Limiting passwords to 12 characters is "secure enough"
forums.stardock.com
Limiting passwords to 12 characters is "secure enough"
1–10 of 111 posts
Re: Limiting passwords to 12 characters is "secure enough"
#2Bill Cheswick, of the "Firewalls and Internet Security; Repelling the Wily Hacker" fame, gives a great talk called "Rethinking Passwords" calling for a better solution:
http://www.youtube.com/watch?v=KRVRlhrLKkI [video, 22 min] http://web.cheswick.com/ches/talks/rethink.pdf [slides]
Re: Limiting passwords to 12 characters is "secure enough"
#3Ah, yes, there's nothing quite like a condescending representative entirely out of his depth telling you to "do the maths" to show your customers that you really care about their security and privacy. I wish you good luck in getting them to listen to you.
Re: Limiting passwords to 12 characters is "secure enough"
#4In theory it is secure enough - you should not be allowing a password attempt every second on an account and unlimited attempts per day per account.
But of course we should be using pass-sentences by now.
Re: Limiting passwords to 12 characters is "secure enough"
#5As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain-text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given.
But if a site rejects the password that my password manager generated (16 chars [a-zA-Z0-9]), then I have to work around it, make a password manually, and it's generally a pain in the ass that shouldn't be necessary. And since I'm doing it right and these sites doing it wrong, I'm not inclined to be forgiving.
Re: Limiting passwords to 12 characters is "secure enough"
#6As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain-text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given. But if a site rejects the password t…
The worst thing is when password boxes have paste protection so site-specific randomly generated passwords become a pain to use. A few sites have started doing it recently, it's nonsensical.
Re: Limiting passwords to 12 characters is "secure enough"
#7In theory it is secure enough - you should not be allowing a password attempt every second on an account and unlimited attempts per day per account. But of course we should be using pass-sentences by now.
> I'm not concerned that someone is going to brute-force my password
Please read the article before commenting. The OP's concern is that all of the passwords are sitting in plaintext in a questionably-secure database somewhere.
Re: Limiting passwords to 12 characters is "secure enough"
#8In theory it is secure enough - you should not be allowing a password attempt every second on an account and unlimited attempts per day per account. But of course we should be using pass-sentences by now.
> I'm not concerned that someone is going to brute-force my password Please read the article before commenting. The OP's concern is that all of the passwords are sitting in plaintext in a questionably-secure database somewhere.
I stand corrected, there is absolutely no excuse for plaintext passwords.
Re: Limiting passwords to 12 characters is "secure enough"
#9As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain-text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given. But if a site rejects the password t…
The worst thing is when password boxes have paste protection so site-specific randomly generated passwords become a pain to use. A few sites have started doing it recently, it's nonsensical.
Thankfully good browser password manager extensions (I use 1Password) ignore all of this nonsense.
Re: Limiting passwords to 12 characters is "secure enough"
#10Even if they were brute-forcing, a new GPU cluster can do 350 billion guesses per second. http://arstechnica.com/security/2012/12/25-gpu-cluster-crack... That means an average of 78 days to crack an individual password, even with no heuristics about which passwords are more likely.