I used a small regional bank until recently and they had both a small (might be 8, I can't remember) character limit and stored them in plaintext. When I was emailed my current password after having to reset it, I left.
What technical reasons are there to have low maximum password lengths?
61–70 of 128 posts
Re: What technical reasons are there to have low maximum password lengths?
#62My bank limits my password to 8. When I questioned while creating my account, they asked me to visit the login page - in the login page you are asked for the answer of the security question and also presented with 8 input boxes - one for each of of the password characters - but having to enter only randomly selected few from the password ( for preventing key loggers from getting password, of course ). This seemed lik…
May I ask what bank you bank with?
This was HSBC in Canada.
I am not a security expert, and realize that this may not be the right thing, and the implementation might be horrible, but if there is a reason to limit password to 8, this was a good enough reason to do so :)
Re: What technical reasons are there to have low maximum password lengths?
#63My bank limits my password to 8. When I questioned while creating my account, they asked me to visit the login page - in the login page you are asked for the answer of the security question and also presented with 8 input boxes - one for each of of the password characters - but having to enter only randomly selected few from the password ( for preventing key loggers from getting password, of course ). This seemed lik…
What kind of security is that? Don't you think an attacker who can install a key logger could also install a screen grabber? This definitely smells like a false sense of security.
It might be insecure, but not in the way you mention. You only enter 3 or so characters while logging in. Others are hidden. Screen grabber can get only the three characters. Of course, if you login multiple times, the password can be obtained eventually. But this probably for one time login at a public computer.
And yeah, like in many things, these are done to give a false sense of security to the user and some minimal deterrent to the attacker.
Re: What technical reasons are there to have low maximum password lengths?
#64Re: What technical reasons are there to have low maximum password lengths?
#65Earlier quoted context omitted.
Some developers love that kind of micro optimizations. Even smart ones. I've had my varchar(256) columns changed to a more modest varchar(30) because I was "wasting space." Those people dont like being wrong either so there's no point arguing it either and instead concentrate on the bigger issues.
I've seen that, but once the internal format is actually explained, varchar(256) generally survives. For those who don't know, for varchar(1) through varchar(256) the internal database representation in sensible databases is one byte to say how long the varchar is, followed by the actual data. There is therefore absolutely no difference between the representation of varchar(30) and varchar(256) - it is just an arbitr…
I recently discovered its a similar case for numbers in Oracle, which slightly surprised me.
Re: What technical reasons are there to have low maximum password lengths?
#66Earlier quoted context omitted.
No; this is effectively the same as doing no hashing at all. If your database gets stolen, people can replay the "hashed" passwords from it to the server, without having to hash them themselves.
I didn't mean to imply that you'd just store the hash the client comes up with. That's idiotic, of course. Not everyone uses SSL, even though they should, and it's not always secure, and even with the use of SSL, it seems that there would be a potential length attack that could be employed to effectively guess a user's password length. So in all cases, IMO, it makes more sense to be receiving a fixed-length thing tha…
Now you have quite a restricted domain, so if your database is compromised there are a lot fewer values an attacker needs to enumerate to try and crack the password.
Re: What technical reasons are there to have low maximum password lengths?
#67Discover (the credit card company) doesn't allow non alphanumeric characters in their passwords. I harangued them until I got a reason why: that way, they got fewer people bothering customer support with password problems. (I wonder if they got any other people besides me bothering them because of that rule...)
Why can't they just use email password recovery like everyone else?...
Re: What technical reasons are there to have low maximum password lengths?
#68Earlier quoted context omitted.
I've seen that, but once the internal format is actually explained, varchar(256) generally survives. For those who don't know, for varchar(1) through varchar(256) the internal database representation in sensible databases is one byte to say how long the varchar is, followed by the actual data. There is therefore absolutely no difference between the representation of varchar(30) and varchar(256) - it is just an arbitr…
Thanks for the explanation, didn't know that. Is this true in most modern DBs? (I'm thinking MySQL and Postgres particularly).
Close enough in PostgreSQL. String columns larger than 256 actually use 4 bytes to indicate the length, but on the other hand, large strings are automatically compressed, so they may use less space than 4 + length.
http://www.postgresql.org/docs/9.2/static/datatype-character...
Re: What technical reasons are there to have low maximum password lengths?
#69Primo Levi, The Periodic Table, Chromium, tells a similar story of something that was done once for a good reason, but then became 'just what you do'.
Re: What technical reasons are there to have low maximum password lengths?
#70Earlier quoted context omitted.
No; this is effectively the same as doing no hashing at all. If your database gets stolen, people can replay the "hashed" passwords from it to the server, without having to hash them themselves.
I didn't mean to imply that you'd just store the hash the client comes up with. That's idiotic, of course. Not everyone uses SSL, even though they should, and it's not always secure, and even with the use of SSL, it seems that there would be a potential length attack that could be employed to effectively guess a user's password length. So in all cases, IMO, it makes more sense to be receiving a fixed-length thing tha…
If you don't use SSL and the attacker can sniff the stream, chances are he can inject JavaScript to send him the password.
SSL is just indispensable nowadays for authentication.