Last week, I tried to register for a service and was really surprised by a password limit of 16 characters. Why on earth yould you impose such strict limits? Never heard of correct horse battery staple?
Last week, I tried to register for a service and was really surprised by a password limit of 16 characters. Why on earth yould you impose such strict limits? Never heard of correct horse battery staple?
This is my biggest pet peeve. Password policies are largely mired in inaccurate conventional wisdom, even though we have good guidance docs from NIST on this.
Frustrating poor policy configs aside, this max length is a huge red flag, basically they are admitting that they store your password in plan text and aren’t hashing like they should be.
If a company tells you your password has a maximum length, they are untrustable with anything important.
Oh I had the same thought. Whoever limits password length probably has many other shitty security practices.
Lemmy-UI has a password limit of 60 characters. Does that make it untrustworthy?
OWASP recommendation is to allow 64 chars at least:
The lemmy-UI limit is reasonably close and as everything is open source, we can verifiy that it does hash the password before storing it in the database.
There is a github issue, too.
It being open source helps because we can confirm it’s not being mishandled, but it’s generally arbitrary to enforce password max lengths beyond avoiding malicious bandwidth or compute usage in extreme cases.
I would add if they require a short “maximum length.” There’s no reason to allow someone to use the entirety of Moby Dick as their password, so a reasonable limit can be set. That’s not 16 characters, but you probably don’t need to accept more than 1024 anyway.
Why not? You’re hashing it anyways, right?
Right?!
Sure but if my password is the entire lord of the rings trilogy as a string, hashing that would consume some resources
I think there are other problems before that 😂
Of course, but if you’re paying for network and processing costs you might as well cap it at something secure and reasonable. No sense in leaving that unbounded when there’s no benefit over a lengthy cap and there are potentially drawbacks from someone seeing if they can use the entirety of Wikipedia as their password.
You can also hash it on the client-side, then the server-side network and processing costs are fixed because every password will be transmitted using same number of bytes
You still need to deal with that on the server. The client you build and provide could just truncate the input, but end users can pick their clients so the problem still remains.
The server can just reject any password hash it receives which isn’t exactly hash-sized.
That would take care of it, you do nead to salt & hash it again server side ofc.
Bcrypt and scrypt functionally truncate it to 72 chars.
There’s bandwidth and ram reasons to put some kind of upper limit. 1024 is already kinda silly.
I wonder if a lot of it is someone using their personal experience and saying “just a little bigger ought to cover it”
When I used my own passwords, I rarely used more than 12 characters, so that should be enough
All the password generators I’ve used default to about 24 chars, so 30 ought to be enough for anyone
OWASP recommends allowing at least 64 characters. That would cover all of my passphrases, including the ones that are entire sentences
The number of government websites that I’ve encountered with this “limitation.” Even more frustrating when it’s not described upfront in the parameters or just results in an uncaught error that reloads the page with no error message.
Or accepts and silently truncates it 🤬
bcrypt has a maximum password length of 56 to 72 bytes and while it’s not today’s preferred algo for new stuff, it’s still completely fine and widely used.
Wait, really? I always thought bcrypt was just a general-purpose hash algorithm, never realized that it had an upper data size limit like that.
also, if they think a strong password is only about types of characters. a dozen words from as many languages and 5+alphabets is just as good!
its to the point I don’t bother remembering my passwords anymore, because this bullshit makes user-memorable-hard-to-machine-guess passwords impossible.
I am now very concerned about a certain medical implant device company
True!