Why your password can’t have symbols—or be longer than 16 characters
1–10 of 75 posts
Re: Why your password can’t have symbols—or be longer than 16 characters
#2 The brokerage and banking company Charles Schwab has strict length limits—
passwords can be no longer than six characters.
Re: Why your password can’t have symbols—or be longer than 16 characters
#3I found this very strange
The permitted characters and length for passwords are defined as a regular
expression in Evernote’s API, but spaces are left out, Evernote says,
because leading and trailing spaces presents a problem. “Software needs to
precisely determine how to treat leading and trailing spaces,” Dave
Engberg, Evernote’s CTO, told Ars. “Some UI frameworks and third-party
applications would unreliably trim spaces, others would not.”
Sounds like the guy writing the regex thought it might be a problem so instead of thinking about it just opted for the safer option.
Why do any kind of a regex validation at all for a password? As long as you are hashing it straight after receiving it the user should be able to send whatever they want.
Re: Why your password can’t have symbols—or be longer than 16 characters
#4The brokerage and banking company Charles Schwab has strict length limits— passwords can be no longer than six characters. I'm a little dubious of this claim as I have several accounts (checking, savings and brokerage) with Charles Schwab and my password is longer than 6 characters. I'd be interested in knowing where they got this information.
If you change the last Length-6 characters and login, does it fail?
Re: Why your password can’t have symbols—or be longer than 16 characters
#5I remember once reading a bank's FAQ trying to explain why passwords couldn't contain SELECT, UPDATE, DROP, or DELETE. I can't find it now so hopefully that little problem has been fixed...
Re: Why your password can’t have symbols—or be longer than 16 characters
#6The brokerage and banking company Charles Schwab has strict length limits— passwords can be no longer than six characters. I'm a little dubious of this claim as I have several accounts (checking, savings and brokerage) with Charles Schwab and my password is longer than 6 characters. I'd be interested in knowing where they got this information.
I have a brokerage account with Schwab and I am using a 10 character password, so I can confirm your skepticism.
Re: Why your password can’t have symbols—or be longer than 16 characters
#7I found this very strange The permitted characters and length for passwords are defined as a regular expression in Evernote’s API, but spaces are left out, Evernote says, because leading and trailing spaces presents a problem. “Software needs to precisely determine how to treat leading and trailing spaces,” Dave Engberg, Evernote’s CTO, told Ars. “Some UI frameworks and third-party applications would unreliably trim…
Additionally.
"Adding support for spaces only in the middle of the password would make the regular expression defining them three times longer, Engberg said."
So they admit they already have the regex definition that would allow this, but for some reason don't want to put it in production? How strange.
Re: Why your password can’t have symbols—or be longer than 16 characters
#8The brokerage and banking company Charles Schwab has strict length limits— passwords can be no longer than six characters. I'm a little dubious of this claim as I have several accounts (checking, savings and brokerage) with Charles Schwab and my password is longer than 6 characters. I'd be interested in knowing where they got this information.
If you change the last Length-6 characters and login, does it fail?
Nope. It silently truncates whatever you give it to 6 characters.
edit: I just tried on my account and it's actually 8 characters, not 6.
Re: Why your password can’t have symbols—or be longer than 16 characters
#9 A third user thought the length limit suggested that the company may then be storing
the password themselves rather than hashing them
Is there any point at all to capping the maximum length? Are sites worried that if the 64-character limit is lifted, 64+ character passwords will become common, leading to a bad user experience?
Re: Why your password can’t have symbols—or be longer than 16 characters
#10The only line of reasoning in the article that seems somewhat convincing to me is Microsoft's point that stronger passwords don't prevent phishing, malware, or compromise via another site (and I'm not sure about the third one -- I guess it's true if the other site is storing passwords in the clear, but if they're hashed, I'd think stronger passwords would be harder to get using rainbow tables). But even if it's true that password strength isn't the weakest link for MS, why not allow for stronger passwords anyway? Is it really a big investment that would require tradeoffs to make that kind of change?
Evernote's reason seems more like an admission of a technical debt than any kind of defense.
AT&T's reason doesn't make sense either -- if users don't like entering certain characters on a mobile phone, they can pick a different password.