In password security, the longer the better. With a password manager, using more than 24 characters is simple. Unless, of course, the secure password is not accepted due to its length. (In this case, through STOVE.)
Possibly indicating cleartext storage of a limited field (which is an absolute no-go), or suboptimal or lacking security practices.
At least they tell you. I signed up with websites that just cut the password after the 12th character. No way of signing in with the password again (not without trying a couple of times, at least)
when you varchar(24) and forget about the hash
I like it that the site says the max length…this is not common. I wish it was.
The problem is a password hash is a fixed length regardless of the password, so if this is implemented correctly there is no need for a maximum password length. These things raise my security flag because it makes me think they are storing the password in plain text instead of doing proper practice and storing the hash only.
c/passwordtoostrong
My best experience… They allowed me to set a 100 characters password, but then changed the limits a year later, so that you couldn’t even login anymore.
Used to run into this more. Some legacy systems imposed password limits that seem archaic by modern standards. The authentication system was just supporting systems from before newer standards were created.
I think some of those compatibility layers outlived the systems they needed to be compatible with. The people that knew the system retired ages ago and the documentation was lost 3 or 4 “documentation system” changes ago.
Anyway, those have no place on the modern web.
The password on my PC is something like 30 characters long. Back when win10 was first coming out, they were pushing getting an actual outlook account and tying that to your login. I was hesitant at first, but figured I’d try it out and see how that worked for me.
Turns out outlook accounts (at the time) had something like a 16 character limit on passwords. Bruh.
Your password MUST contain big and small letters, and contain at least 1 number character and 1 spacial character, it MUST be 8 characters long, and it MUST be typed on a German Cherry keyboard between 8-9 PM, using ONLY 1 finger while blindfolded and listening to ABBA music. BUT NO SPACES ALLOWED!!!
This is because of something called entropy we never even read about so we have zero understanding of it. Of course combined with lousy programming, so safety is all on you.Making all these possibilities OPTIONAL would actually make for safer passwords (higher entropy), as would using multiple words separated by spaces. The only meaningful way to accept a password would be to test it against common bad passwords, and test the entropy to determine acceptable levels. There is no good reason a password couldn’t be 10 words and at least 127 characters. There is no way that should stress a properly designed modern system.
you forgot that you can only use a selection of special characters from a pre approved list of 10.
A pre-approved list of 10 which THEY DON’T EVEN TELL YOU WHAT THEY ARE
Had that yesterday.
“Must use special characters!”
“Okay, no problem. Here you go.”
“Not that one! It’s too special!”
“Dude, I haven’t even touched extended ASCII yet.”
genuinely, whats up with not being able to use spaces?
I think it’s originally because of bad programming. It’s so incredibly stupid I don’t have words.
I love when there are so many rules that my first few randomly-generated passwords are rejected.
Even worse, when you can’t figure out why, or how to configure the generator, then end up having to type your own anyway
You have described all of the guidelines that NIST, Microsoft, GCHQ and a few other institutions now recommend for password security.
And yet I still have to have this argument with so-called security engineers and my favourite, compliance officers.
the guidelines that NIST, Microsoft, GCHQ and a few other institutions now recommend for password security
Because they are morons that don’t understand entropy.
Requiring at least 1 number increases entropy less than simply allowing the use of numbers, and then recommending it.
But most password queries are lousy at describing what’s allowed when creating it, and they generally don’t describe it at all when you enter it for access.
The second part can be crucial for remembering exactly how the password was created, because what is now required, used to often not even be possible to use!
I like the ones that just tell you your password strength.
Subtle shaming of bad passwords without giving bad actors hints as to what the minimum (and thus most likely) password is.
Don’t worry, pretty soon they will just block password managers from autofilling fields on their login page so that you HAVE to remember your password! Then you’ll be happy it can’t be that long, you can only fit so much on a post-it note on the side of your monitor
/s
EDIT: I think there should be a law against blocking password managers for filling in fields. Any brute force bots are going to submit HTTP requests directly anyway; no one is hitting the DOM to do that
think there should be a law against blocking password managers for filling in fields.
I’ve never heard of anyone trying to do that. I couldn’t even imagine how a website could detect a password manager.
I’ve had banks do it in the past. It’s not that they can “detect” the password manager, they just use a method that’s incompatible with them.
They have a fake input field and capture keypress events via JavaScript directly from the dom, then just make it look like you typed in to the input field. They don’t read the password from the input field, they build it up in memory from those key press events.
It also completely breaks accessibility software, which is the main reason I think the industry moved away from doing it for the most part.
I’ve seen a couple of times. It’s the same ones that block copy/paste on password fields. The workaround is to write a short python script using pyautogui or similar to “type” out the clipboard content.
Sounds like they’re using bcrypt. Feeding more than 24 utf8 characters into bcrypt won’t do anything useful. You can permit longer passwords (many sites do) but they’d be providing a false sense of security.
Bcrypt is still secure enough and 24 characters are fine as long as they’re randomly generated by your password manager.
The specification of the algorithm specifies up to 56 bytes, including a null terminator. If you’re using UCS-2 (2+ bytes per character, like Windows, Java, Javascript, and more languages and platforms do), that’s 27 characters (can’t use the last half byte character pair). Add some margins for extended characters (emoji and such) and you’ll end up just above or below 24. With UTF-8 you can end up doing much better (exclusively Latin-1) or much worse (exclusively non-Latin character sets). Verifying that on the frontend is a massive pain (string length in JS is unreliable) and dynamically switching codecs is a recipe for bugs and security leaks.
The 72 byte limit is the result of the internal workings of most bcrypt algorithms, but if you ever switch implementations you need to make sure that implementation doesn’t change the internal workings if you rely on details like that. If the stars align you can use 71 characters (72 if you use Pascal strings), but that’s far from a given.
Utf8 isn’t ASCII. It takes up more space.
No, it does not take up more space for ASCII characters.
If you want a source, Wikipedia
the first 128 characters of Unicode, which correspond one-to-one with ASCII, are encoded using a single byte with the same binary value as ASCII
There was a game launcher for a popular game that required a minimum of 8 characters but only used the first 8 characters and it wasn’t case sensitive. So something like PassWord12345!? could be entered when changing the password, but you could sign in with any of the following:
- password1234
- PassWord123499(#$%
- Password12345!?
- passWord12345!
- pASSword12345?!
- PassWord123499(#$%
- password
I haven’t logged in for years so I’m not sure if it is still working that way.
My bank does this 💀
oh. this has been a big pet peeve of mine for awhile. After starting to use password managers I figured I would standardize on the largest required characters only to find a source whos maximum characters were lower than anothers minimum characters.
My mum told be the other day she logged onto a new bank, gave it a 12 character password then couldn’t get back in after. When she got through to their customer services they said that it was an 8 character password limit (!), but it just never said on the register screen.
Microsoft does this to our users at my job. They go to charge their password and it won’t accept it but won’t tell them what the requirements are. “Your password doesn’t meet our criteria.” Okay, so what are you looking for???
Worst is that there seems to be a soft block at some point and instead of telling them that, it shows this dumb error instead over and over again no matter what password they choose.
so secure, no one can get in, even her!
Maybe that’s security by obscurity. Or security by confusion. /s
Yeah, I’d be doing that bank if there’s any choice.
Edit: Leaving (my attention got taken away as I posted)
Either this is some new slang I’m not rizz enough to understand or one of us had a stroke.
No cap
Tain planet, he’s our hero.
He just wants to have sex with the bank.
Ah must be my bank. Same.
There’s a joke in there somewhere.
