Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why your password can’t have symbols—or be longer than 16 characters

arstechnica.com

Post reply on HN
Print view View original

51–60 of 75 posts

Re: Why your password can’t have symbols—or be longer than 16 characters

#51

Post by troels »

shawabawa3 wrote: post #13
seanalltogether wrote: post #7

Earlier quoted context omitted.

Additionally. "Adding support for spaces only in the middle of the password would make the regular expression defining them three times longer, Engberg said." So they admit they already have the regex definition that would allow this, but for some reason don't want to put it in production? How strange.

but it's 3 times longer! Think of all the ram that would use! They can't even cite performance reasons as hashing passwords should be very cpu intensive anyway

The regexp might be longer to write, but I doubt it would perform worse, once compiled.

Re: Why your password can’t have symbols—or be longer than 16 characters

#52

Post by rogerbinns »

MichaelGG wrote: post #34

I talked to a guy that worked on Windows Live about the 16 char restriction. Microsoft Accounts also do not support Unicode, or anything but a small subset of ASCII characters. First, there must be a maximum size. Obviously, you're not going to allow allow 2^64 byte passwords. So it's under that. But, sure, 16 characters is pretty low. The actual reason seems to be lost to time. The password code was originally writt…

The general reason in Microsoft environments is backwards compatibility. They have had a number of password hashing schemes over time, each getting better. But the password itself isn't sent in the clear over the wire so there is no way to upgrade the user account from one hash to another. The only time it can be done is when the user changes their password, and again that requires the authentication service getting the new password in the clear. Consequently they tend to store all supported hashes at once, and you are limited to the lowest common denominator.

http://en.wikipedia.org/wiki/LM_hash

http://en.wikipedia.org/wiki/NTLM#NTLMv1

http://support.microsoft.com/kb/299656

Re: Why your password can’t have symbols—or be longer than 16 characters

#53

Post by phene »

tikhonj wrote: post #20
jerf wrote: post #14

Earlier quoted context omitted.

"Evernote's reason seems more like an admission of a technical debt than any kind of defense." Our eyebrows are only raising because an article with a strong focus on passwords was written and they saw fit to include this tidbit. In isolation I doubt any of us, including the developers of this particular little thing, sees it as something worth caring about. The point about leading or trailing spaces is definitely tr…

Eh, spaces are nice if you want to have an actual pass phrase .

Because ' ' is the only possible word delimiter...

Re: Why your password can’t have symbols—or be longer than 16 characters

#54

Post by jfb »

MichaelGG wrote: post #34

I talked to a guy that worked on Windows Live about the 16 char restriction. Microsoft Accounts also do not support Unicode, or anything but a small subset of ASCII characters. First, there must be a maximum size. Obviously, you're not going to allow allow 2^64 byte passwords. So it's under that. But, sure, 16 characters is pretty low. The actual reason seems to be lost to time. The password code was originally writt…

Apple truncates passwords longer than 32 characters on Apple ID creation. I find this really annoying, particularly because they don't call this restriction out when you create/change a password.

I think it'd be nice if there were a list of these stupid password rules per domain; that way, 1Password and equivalents could generate maximally strong random passwords per site. Best of all, of course, would be a standard, machine-readable way to communicate this security brain-damage so that it wouldn't have be crowdsourced.

Hmm.

Re: Why your password can’t have symbols—or be longer than 16 characters

#55

Post by mikeash »

wereHamster wrote: post #33
eli wrote: post #29

Earlier quoted context omitted.

> if users don't like entering certain characters on a mobile phone, they can pick a different password Fundamentally, I don't think it's unreasonable to try to protect users from themselves.

Only in america. Because people in other parts of the world actually have a brain.

Thank you for the important reminder that Americans are sub-humans and have a monopoly on the world supply of stupid.

Re: Why your password can’t have symbols—or be longer than 16 characters

#56

Post by slg »

eli wrote: post #29
wwweston wrote: post #10

The only line of reasoning in the article that seems somewhat convincing to me is Microsoft's point that stronger passwords don't prevent phishing, malware, or compromise via another site (and I'm not sure about the third one -- I guess it's true if the other site is storing passwords in the clear, but if they're hashed, I'd think stronger passwords would be harder to get using rainbow tables). But even if it's true…

> if users don't like entering certain characters on a mobile phone, they can pick a different password Fundamentally, I don't think it's unreasonable to try to protect users from themselves.

You do have a valid point. I used to have a password with a backtick (`) in it. That is a standard key on a QWERTY keyboard but seemingly untypeable on an iPhone. I didn't realize that until I actually tried to enter that password on my iPhone.

Re: Why your password can’t have symbols—or be longer than 16 characters

#57

Post by darklajid »

jerf wrote: post #14
wwweston wrote: post #10

The only line of reasoning in the article that seems somewhat convincing to me is Microsoft's point that stronger passwords don't prevent phishing, malware, or compromise via another site (and I'm not sure about the third one -- I guess it's true if the other site is storing passwords in the clear, but if they're hashed, I'd think stronger passwords would be harder to get using rainbow tables). But even if it's true…

"Evernote's reason seems more like an admission of a technical debt than any kind of defense." Our eyebrows are only raising because an article with a strong focus on passwords was written and they saw fit to include this tidbit. In isolation I doubt any of us, including the developers of this particular little thing, sees it as something worth caring about. The point about leading or trailing spaces is definitely tr…

So.. IF I would buy the argument that leading/trailing spaces are evil: How would the expression triple in size by exclusing those?

And more important: Why is that relevant in any way? An article about maximum password length presents a quote that reads like "that's over our maximum regex length".

Certainly no big deal, but I can't help raising my eyebrows at that line of reasoning..

Re: Why your password can’t have symbols—or be longer than 16 characters

#58

Post by illuminate »

jfb wrote: post #32
hamburglar wrote: post #21

Earlier quoted context omitted.

I assume the problem is related to space-handling on HTML form submission. I don't know off-hand how POST handling differs, but for forms submitted by GET, spaces get all screwed up and it wouldn't surprise me if some or all browsers automatically trimmed leading and trailing spaces, and it also wouldn't surprise me if various JS libs took varying approaches to compensating for this weirdness. Re: why you'd have a re…

I've noticed that the quality of Ars' work has been getting worse as they've widened their coverage. Much of it now seems to be either simply regurgitated PR garbage, or the lightest rewrite of PR garbage, with a sprinkling of "some people like cake; others, pie. You decide!" sort of non-journalism on top. It's a shame, because they have had excellent writers in the past.

It's somewhat interesting, I've noticed that around the last 6 months or so, I'm not sure what changed. I first noticed all the tabloidy Xbox rumor-mongering based on "leaks". Ars was the best around, they don't need to emulate the Gawker network, even though those threads surely get more pagehits and comments.

Re: Why your password can’t have symbols—or be longer than 16 characters

#59

Post by illuminate »

wereHamster wrote: post #11

> [...] an AT&T spokesperson [...] told Ars that the company decided not to allow symbols because customers did not like typing them when using mobile phones. That argument does not compute.

It plausibly sounds like something a PM would say.

Re: Why your password can’t have symbols—or be longer than 16 characters

#60

Post by illuminate »

swang wrote: post #17

American Express has (had?) terrible password requirements. I think it has changed but not sure. Who is giving these banks all this terrible advice?

"Who is giving these banks all this terrible advice?"

Focus groups of users, I'm guessing.

Post reply on HN