What technical reasons are there to have low maximum password lengths? • Hacker News Board

Re: What technical reasons are there to have low maximum password lengths?

#41

Post by raverbashing » Sun, Mar 31, 2013, 8:07 AM UTC

godfreykfc wrote: post #31

manojlds wrote: post #14

My bank limits my password to 8. When I questioned while creating my account, they asked me to visit the login page - in the login page you are asked for the answer of the security question and also presented with 8 input boxes - one for each of of the password characters - but having to enter only randomly selected few from the password ( for preventing key loggers from getting password, of course ). This seemed lik…

Wait. Doesn't that imply your bank is storing your password in plaintext, or at best salted and hashed each individual character of your password? (Which is still horrible, because it now takes O(n) instead of O(n^8) to crack stolen hashes)

Oh they probably are storing it in plaintext

I believe they have some legitimate reasons for doing that (like the example quotes)

Another reason for specifying a length/limits is that you may need to type it using another device (like an ATM) and keeping it apart from other passwords (if you allow everything, you'll just use your gmail password or something)

Now, to be honest, if you break into a bank db, why are you going to bother with passwords?

Re: What technical reasons are there to have low maximum password lengths?

#42

Post by geuis » Sun, Mar 31, 2013, 8:28 AM UTC

Remember that until the early-mid 90s, file names were limited to 8 characters. Lots and lots of enterprise financial software was written in those days, and a lot of it still runs. We're talking about tremendously complicated systems that support trillions of dollars in transactions a day. You don't change level of interleaving complication fast nor easily.

With that said, the rest is just my own guess. Banks are slow moving. They're built on these old systems that run well, but would be prohibitively expensive to rebuild from scratch with modern principals. We see the edges of these systems when it comes to things like passwords.

Re: What technical reasons are there to have low maximum password lengths?

#43

Post by andreasvc » Sun, Mar 31, 2013, 8:39 AM UTC

andreyf wrote: post #38

I could swear learning somewhere that it's because forcing short/simple passwords makes it harder to recognize the password in keystroke logs, which is the attack vector banks face the most. Can't find any sources to back that up, though... has anyone else head this explanation?

I'd expect that the attack vector banks face most is that oblivious users simply give away passwords through phishing schemes. And banks with reasonable security don't rely on passwords (alone), but on some kind of token generator, in which case such a phishing scheme which directly transfers money to the attacker is the only option (any keystrokes captured are useless after x minutes).

Re: What technical reasons are there to have low maximum password lengths?

#44

Post by tjoff » Sun, Mar 31, 2013, 8:42 AM UTC

godfreykfc wrote: post #31

manojlds wrote: post #14

My bank limits my password to 8. When I questioned while creating my account, they asked me to visit the login page - in the login page you are asked for the answer of the security question and also presented with 8 input boxes - one for each of of the password characters - but having to enter only randomly selected few from the password ( for preventing key loggers from getting password, of course ). This seemed lik…

Wait. Doesn't that imply your bank is storing your password in plaintext, or at best salted and hashed each individual character of your password? (Which is still horrible, because it now takes O(n) instead of O(n^8) to crack stolen hashes)

The client, or server, could just concatenate all the chars and then calculate whatever hash you desire of the result. Or?

Yes, if the machine is compromised the attacker could do it as well but the point was to prevent keyloggers specifically.

Re: What technical reasons are there to have low maximum password lengths?

#45

Post by alxndr » Sun, Mar 31, 2013, 8:43 AM UTC

Discover (the credit card company) doesn't allow non alphanumeric characters in their passwords. I harangued them until I got a reason why: that way, they got fewer people bothering customer support with password problems.

(I wonder if they got any other people besides me bothering them because of that rule...)

Re: What technical reasons are there to have low maximum password lengths?

#46

Post by duaneb » Sun, Mar 31, 2013, 8:46 AM UTC

alxndr wrote: post #45

Discover (the credit card company) doesn't allow non alphanumeric characters in their passwords. I harangued them until I got a reason why: that way, they got fewer people bothering customer support with password problems. (I wonder if they got any other people besides me bothering them because of that rule...)

I'm pretty sure this is no longer true. I use my strongest password (techniques) at discover, including symbols.

Re: What technical reasons are there to have low maximum password lengths?

#47

Post by andreasvc » Sun, Mar 31, 2013, 8:48 AM UTC

manojlds wrote: post #14

My bank limits my password to 8. When I questioned while creating my account, they asked me to visit the login page - in the login page you are asked for the answer of the security question and also presented with 8 input boxes - one for each of of the password characters - but having to enter only randomly selected few from the password ( for preventing key loggers from getting password, of course ). This seemed lik…

What kind of security is that? Don't you think an attacker who can install a key logger could also install a screen grabber? This definitely smells like a false sense of security.

Re: What technical reasons are there to have low maximum password lengths?

#48

Post by benjiweber » Sun, Mar 31, 2013, 8:48 AM UTC

cbhl wrote: post #18

manojlds wrote: post #14

My bank limits my password to 8. When I questioned while creating my account, they asked me to visit the login page - in the login page you are asked for the answer of the security question and also presented with 8 input boxes - one for each of of the password characters - but having to enter only randomly selected few from the password ( for preventing key loggers from getting password, of course ). This seemed lik…

May I ask what bank you bank with?

Natwest do exactly this.

They also require two factor authentication for all actual money transactions via a chip-and-pin card reader they ship to all customers. You only authorise one transaction for a specific amount/destination at a time.

Re: What technical reasons are there to have low maximum password lengths?

#49

Post by andreasvc » Sun, Mar 31, 2013, 8:52 AM UTC

mattchamb wrote: post #26

I work for a company that does the banking websites for several major banks (not going to mention any names here). We have a few customers who have quite low password length limits. There isn't any technical reason for this. We provide a configuration option that the bank can set to limit password lengths. So from my experience, the limits have less to do with technical reasons, and are instead arbitrary "business lo…

Why don't you just tell them that for technical reasons, the lowest you "can" limit it to is 12 characters?

Re: What technical reasons are there to have low maximum password lengths?

#50

Post by ema » Sun, Mar 31, 2013, 8:55 AM UTC

derefr wrote: post #40

just2n wrote: post #35

Earlier quoted context omitted.

That's why the client should perform the hash and only submit the result.

No; this is effectively the same as doing no hashing at all. If your database gets stolen, people can replay the "hashed" passwords from it to the server, without having to hash them themselves.

Couldn't you solve that by hashing it again on the sever?