Password length requirement
Password length requirement
Last week, I tried to register for a service and was really surprised by a password limit of 16 characters. Why on earth yould you impose such strict limits? Never heard of correct horse battery staple?
This is my biggest pet peeve. Password policies are largely mired in inaccurate conventional wisdom, even though we have good guidance docs from NIST on this.
Frustrating poor policy configs aside, this max length is a huge red flag, basically they are admitting that they store your password in plan text and aren’t hashing like they should be.
If a company tells you your password has a maximum length, they are untrustable with anything important.
Oh I had the same thought. Whoever limits password length probably has many other shitty security practices.
If a company tells you your password has a maximum length, they are untrustable with anything important.
Lemmy-UI has a password limit of 60 characters. Does that make it untrustworthy?
OWASP recommendation is to allow 64 chars at least:
Maximum password length should be at least 64 characters to allow passphrases (NIST SP800-63B). Note that certain implementations of hashing algorithms may cause long password denial of service.
The lemmy-UI limit is reasonably close and as everything is open source, we can verifiy that it does hash the password before storing it in the database.
There is a github issue, too.
It being open source helps because we can confirm it’s not being mishandled, but it’s generally arbitrary to enforce password max lengths beyond avoiding malicious bandwidth or compute usage in extreme cases.
If a company tells you your password has a maximumn length, they are untrustable with anything important.
I would add if they require a short "maximum length." There's no reason to allow someone to use the entirety of Moby Dick as their password, so a reasonable limit can be set. That's not 16 characters, but you probably don't need to accept more than 1024 anyway.
you probably don't need to accept more than 1024 anyway.
OWASP recommends allowing at least 64 characters. That would cover all of my passphrases, including the ones that are entire sentences
I wonder if a lot of it is someone using their personal experience and saying “just a little bigger ought to cover it”
When I used my own passwords, I rarely used more than 12 characters, so that should be enough
All the password generators I’ve used default to about 24 chars, so 30 ought to be enough for anyone
The number of government websites that I’ve encountered with this “limitation.” Even more frustrating when it’s not described upfront in the parameters or just results in an uncaught error that reloads the page with no error message.
Or accepts and silently truncates it 🤬
bcrypt has a maximum password length of 56 to 72 bytes and while it's not today's preferred algo for new stuff, it's still completely fine and widely used.
Wait, really? I always thought bcrypt was just a general-purpose hash algorithm, never realized that it had an upper data size limit like that.
also, if they think a strong password is only about types of characters. a dozen words from as many languages and 5+alphabets is just as good!
its to the point I don't bother remembering my passwords anymore, because this bullshit makes user-memorable-hard-to-machine-guess passwords impossible.
I am now very concerned about a certain medical implant device company
True!
"If a company tells you your password has a maximum length..."
Uhhh no. Not at all. What so ever. Period. Many have a limit for technical reasons because hashing passwords expands their character count greatly. Many websites store their passwords in specific database columns that themselves have a limit that the hashing algorithm quickly expands passwords out to.
If you plan your DB schema with a column limit in mind for fast processing, some limits produce effectively shorter password limits than you might expect. EVERYONE has column limits at least to prevent attacks via huge passwords, so a limit on a password can be a good sign they're doing things correctly and aren't going to be DDOS'd via login calls that can easily crush CPUs of nonspecialized servers.
It doesn't matter the input size, it hashes down to the same length. It does increase the CPU time, but not the storage space. If the hashing is done on the client side (pre-transmission), then the server has no extra cost.
For example, the hash of a Linux ISO isn't 10 pages long. If you SHA-256 something, it always results in 256 bits of output.
On the other hand, base 64-ing something does get longer as the input grows.
Just in case someone runs across this and doesn't notice the downvotes, the parent post is full of inaccuracies and bad assumptions. Don't base anything on it.
I had to make an account the other day with the absolute worst password requirements I've ever seen:
Do you know the password game?
The digits in your password must add up to 25.
Yeah but the stakes are higher in Jersey you can get fined or even jail for messing up that password.
When I was working on a password system a few years ago, I found some amazingly bad password requirements. One that stuck with me was it couldn't contain any two digit years (e.g. 08).
I'll also leave this here: https://dumbpasswordrules.com/sites-list/
That sounds like a rule from The Password Game
Ugh, I'm unfortunately even more bothered by the random extra spaces at the start of the first and last requirements than I am by the security horror.
I am now even more relieved that the NJ courts have removed me permanently from jury duty, so my chances of interacting with that entire nonsense has gone down. A bit. Just a bit down.
Now I just must try to not be taken to court or take one to court.
This is where hiding inside might help.
The worst is when it either won't tell you what the character limit is so you have to just keep lowering it and retrying until it finally works, or when the infrastructure for signing up has a different character limit than the infrastructure for logging in, so you can sign up with a long password but can't actually sign in with it. I once encountered a website that had this issue for both the password AND username so I had to change my password and then contact support to change my username. Absurd.
I used to manage a system that had a longer character limit on the creation than in the sign in. To fix it, they just let you type in more characters when you signed in but only validated the first 8 anyway. 🤦♂️
Honestly at that point, it's not worth using the service to me if I have to contact support just to sign in.
I used a service that had password validation on the “current password” field when you update your password. My password had stopped being valid due to a change in their password policy, but I couldn’t fix it because the “update password” form kept saying my current password was invalid. I know — you told me to change it!!!!
I have had this before, I was so confused for a while.
Made account used my password manager, so I knew the password was correct, went around the loop a few times of "forgot password"; finally shortened form 25 to 16 characters and it just worked.
I know a bank with a 12 character max, no symbols password restriction.
Ridiculous
Mine does not allow spaces. They used to use a 4 digit pin as 2FA. Not a new pin you got every time you logged in, the same 4 digit pin.
A lot of bank computing is a complete clusterf@#k. Getting even basic changes and bug fixes requires it being signed off on by various regulators and committees. Apparently, 18 months for a 1 line change is normal. This has ended up with layers of new work being frankensteined onto older systems. E.g. Internet banking, for a long time, physically printed checks, via an automated machine, posted them, and then had them read in, via an automated machine. Hence why Internet bank transfers took 2-3 days.
I had issues with my banks truncating my password a while back. It only looked at the first 8 characters.
One of my past banks used to be case-insensitive. They aren't anymore (as far as I know). Their name starts with Key and ends with Bank.
My bank got busted a few years ago for cheating customers using their coin-counting machines. Literally nickel-and-dimed their own customers. They removed the machines and just threw loose cloth over the empty spaces - an ongoing testament to their shame, if they could feel shame, which they can't. Out of sheer laziness I'm still with them.
Sheesh
Its even better when they don't tell you that your password is too long, and they truncate it somewhere unknown.
Tried a randomgen 32 character password at the local sheriff's office. Copy and pasted it directly out of my password manager into the password creation field so I know I didn't typo it and when I tried to login it wouldn't work. Took me a bit of troubleshooting to figure out what happened.
Oh that's evil.
Ive seen an account creation or password reset that let's you do any length password, but the actual login page has a character limit.
About 10 years ago this happened to me at chase.com. IIRC they truncated at 30 characters at the time.
That happens all the fucking time, and it's infuriating. Most recent example was with Kagi, which I eventually found out had a max of 72, truncated, no warning. I bitched out their support and they were like 'nbd, and it should have warned you' and I'm like 'nope, no warning at all' which means they didn't bother checking if a warning actually showed or prevented the input, just 'I wrote it so we must be good'.
They claim to have fixed this, but ugh. Took me a half an hour, and I started with the suspicion that it was being truncated. Test your shit if you're going to be stupid, people.
Bcrypt and scrypt have a limit of 72 chars, so it's probably that. Implementations can work around it by putting the password through a pre-hash, but most don't bother. There are tons of reasonably secure password storage systems with that limit.
A prominent Australian bank has these requirements:
For Internet Banking, your password must be six to eight characters long.
To improve security, it should:
contain both numbers and letters.
include upper and lower-case letters (your password is case sensitive).8 character max means they're running it on a mainframe I think, though I don't know enough about mainframes to know if this is a normal level of bad or really bad
8??? For banking? I haven’t used less than like 16 in at least 5, maybe 10 years. Jeez.
worst i've seen is 8 characters. precisely 8 characters, no more no less........ it was for a bank ....
A major US bank that I used to use has case insensitive passwords, found that out one day when I noticed caps lock was on after logging in with no trouble
Early 2000s internet banking was a trip.
i think this was about a year ago when they changed it....
I had to make a 10 character password for Santander
The fact that it was a power of 2 makes me suspect lazy coding. That bank didn't pay its programmers well enough.
Banks don't have much money for paying people, methinks. They're famously poor practically non-profits.
maybe they store the entire password as a u64 and bitmask out each character
Ha. I had the same thing, with a government-run student loan website
I got this from a bank. A BANK. Not only was it limited to 12 characters. THEY ALSO LIMITED THE SPECIAL CHARACTER SET.
I complained and was told, oh that's why we have the security number for (a unchanging six digit code), and I'm like, that's basically 1 password with 18 character limit and 6 of the characters are definitely numbers.
Not only that, 2FA is not available for logon, it just says "to authenticate certain types of Internet and Mobile Banking transactions".
I couldn't believe it. Surprise, surprise, there are no minimum password security regulations in Australia...
"correct horse battery staple" is for your password manager password. The regular passwords for services should be random character gibberish.
Edit: to be clear, though, I'm not excusing their failure to allow >16 characters of gibberish.
Obligatory link https://imgs.xkcd.com/comics/password_strength.png
ADD FIELD PASSWORD VARCHAR(16)SELECT * FROM users WHERE name = "$name" OR password = "$password"sqlquery = "INSERT INTO users (username, password) VALUES ('" + username + "', '" + password + "')"What could go wrong?
Eons ago, I got an account for using a software on an IBM mainframe. Keep in mind that the machine used masks with fixed-width text fields on the terminal (TN3270, IIRC), even for the login mask. Being security cautious, the first thing I did after login was to change my password. The "change password" mask allowed for passwords of up to 12 characters, which I used freely. I logged out, got back to the login mask - which only allowed for an eight character password...
No need to escape, if the table name for
; drop table ... --doesn't fit 😉
Tell me about it. USAA has a password policy of "between 8 and 12 characters."
Like, that's not even secure under old understandings of secure. A max of 12 should be, like, an actual offense with sanctions attached if they get hacked at some point. Especially for a financial institution. Ridiculous.
Definitely used a one-off password for that one...
Wow that’s true, what a crock.
USAA strikes me as the most Wonder bread Texas Aw Shucks company that smiles to your face while outsourcing as much as possible (and stabbing you in the back in the process). Case in point. USAA only allows TOTP through Symantec’s proprietary app. I’m moving everything away from them except for auto insurance (which will likely go away at some point too as they’re not really that valuable for that anymore either).
I have to change my USAA password every few months because I forget about the 12 character restriction...
12charactersis 12 characters long
Huh? I have had a USAA account for many years and my current password is far beyond 12 characters. I use both the website and the app...
Weird. I had to make up a new one cause all my normal passwords were too long.
Several people on here have had the same issue it seems, and Google agrees thats their limit is 12.
Not sure how you got around it. Maybe you're using a USAA reseller or something? You sure that your password's more than 12 characters?
My current employer has the dumbest restrictions for passwords to our core system. It is a large regional bank. Our core system must have a password that is either 7 or 8 characters long (nothing shorter or longer). It cannot have any vowels or special characters. It cannot have any capital letters. It cannot have two numbers in a row.
Ah yes, the password rules from 1980.
By any chance wanna share your approximate location, asking for a friend
I used to have to use a government-run website that required passwords to be exactly 8 characters
How about a bank app that requires 6 numbers password (not the app PIN, but the user account's password).
A lot of older systems I worked on had password requirement of exactly 7 characters, no special characters, no numbers and no upper case. Must have been interesting times in security when those systems were made.
Ran into this when I chose a password for my new work e-mail. As my employer is Chinese, error messages show up in mandarin, so it took me a while to understand what the problem was: Must be between 9 and 16 characters long.
How to properly set password requirements on your website. Accept any utf8 string. Have a nice day.
The answer is always a poorly coded database. :(
What? The password should only receive the hashed password, and that's gonna have a fixed length. What's stored in the db should have the exact same length whether the password is 2 characters long or 300. If the length of the password is in any way a consideration for your database, you've royally fucked up long before you got to that point.
"Your password may not contain any quotes or backslashes"
The answer is always a poorly coded everything.
You are expecting a lot from someone who thinks a password needs a low maximum length. It makes sense to limit password length to avoid dos attacks, but certainly to something longer than 16.
There are going to be very few hashing algorithms that can take a certain byte value and hash it down into a unique smaller byte value. If you miscoded the database and stored the hashed passwords into a value of a fixed length, you have to abide by that length without some trickery or cleaveriness. Is that not the case? Every time I've seen this limitation in wild code that has been the case.
This one time I got this catch22 situation with a service.. Turned out password reset in the Android app accepted 32 characters but in the browser less.
Happened to me a couple days ago when resetting a password for Paypal. The browser limit was 20 characters for the 2nd password box but had a higher limit for the first password box.
Though, it appears they recently modified the form to pop up with an "Enter a shorter password" message. With that being said, PayPal has apparently always had shitty password policies.
My favorite was "Your password must begin with a letter"
"Otherwise our database may misinterpret it as a number when we store it in pain text"
pain text
Accidentally accurate
Here is a screenshot from the page where my meme came from. But it it not the only company out there with ridiculous password policies.
Paypal has (had?) absurdly short limits
And (at least at the time of my account creation) don't even tell you about it. I found out by the errormessage in the networklog of the REST requests why my signup failed repeately.
Has. 20 char max.
Drives me nuts when this happens.
Dammit, I just spent 5 minutes rolling dice and flipping through a binder. One of us takes this shit seriously.
