What technical reasons are there to have low maximum password lengths?
security.stackexchange.com
What technical reasons are there to have low maximum password lengths?
1–10 of 128 posts
Re: What technical reasons are there to have low maximum password lengths?
#2The usual one I've seen is that it's hardcoded into a system in some way that, while changeable, nobody wants to touch for fear of collateral breakage, which is a variant on the "don't touch the ladder" argument given by the first response.
This is usually something like a fixed width database or file field that works with code written a long time ago...
Does it suck? Yes. In nearly all cases, Authentication, Authorization, and Access should be separated in ways where they don't interact/overlap other than at an absolute minimum.
Re: What technical reasons are there to have low maximum password lengths?
#3As mentioned in the link I've seen it mostly due to modern web-apps that have to interact with legacy systems.
Also, I just did some Googling and it wasn't until 2009 that HP/UX supported passwords >8 characters!
Re: What technical reasons are there to have low maximum password lengths?
#4Does Paypal still do this? It said my password was too long when I first set it. I really really hate that.
Re: What technical reasons are there to have low maximum password lengths?
#5I'd say there are three main reasons:
1) Legacy systems not supporting special characters, 2) The desire to keep support overhead down, and use of the system up, by keeping users' passwords actually rememberable. In other words, if you let users make and use paswords they can't remember, they will, and as a result they'll either annoy you about it or stop using the site due to the hassle, and 3) Developers not wanting to have to worry about parsing special characters from untrusted users, which could potentially be dangerous.
In the past the top reason was probably the lack of ability to support the passwords (#1), and today it's probably the lack of desire to support them--mostly from #2, but partially from #3.
Re: What technical reasons are there to have low maximum password lengths?
#6It's amazing how all the comments so far have entirely missed that it's the top answer that was really submitted, not the question.
Re: What technical reasons are there to have low maximum password lengths?
#7In today's world, password length is like zombo.com: The only limit is your imagination.
Re: What technical reasons are there to have low maximum password lengths?
#8There's one reason I haven't seen mentioned yet:
Because the developer is storing passwords in plaintext, and he wants to save database space.
Now, this is not a good reason, but it is a reason nevertheless. Please note that you should never, ever, ever, ever store passwords in plaintext.
Re: What technical reasons are there to have low maximum password lengths?
#9The usual one I've seen is that it's hardcoded into a system in some way that, while changeable, nobody wants to touch for fear of collateral breakage, which is a variant on the "don't touch the ladder" argument given by the first response. This is usually something like a fixed width database or file field that works with code written a long time ago... Does it suck? Yes. In nearly all cases, Authentication, Authori…
The only way "fixed width database field" makes any sense is if they're storing in plaintext, which is stupid all on its own.
Re: What technical reasons are there to have low maximum password lengths?
#10"Because it's hard enought remember 12 characters already"
-my bank's tech support