Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why your password can’t have symbols—or be longer than 16 characters

arstechnica.com

Post reply on HN
Print view View original

41–50 of 75 posts

Re: Why your password can’t have symbols—or be longer than 16 characters

#41

Post by porker »

tikhonj wrote: post #20
jerf wrote: post #14

Earlier quoted context omitted.

"Evernote's reason seems more like an admission of a technical debt than any kind of defense." Our eyebrows are only raising because an article with a strong focus on passwords was written and they saw fit to include this tidbit. In isolation I doubt any of us, including the developers of this particular little thing, sees it as something worth caring about. The point about leading or trailing spaces is definitely tr…

Eh, spaces are nice if you want to have an actual pass phrase .

Exactly!

Re: Why your password can’t have symbols—or be longer than 16 characters

#42

Post by rhizome »

bascule wrote: post #30

Umm, great reporting Ars. Schwab actually has a limit of 8 characters, not 6: http://www.schwab.com/public/schwab/nn/legal_compliance/schw... Still crappy and their password policy is terrible, but it's better than what Ars is reporting.

It's a distinction with a microscopically negligible difference.

Re: Why your password can’t have symbols—or be longer than 16 characters

#43

Post by shawabawa3 »

r00fus wrote: post #28
shawabawa3 wrote: post #23

Earlier quoted context omitted.

Well to be fair, there really is zero point from a security point of view in having a password longer than 64 characters. If someone does enter more than 64 they almost certainly have made a mistake (a copy-paste screw up for example). And you do need some kind of limit to prevent people using gigabyte sized passwords.

Most people using 50+ character passwords or phrases often use password management software like 1Password, Keepass, or browser-based, etc. I do think an upper limit is valid, as allowing an arbitrary long string could be a form of DOS (imagine someone sending the library of congress as a password), but 64 characters seems kind of weak.

> password management software like 1Password, Keepass, or browser-based, etc.

AFAIK all these programs allow generation of > but 64 characters seems kind of weak.

A 64 character alpha-numeric password has 36^64 combinations. That's 2^330. You're trillions of times more likely to find a hash collision than brute force the password (assuming 256bit hashes).

Security-wise there is absolutely 0 difference between allowing >64 character passwords and not. From a user experience perspective I'm sure arguments could be made either way

Re: Why your password can’t have symbols—or be longer than 16 characters

#44

Post by rflrob »

“Criminals attempt to victimize our customers in various ways and we’ve found the vast majority of attacks are through […] and the reuse of passwords on third-party sites—none of which are helped by very long passwords.”

I'd actually disagree with this assertion. If I can just prefix my insecure password (let's say "password123") with "Microsoft", it becomes both more secure, essentially distinct from the password on other sites, and easy for me to remember. If the limit is just 16 chars, then I can't do that.

Re: Why your password can’t have symbols—or be longer than 16 characters

#45

Post by harshreality »

samegreatsleeve wrote: post #22
Evbn wrote: post #16

Earlier quoted context omitted.

Hashing passwords intentionally slow for security. The solution to a DOS like this is to ignored all password attempts after N per M time.

That's like saying to get someone to stop punching you, just punch yourself. DOSing yourself to stop a DOS :/

Nope, what typically happens is the account gets locked out and requires a confirmation sent to the account's email address to unlock it.

Re: Why your password can’t have symbols—or be longer than 16 characters

#47

Post by incision »

A recent favorite example of example of terrible password requirements, VMWare VDP. The appliance requires exactly 9 characters, no more, no less.

Personally, I'm most aggravated by services with uneven complexity requirements. It seems pretty often that I run into situations where special characters are required but underscores are forbidden, things of that sort.

Re: Why your password can’t have symbols—or be longer than 16 characters

#48

Post by Terretta »

bascule wrote: post #30

Umm, great reporting Ars. Schwab actually has a limit of 8 characters, not 6: http://www.schwab.com/public/schwab/nn/legal_compliance/schw... Still crappy and their password policy is terrible, but it's better than what Ars is reporting.

At the time of my reading and comment, the Ars text says a minimum of 6 and maximum of 8.

Re: Why your password can’t have symbols—or be longer than 16 characters

#49

Post by coldtea »

tikhonj wrote: post #20
jerf wrote: post #14

Earlier quoted context omitted.

"Evernote's reason seems more like an admission of a technical debt than any kind of defense." Our eyebrows are only raising because an article with a strong focus on passwords was written and they saw fit to include this tidbit. In isolation I doubt any of us, including the developers of this particular little thing, sees it as something worth caring about. The point about leading or trailing spaces is definitely tr…

Eh, spaces are nice if you want to have an actual pass phrase .

Passphrases are lame.

You use the "passphrase" thing in a system that silently ignores the extra characters (see below for "brokerage and banking company Charles Schwab" which does just that), and "wonderful undefeated password ftw" becomes "wonderful" (trivially cracked with a dictionary attack). Pwned.

Or you get your way, and, as a naive user, use a common passphrase, included in more involved attacks. Like "rage against the machine", "let me in", "my secret password", "empire strikes back", etc. Pwned.

Or you end up with 30 passphrases in 30 different systems. Or, since a lot of them don't allow long password, you end with a mix with passphrases and short passwords.

Might as well have used a password management app with cryptic generated passwords all along.

Re: Why your password can’t have symbols—or be longer than 16 characters

#50

Post by rcxdude »

samegreatsleeve wrote: post #22
Evbn wrote: post #16

Earlier quoted context omitted.

Hashing passwords intentionally slow for security. The solution to a DOS like this is to ignored all password attempts after N per M time.

That's like saying to get someone to stop punching you, just punch yourself. DOSing yourself to stop a DOS :/

how so? cutting off an IP after many failed passwords is good security anyway. Only side affect may be if someone's machine is infected and taking part in the attack they get locked out while it goes on.
Post reply on HN