Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Limiting passwords to 12 characters is "secure enough"

forums.stardock.com

Post reply on HN
Print view View original

41–50 of 111 posts

Re: Limiting passwords to 12 characters is "secure enough"

#41

Post by akg_67 »

Reading comments in this thread have been very enlightening. I am wondering if there is a best practices or guidelines for password storage for web service operators.

I currently manage a web service that has about 1,000 registered users. I have taken the most restrictive path to storing password in database except I need to make sure user/password database is portable from one host to another. Reading the comments, I am getting the impression that such portability may not be a good thing. But then how can I migrate from one host to another or restore backups?

Are there documented good practices for storing passwords in database that also allow portability.

Re: Limiting passwords to 12 characters is "secure enough"

#42

Post by jmspring »

akg_67 wrote: post #41

Reading comments in this thread have been very enlightening. I am wondering if there is a best practices or guidelines for password storage for web service operators. I currently manage a web service that has about 1,000 registered users. I have taken the most restrictive path to storing password in database except I need to make sure user/password database is portable from one host to another. Reading the comments,…

Simple rules for the bare minimum

- never store plain text password - never store direct hash of password - use a salt (must be stored) and hash password and salt

Ideally salt and hash of password/salt are in different databases.

Avoiding MD5 is recommended, but if you are at the point of worrying about that, you have bigger issues.

Re: Limiting passwords to 12 characters is "secure enough"

#43

Post by DrJosiah »

izend wrote: post #14
jimrandomh wrote: post #5

As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain-text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given. But if a site rejects the password t…

Isn't there research out there that proves long sentences and phrases are better than any random alpha numeric password

No. And preliminary research suggests that they are easier to crack.

http://arstechnica.com/security/2013/01/grammar-badness-make...

Legitimately randomly generated passwords still win, as long as the server uses a salt with bcrypt or iterated hashing like PBKDF1 or PBKDF2.

Re: Limiting passwords to 12 characters is "secure enough"

#44

Post by tlrobinson »

akg_67 wrote: post #41

Reading comments in this thread have been very enlightening. I am wondering if there is a best practices or guidelines for password storage for web service operators. I currently manage a web service that has about 1,000 registered users. I have taken the most restrictive path to storing password in database except I need to make sure user/password database is portable from one host to another. Reading the comments,…

Here's one http://codahale.com/how-to-safely-store-a-password/

I'm not sure what portability issue you're referring to.

Re: Limiting passwords to 12 characters is "secure enough"

#45

Post by UnoriginalGuy »

jmspring wrote: post #42
akg_67 wrote: post #41

Reading comments in this thread have been very enlightening. I am wondering if there is a best practices or guidelines for password storage for web service operators. I currently manage a web service that has about 1,000 registered users. I have taken the most restrictive path to storing password in database except I need to make sure user/password database is portable from one host to another. Reading the comments,…

Simple rules for the bare minimum - never store plain text password - never store direct hash of password - use a salt (must be stored) and hash password and salt Ideally salt and hash of password/salt are in different databases. Avoiding MD5 is recommended, but if you are at the point of worrying about that, you have bigger issues.

I agree with everything you said except the "store in two different databases" line. If someone has compromised your system responsible for handling authentication then presumably they'd have access to both databases regardless - unless you've designed some kind of complex API for generating the salt and secured that API behind a whole different set of security and authentication (which almost everyone is too lazy to do).

The salt is just there to stop rainbow tables being generated, and if you're really evil to add computational overhead, it isn't meant to be used in a game of hide and seek.

Re: Limiting passwords to 12 characters is "secure enough"

#46

Post by danielbarla »

omni wrote: post #3

Ah, yes, there's nothing quite like a condescending representative entirely out of his depth telling you to "do the maths" to show your customers that you really care about their security and privacy. I wish you good luck in getting them to listen to you.

That entire thread was cringe-worthy. At least the last company I reported something similar to came back with "our developers are looking into the problem, and we will probably switch out the login scheme in the next few weeks". Whether they actually did it or not, who knows, but at least they acknowledged it.

Re: Limiting passwords to 12 characters is "secure enough"

#47

Post by UnoriginalGuy »

tlrobinson wrote: post #26

When I complained to my bank about their 12 character limit they told me... "12 characters is already hard enough to remember." Sigh.

I would have just responded - "You know 'Lord of the rings' the movie, right? The title of that movie is a 17 character password. Is that hard to remember?"

Re: Limiting passwords to 12 characters is "secure enough"

#48

Post by kijin »

UnoriginalGuy wrote: post #47
tlrobinson wrote: post #26

When I complained to my bank about their 12 character limit they told me... "12 characters is already hard enough to remember." Sigh.

I would have just responded - "You know 'Lord of the rings' the movie, right? The title of that movie is a 17 character password. Is that hard to remember?"

It is kinda hard to remember if you need to pepper it with numbers and special characters to comply with the bank's rules.

    L0rd_ofthe$Ring5

Re: Limiting passwords to 12 characters is "secure enough"

#50

Post by DanBC »

izend wrote: post #14
jimrandomh wrote: post #5

As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain-text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given. But if a site rejects the password t…

Isn't there research out there that proves long sentences and phrases are better than any random alpha numeric password

Properly chosen pass phrases are very strong.

Most people cannot properly chose a pass phrase.

Use something like Diceware to generate a phrase.

Post reply on HN