91–100 of 128 posts
Needless to say, I found that to be even more disconcerting than the existence of the character limit.
For how much people like to repeat the "Use bcrypt!" mantra I'm amazed no one has mentioned the password length limit of bcrypt. The hash output of bcrypt stops changing after 72 characters but almost all bcrypt documentation mentions a 55 character limit. I'm not quite sure what that is about, can anyone clarify?
Earlier quoted context omitted.
I found one of the comments interesting: that the monkey/ladder experiment could be a myth.
It's probably just a thought experiment, a nice allegory. http://skeptics.stackexchange.com/questions/6828/was-the-exp...
That is, if I take a lesson from a story about an experiment that never happened, I'm acting like the hapless chimpanzees that merely learn to fear the ladder. So I must choose to not model other people as cartoon chimpanzees.
It's amazing how all the comments so far have entirely missed that it's the top answer that was really submitted, not the question.
I found one of the comments interesting: that the monkey/ladder experiment could be a myth.
I actually emailed my credit union, pleading for them to increase their 10 character limit to something reasonable, and got a response saying that the way their database handles passwords made it impossible. Needless to say, I found that to be even more disconcerting than the existence of the character limit.
I actually emailed my credit union, pleading for them to increase their 10 character limit to something reasonable, and got a response saying that the way their database handles passwords made it impossible. Needless to say, I found that to be even more disconcerting than the existence of the character limit.
Earlier quoted context omitted.
What kind of security is that? Don't you think an attacker who can install a key logger could also install a screen grabber? This definitely smells like a false sense of security.
It might be insecure, but not in the way you mention. You only enter 3 or so characters while logging in. Others are hidden. Screen grabber can get only the three characters. Of course, if you login multiple times, the password can be obtained eventually. But this probably for one time login at a public computer. And yeah, like in many things, these are done to give a false sense of security to the user and some mini…
Even sniffing just one login gives a completely practical attack to gain access to your account, even though the attacker doesn't have the full password. They might not be able to do everything the full password would let them do, but its still not exactly acceptable.
There's one reason I haven't seen mentioned yet: Because the developer is storing passwords in plaintext, and he wants to save database space. Now, this is not a good reason, but it is a reason nevertheless. Please note that you should never, ever, ever, ever store passwords in plaintext.
Just use ROT13 - same space requirements as in plaintext (I really, really hope people realize that is a joke. Otherwise this might be the worst piece of advice I have ever given on the internet)
I actually emailed my credit union, pleading for them to increase their 10 character limit to something reasonable, and got a response saying that the way their database handles passwords made it impossible. Needless to say, I found that to be even more disconcerting than the existence of the character limit.
CHAR(8)
There's one reason I haven't seen mentioned yet: Because the developer is storing passwords in plaintext, and he wants to save database space. Now, this is not a good reason, but it is a reason nevertheless. Please note that you should never, ever, ever, ever store passwords in plaintext.
Because the developer is storing passwords in plaintext, and he wants to save database space. This seem far fetched, not sure what thought process would lead anyone to come to this conclusion. Even if you have a million users, you have ~8MB worth of passwords. I'd imagine even developers who are not competent in cryptography realise that.