Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why your password can’t have symbols—or be longer than 16 characters

arstechnica.com

Post reply on HN
Print view View original

31–40 of 75 posts

Re: Why your password can’t have symbols—or be longer than 16 characters

#31

Post by ChrisClark »

mcherm wrote: post #6
themckman wrote: post #2

The brokerage and banking company Charles Schwab has strict length limits— passwords can be no longer than six characters. I'm a little dubious of this claim as I have several accounts (checking, savings and brokerage) with Charles Schwab and my password is longer than 6 characters. I'd be interested in knowing where they got this information.

I have a brokerage account with Schwab and I am using a 10 character password, so I can confirm your skepticism.

Try logging in with just the first 6 characters of your password and see if it's really looking at all 10 of them.

Edit: Someone else commented saying it might actually be the first 8, so try that too if you want.

Re: Why your password can’t have symbols—or be longer than 16 characters

#32

Post by jfb »

hamburglar wrote: post #21
shawabawa3 wrote: post #3

I found this very strange The permitted characters and length for passwords are defined as a regular expression in Evernote’s API, but spaces are left out, Evernote says, because leading and trailing spaces presents a problem. “Software needs to precisely determine how to treat leading and trailing spaces,” Dave Engberg, Evernote’s CTO, told Ars. “Some UI frameworks and third-party applications would unreliably trim…

I assume the problem is related to space-handling on HTML form submission. I don't know off-hand how POST handling differs, but for forms submitted by GET, spaces get all screwed up and it wouldn't surprise me if some or all browsers automatically trimmed leading and trailing spaces, and it also wouldn't surprise me if various JS libs took varying approaches to compensating for this weirdness. Re: why you'd have a re…

I've noticed that the quality of Ars' work has been getting worse as they've widened their coverage. Much of it now seems to be either simply regurgitated PR garbage, or the lightest rewrite of PR garbage, with a sprinkling of "some people like cake; others, pie. You decide!" sort of non-journalism on top. It's a shame, because they have had excellent writers in the past.

Re: Why your password can’t have symbols—or be longer than 16 characters

#33

Post by wereHamster »

eli wrote: post #29
wwweston wrote: post #10

The only line of reasoning in the article that seems somewhat convincing to me is Microsoft's point that stronger passwords don't prevent phishing, malware, or compromise via another site (and I'm not sure about the third one -- I guess it's true if the other site is storing passwords in the clear, but if they're hashed, I'd think stronger passwords would be harder to get using rainbow tables). But even if it's true…

> if users don't like entering certain characters on a mobile phone, they can pick a different password Fundamentally, I don't think it's unreasonable to try to protect users from themselves.

Only in america. Because people in other parts of the world actually have a brain.

Re: Why your password can’t have symbols—or be longer than 16 characters

#34

Post by MichaelGG »

I talked to a guy that worked on Windows Live about the 16 char restriction. Microsoft Accounts also do not support Unicode, or anything but a small subset of ASCII characters.

First, there must be a maximum size. Obviously, you're not going to allow allow 2^64 byte passwords. So it's under that. But, sure, 16 characters is pretty low.

The actual reason seems to be lost to time. The password code was originally written well over a decade ago, when things were less security focused. For all we know, some part of the auth pipeline (even if the passwords are stored hashed) might have sent the user data in a space or comma delimited, using 8-bit chars without UTF-8 support.

He explained that every time they've reviewed it, the password restrictions haven't been close to the top of things they can spend their time on to improve user safety.

I've run into other companies that limit symbols, citing problems with users on mobile devices messing up and generating support tickets. That sounds reasonable for lower-security assets.

Evernote's space explanation sounds really silly. Why not just include stripping spaces as part of the password "hash" function? That's gotta be easier than using Regex.

I remember reading a story about Facebook, where they flipped-case hashes as well, again to help the user login experience.

Re: Why your password can’t have symbols—or be longer than 16 characters

#35

Post by ktsmith »

mcherm wrote: post #6
themckman wrote: post #2

The brokerage and banking company Charles Schwab has strict length limits— passwords can be no longer than six characters. I'm a little dubious of this claim as I have several accounts (checking, savings and brokerage) with Charles Schwab and my password is longer than 6 characters. I'd be interested in knowing where they got this information.

I have a brokerage account with Schwab and I am using a 10 character password, so I can confirm your skepticism.

Is it actually using all 10 characters? Can you log in with 6 characters of your password, or 8 as zrail indicated?

Re: Why your password can’t have symbols—or be longer than 16 characters

#36

Post by MichaelGG »

jfb wrote: post #26
jerf wrote: post #14

Earlier quoted context omitted.

"Evernote's reason seems more like an admission of a technical debt than any kind of defense." Our eyebrows are only raising because an article with a strong focus on passwords was written and they saw fit to include this tidbit. In isolation I doubt any of us, including the developers of this particular little thing, sees it as something worth caring about. The point about leading or trailing spaces is definitely tr…

There's no technical reason for this. It's all about reducing their support burden. I wish they'd just be honest.

Sounds like lack of technical thinking if it actually reduces support burden. It's trivial to just remove spaces before storing the password, allowing authentication with or without spaces. I'm not sure why people don't realise that normalizing the password before saving the hash is acceptable, so long there's still enough password material being used.

Re: Why your password can’t have symbols—or be longer than 16 characters

#37

Post by slg »

themckman wrote: post #2

The brokerage and banking company Charles Schwab has strict length limits— passwords can be no longer than six characters. I'm a little dubious of this claim as I have several accounts (checking, savings and brokerage) with Charles Schwab and my password is longer than 6 characters. I'd be interested in knowing where they got this information.

They truncate your password (at 8 character not 6). Which makes things even worse in my mind. You might feel secure with a password like "Password329#*3j3f930#(4j49", but Schwab will simply validate against the "Password" portion without even letting you know the obvious security repercussions.

Re: Why your password can’t have symbols—or be longer than 16 characters

#38

Post by john_b »

eli wrote: post #29
wwweston wrote: post #10

The only line of reasoning in the article that seems somewhat convincing to me is Microsoft's point that stronger passwords don't prevent phishing, malware, or compromise via another site (and I'm not sure about the third one -- I guess it's true if the other site is storing passwords in the clear, but if they're hashed, I'd think stronger passwords would be harder to get using rainbow tables). But even if it's true…

> if users don't like entering certain characters on a mobile phone, they can pick a different password Fundamentally, I don't think it's unreasonable to try to protect users from themselves.

I'm not sure if you meant this is sarcasm, but I read this quote as being more appropriate for an Onion-type article than for a serious discussion about security.

Re: Why your password can’t have symbols—or be longer than 16 characters

#40

Post by ocean12 »

columbo wrote: post #25

I would bet 99% of this is legacy support. Someone in built an entire system over assuming the password is CHAR(6). Unfortunately these fixes aren't always as easy as updating the column and introducing salt/hash. The system could be sending the password in plaintext to multiple sub-systems, it could be used for VOIP services, it could even be used by CSRs to manually update settings on behalf of a user, even better,…

Ars Technica has been doing a lot of excellent work recently.
Post reply on HN