What technical reasons are there to have low maximum password lengths? • Hacker News Board

Re: What technical reasons are there to have low maximum password lengths?

#101

Post by mistercow » Sun, Mar 31, 2013, 4:40 PM UTC

gweinberg wrote: post #96

mistercow wrote: post #91

I actually emailed my credit union, pleading for them to increase their 10 character limit to something reasonable, and got a response saying that the way their database handles passwords made it impossible. Needless to say, I found that to be even more disconcerting than the existence of the character limit.

Don't worry too much about it. It's vastly more likely that it's actually their change policies that make the increase impossible.

Yes, probably, but it's still scary that whichever technical person they asked thought this would be an OK answer to give someone who is reporting security concerns.

Re: What technical reasons are there to have low maximum password lengths?

#102

Post by michaelwww » Sun, Mar 31, 2013, 4:44 PM UTC

I'm not up on this topic, but I've always wondered why password length is so important if dictionary and other automated attacks aren't allowed. I hope you don't tell me that banks allow millions of password attempts in a short period of time, certainly not from the same ip address and even from what might be a bot net.

Re: What technical reasons are there to have low maximum password lengths?

#103

Post by randomdata » Sun, Mar 31, 2013, 4:54 PM UTC

mistercow wrote: post #91

I actually emailed my credit union, pleading for them to increase their 10 character limit to something reasonable, and got a response saying that the way their database handles passwords made it impossible. Needless to say, I found that to be even more disconcerting than the existence of the character limit.

My credit union enforces similar limits (and only 0-9 are valid characters), but I realized the validation was only enforced in Javascript. I disabled the validation and I was able to use any password I wanted.

Re: What technical reasons are there to have low maximum password lengths?

#104

Post by vidarh » Sun, Mar 31, 2013, 4:56 PM UTC

lucaspiller wrote: post #59

cbhl wrote: post #18

Earlier quoted context omitted.

May I ask what bank you bank with?

All UK financial institutions I have used do this: Nationwide, Barclay's, Natwest (RBS).

Well yes, but not as the only security mechanism, as far as I'm aware.

Barclays for example allows you to log in with this plus a separate pass code, but you can't do much damage without using a chip and pin reader that will give you an 8 digit one time pad too (alternatively they now let you use a mobile app to generate the one time pads)

E.g. you can't do transfers to recipients you haven't specifically saved for future payments, for example, without entering your pin, the account number and amount into your key generator and entering the resulting code into online banking.

Re: What technical reasons are there to have low maximum password lengths?

#105

Post by codesuela » Sun, Mar 31, 2013, 4:59 PM UTC

ema wrote: post #50

derefr wrote: post #40

Earlier quoted context omitted.

No; this is effectively the same as doing no hashing at all. If your database gets stolen, people can replay the "hashed" passwords from it to the server, without having to hash them themselves.

Couldn't you solve that by hashing it again on the sever?

I'm not sure about the added security benefit. Basically the only additional security is if someone gains access to your server they can't capture plain text passwords anymore but once someone gains access all bets are off and they might as well just switch out the Javascript. In any case you should run a strong hashing algorithm like bcrypt with a salt and oh I don't know 1000 iterations? Also last time I tried something like that (which was a few years ago) I ran into big problems with different hashing algorithm implementations providing different results (JS.md5("password") != Python.md5("password")).

Also please correct me if I'm wrong.

Re: What technical reasons are there to have low maximum password lengths?

#106

Post by codesuela » Sun, Mar 31, 2013, 5:07 PM UTC

Wow what a dumb question obviously the OP has very little experience in dealing with real people, probably one of those code monkeys disconnected from the real world. Tune out of World of Warcraft, turn off your Xbox and think for a second: If people could choose long passwords with special characters how could our customer support reps read them back to the users in case they loose it? How could they check them on the phone? Geez and people here are complaining they are valued less than a manager.

Re: What technical reasons are there to have low maximum password lengths?

#107

Post by vidarh » Sun, Mar 31, 2013, 5:07 PM UTC

keithpeter wrote: post #64

lucaspiller wrote: post #59

Earlier quoted context omitted.

All UK financial institutions I have used do this: Nationwide, Barclay's, Natwest (RBS).

Which is one of the reasons I do not use online banking!

I don't know your bank, but in my case (Barclays) as mentioned above, I'd think their tellers or credit card authorization would both be a weaker spot for attacks than their online banking.

They don't allow you only log in with two characters from your password like that, you also need a passcode or a one time pad generated with a chip and pin reader, and for transfers to accounts you haven't previously transferred money to and indicated you want to save for future use, you also need to enter your pin, amount and target account into the reader to get a code to enter into online banking to do the transfer.

Re: What technical reasons are there to have low maximum password lengths?

#108

Post by willlll » Sun, Mar 31, 2013, 5:22 PM UTC

codesuela wrote: post #106

Wow what a dumb question obviously the OP has very little experience in dealing with real people, probably one of those code monkeys disconnected from the real world. Tune out of World of Warcraft, turn off your Xbox and think for a second: If people could choose long passwords with special characters how could our customer support reps read them back to the users in case they loose it? How could they check them on t…

Brilliant

Re: What technical reasons are there to have low maximum password lengths?

#109

Post by quasque » Sun, Mar 31, 2013, 5:23 PM UTC

codesuela wrote: post #105

ema wrote: post #50

Earlier quoted context omitted.

Couldn't you solve that by hashing it again on the sever?

I'm not sure about the added security benefit. Basically the only additional security is if someone gains access to your server they can't capture plain text passwords anymore but once someone gains access all bets are off and they might as well just switch out the Javascript. In any case you should run a strong hashing algorithm like bcrypt with a salt and oh I don't know 1000 iterations? Also last time I tried some…

The added security benefit of server-side hashing is the same as if plain text passwords are sent, to prevent knowledge of the authentication secret if the database contents are disclosed to malicious third parties. The client side hash of the password is only to ensure that a fixed length secret is sent and subsequently processed, to avoid DoS attacks on the server.

Re: What technical reasons are there to have low maximum password lengths?

#110

Post by codesuela » Sun, Mar 31, 2013, 5:26 PM UTC

quasque wrote: post #109

codesuela wrote: post #105

Earlier quoted context omitted.

I'm not sure about the added security benefit. Basically the only additional security is if someone gains access to your server they can't capture plain text passwords anymore but once someone gains access all bets are off and they might as well just switch out the Javascript. In any case you should run a strong hashing algorithm like bcrypt with a salt and oh I don't know 1000 iterations? Also last time I tried some…

The added security benefit of server-side hashing is the same as if plain text passwords are sent, to prevent knowledge of the authentication secret if the database contents are disclosed to malicious third parties. The client side hash of the password is only to ensure that a fixed length secret is sent and subsequently processed, to avoid DoS attacks on the server.

Ah I see, thanks for pointing that out. Haven't thought of it myself.