Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Limiting passwords to 12 characters is "secure enough"

forums.stardock.com

Post reply on HN
Print view View original

21–30 of 111 posts

Re: Limiting passwords to 12 characters is "secure enough"

#21

Post by engtech »

Sami_Lehtinen wrote: post #12

I blogged about week ago: Some funny stuff for a change: I told my colleagues that we receive at least 5000 "hack attempts" aka failed logins daily to any of our public Internet facing servers. One of my colleagues just said to me: "Well, you're having such a password policy, that maybe those are actually failed login attempts and not hack attempts at all." - It really got me laughing. Yes, passwords, especially long…

Passwords have been compromised before by being captured in server logs that ended up being accessible.

If you are logging failed password attempts anywhere, then you've got a security hole.

Here's the details on the breach I'm talking about http://ieeelog.com/

Re: Limiting passwords to 12 characters is "secure enough"

#22

Post by Cogito »

jimrandomh wrote: post #5

As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain-text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given. But if a site rejects the password t…

> if someone steals passwords out of your database then they already have all the access that my password to your site would've given

I see where you are coming from, however this premise is fatally flawed.

If my password is stored in plain text then an attacker needs only to read just my password and they have access to my account.

If the site is susceptible to SQL injection attacks it is perfectly reasonable that they can extract my password without having access to any other part of the database or system.

Re: Limiting passwords to 12 characters is "secure enough"

#23

Post by Natsu »

rogerbinns wrote: post #17
rorrr wrote: post #11

Technically, if they are using bcrypt hashes with a high enough work factor, and salt then with something like UserID, then 12 characters is pretty damn secure even if their whole DB gets leaked. Of course, there's no good reason to limit passwords to any length.

You are missing the same point they are. A hash doesn't care about the input length and produces a fixed size output. Consequently if Stardock are claiming there is a need for a limited input length then it is a very good "smell" they are not using hashing at all. The lack of hashing is the problem and debating acceptable length limits is avoiding the topic.

I've long used this smell to identify companies not to trust with security. It's rare that I would be willing to create an account somewhere just to buy something, but a policy like this is always a deal-breaker for me, because I would expect them to get hacked.

Re: Limiting passwords to 12 characters is "secure enough"

#24

Post by peeters »

izend wrote: post #14
jimrandomh wrote: post #5

As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain-text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given. But if a site rejects the password t…

Isn't there research out there that proves long sentences and phrases are better than any random alpha numeric password

Well, you obviously have to define "long" and "any" in that sentence. The famous xkcd cartoon evaluates a four word "phrase" (four common random words) as 44 bits of entropy. But he's not comparing it to a random alpha-numeric string, he's comparing it to taking an uncommon word and doing a couple of letter substitutions to defeat complexity requirements.

A real random alpha-numeric password (what I get my password manager to generate, since I don't have to remember it) 12 characters long is more like 70 bits of entropy. You'd need 6 random words to match that. Essentially for every 2 random alphanumeric characters you need another random word.

Re: Limiting passwords to 12 characters is "secure enough"

#25

Post by B0Z »

omni wrote: post #3

Ah, yes, there's nothing quite like a condescending representative entirely out of his depth telling you to "do the maths" to show your customers that you really care about their security and privacy. I wish you good luck in getting them to listen to you.

While the password limit raises some concerns, this ^ is exactly what I took away from the exchange. Brilliant support!

Re: Limiting passwords to 12 characters is "secure enough"

#27

Post by freework »

yarianluis wrote: post #13

This is far from the worst offender. Banks are typically the worst. All sorts of gimmicky password requirements. 8-12 characters. Must have one capital letter. Must have one number. No special symbols. So "I can't believe it's not butter!" won't work, yet that would probably be a pretty secure password, and be entirely rememberable. In fact I could come up with a silly pun-filled sentence for each site I visit and ma…

My favorite is the eAPIS password requirements:

https://eapis.cbp.dhs.gov/help.html#a7

   Your password:

   must start with a number and be between eight and twelve characters in length, and
   must contain at least one of the following special characters:
   Cannot include your Sender ID, and
   Cannot repeat any character consecutively more than two times.

Re: Limiting passwords to 12 characters is "secure enough"

#28

Post by adrr »

peeters wrote: post #20
rorrr wrote: post #11

Technically, if they are using bcrypt hashes with a high enough work factor, and salt then with something like UserID, then 12 characters is pretty damn secure even if their whole DB gets leaked. Of course, there's no good reason to limit passwords to any length.

Again, the point isn't about whether 12 is enough. It could have been 64 and the point would still stand. The OP's point is that limiting password length (to anything less than 1000 or so) is usually done to be able to set a maximum length on the password column of a database. Password hashes, on the other hand (including bcrypt), produce fixed-length hashes, regardless of the input size.

bcrypt has a 50 char limit. You could always prehash(sha256) the password before passing it to bcrypt.

Re: Limiting passwords to 12 characters is "secure enough"

#29

Post by tantalor »

Cogito wrote: post #22
jimrandomh wrote: post #5

As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain-text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given. But if a site rejects the password t…

> if someone steals passwords out of your database then they already have all the access that my password to your site would've given I see where you are coming from, however this premise is fatally flawed. If my password is stored in plain text then an attacker needs only to read just my password and they have access to my account. If the site is susceptible to SQL injection attacks it is perfectly reasonable that t…

Another example is gaining access to an offline backup, archive, etc.

Re: Limiting passwords to 12 characters is "secure enough"

#30

Post by evoxed »

eksith wrote: post #16

Get a whole heap of passwords from random.org. Create a text file with the sites you use with the usernames/passwords. PGP Encrypt the whole ensamble with a good strong password. The only one you really need to remember. Forget your password? Once you reset via email, as soon as you get access to that encrypted file, get a new random password and reset it again. Save the new password in the encrypted file. Password m…

> Forget the password to the encrypted text file? Throw your life away and start a new identity.

Singularity Amnesia?

Post reply on HN