seems to imply that they aren't hashing, which is simply preposterous for a financial institution.
- codesuela 14y agoMany banks require you to use numbers only for your pin a smart engineer probably figured that cracking 10 char numerical "passwords" is trivial so hashing would be a waste of resources and hence energy and emissions. It is greener that way.
- gweinberg 14y agoDon't worry too much about it. It's vastly more likely that it's actually their change policies that make the increase impossible.
- mistercow 14y agoYes, probably, but it's still scary that whichever technical person they asked thought this would be an OK answer to give someone who is reporting security concerns.
- randomdata 14y agoMy credit union enforces similar limits (and only 0-9 are valid characters), but I realized the validation was only enforced in Javascript. I disabled the validation and I was able to use any password I wanted.
- michaelwww 14y agoI'm not up on this topic, but I've always wondered why password length is so important if dictionary and other automated attacks aren't allowed. I hope you don't tell me that banks allow millions of password attempts in a short period of time, certainly not from the same ip address and even from what might be a bot net.
- ufmace 14y agoThe usual concern is the database storing the passwords/hashes being stolen. This has happened to dozens of small to medium size web services. The attacker could then hash away at the passwords to his heart's content. Then end-goal of this is to get user/pass combos to be tried on other, higher-value sites, like email services and, uh, banks. Which gets us to the strange part. Who hacks a bank's service to steal a password DB in hopes of using the passwords against some other target? I'm thinking nobody. If you managed to compromise a bank's web service to that extent, you'd be trying to transfer all of the money from all of the user's accounts to one you control, not trying to crack their passwords. That means that your bank's password storage method and complexity is not very important. What is important is that, whatever password you use, you never use that password on any other site. And that you use a bank that requires real 2-factor authentication, via text or mobile app or something like that, not with "security questions".
- kc0bfv 14y agoIf the passwords are stored somewhere that's easier to access than your real target at the bank, then cracking the passwords might be helpful... I totally agree with your recommendations, but bank password storage/complexity definitely could be important. If an attacker got hold of a large number of bank account user logins, I'm not sure what they'd do. My bank doesn't provide a feature to quickly transfer cash from the website... Several hundred large billpay changes would show up and be easy to cancel... Perhaps they'd just gather personal info useful to a social engineering attack...
- deleted 14y ago[deleted]
- codesuela 14y agoWow what a dumb question obviously the OP has very little experience in dealing with real people, probably one of those code monkeys disconnected from the real world. Tune out of World of Warcraft, turn off your Xbox and think for a second: If people could choose long passwords with special characters how could our customer support reps read them back to the users in case they loose it? How could they check them on the phone? Geez and people here are complaining they are valued less than a manager.