Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Limiting passwords to 12 characters is "secure enough"

forums.stardock.com

Post reply on HN
Print view View original

61–70 of 111 posts

Re: Limiting passwords to 12 characters is "secure enough"

#61

Post by pjbrunet »

guard-of-terra wrote: post #51

Passwords are bullshit. We should have a start-up about having a better way of keeping your digital identity other than hundreds of logins/passwords, but obviously everyone is too busy with figuring out better ways of sharing lolcats. Not that lolcats are bad. They are good. It's just they aren't fun anymore once your identity is stolen. Or your mom's.

"better way of keeping your digital identity"

We'll get you a seared flesh barcode, for your birthday, on your forehead. Hands-free Facebook logins for life! Are you excited?

Re: Limiting passwords to 12 characters is "secure enough"

#62

Post by tomd3v »

SideburnsOfDoom wrote: post #55

I've seen worse. There's a UK company called The Train Line ( http://www.thetrainline.com/ ) that handles money, and limits passwords to 10 chars with no punctuation characters.

I don't understand why you are so upset. Just edit the HTML and set maxlength to anything you want. It will seal a deal. :D

Re: Limiting passwords to 12 characters is "secure enough"

#64

Post by linhat »

I'm not so sure anymore about the password length limitations (or any other weird password requirements for that matter).

For the longest time I was wondering why my bank would ONLY allow a 5 digit password, alphanumerical only and it MUST contain at least one letter as well as one number, while they let you choose your own username completely free of any restrictions, including special characters. After thinking about it for quite some time, I remembered all these sites where your password had to be as least 6 characters (now 8 seems to be a general minimum).

By forcing users to use EXACTLY 5 characters at least you cannot use the SAME password your already using for your mail and whatnot, except for the fact that there is nothing preventing your from simply dropping the last character (but you sure would NEVER do that, would you ;-), assuming of course you already have letters as well as numbers within the first 5 characters.

While 5 characters seems extremely weak, If you get it wrong 3 times, your account is locked. Locked as in "you have to call them and identify yourself with A LOT OF DETAILS about your account and transactions" to unlock it and reset your password.

I have no idea how they store passwords and it doesn't really matter to me, while it probably should. They are a BANK and if they get hacked and their customer password database gets compromised, I am sure they will have worse problems to take care of.

What I would really like to see is their evaluation of security versus added support work for locked accounts.

Re: Limiting passwords to 12 characters is "secure enough"

#65

Post by guard-of-terra »

pjbrunet wrote: post #61
guard-of-terra wrote: post #51

Passwords are bullshit. We should have a start-up about having a better way of keeping your digital identity other than hundreds of logins/passwords, but obviously everyone is too busy with figuring out better ways of sharing lolcats. Not that lolcats are bad. They are good. It's just they aren't fun anymore once your identity is stolen. Or your mom's.

"better way of keeping your digital identity" We'll get you a seared flesh barcode, for your birthday, on your forehead. Hands-free Facebook logins for life! Are you excited?

It's actually not very safe.

Re: Limiting passwords to 12 characters is "secure enough"

#66

Post by SideburnsOfDoom »

tomd3v wrote: post #62
SideburnsOfDoom wrote: post #55

I've seen worse. There's a UK company called The Train Line ( http://www.thetrainline.com/ ) that handles money, and limits passwords to 10 chars with no punctuation characters.

I don't understand why you are so upset. Just edit the HTML and set maxlength to anything you want. It will seal a deal. :D

As far as I can tell, it's checked on the server side too. But I might have another go at it tonight to be sure. The worst that could happen is that I get a longer, more secure password ;)

Re: Limiting passwords to 12 characters is "secure enough"

#67

Post by molf »

linhat wrote: post #64

I'm not so sure anymore about the password length limitations (or any other weird password requirements for that matter). For the longest time I was wondering why my bank would ONLY allow a 5 digit password, alphanumerical only and it MUST contain at least one letter as well as one number, while they let you choose your own username completely free of any restrictions, including special characters. After thinking abo…

Maybe that's their goal. But if a password has very strict requirements, I cannot choose my own password. This means I cannot remember it, which is annoying in itself even if there are no consequences for security (I need to write it down, reset it every so often, or call them to unlock my account -- a lot of effort).

The result is that a customer of their service is annoyed. I think a login/signup procedure that makes people happy instead of annoy them should be worth a lot to any brand.

Re: Limiting passwords to 12 characters is "secure enough"

#68

Post by molf »

stopcyring wrote: post #34

Any user input needs to be filtered, sanitized, validated and limited. Please be my guest and pass any user input to your magic hashing function, don't cry about it later because due to some special circumstances / framework bug / language bug / buffer overflow / extra hidden utf char, your magic function opens a huge security hole. oh oops.

Okay, fine. But why limit to 12 characters? My email address isn't limited to 12 characters when I sign up, and it's probably limited and validated too. The fact that something needs to be validated does not justify annoyingly strict limits. Allowing 64 characters is just as easy as 12.

Re: Limiting passwords to 12 characters is "secure enough"

#69

Post by oxide »

pjbrunet wrote: post #56

If your password is 100,000,000 characters long, that's simply a waste of bandwidth, CPU time, space on the disk * millions of users * 1000s of iterations = money flushed down the toilet. And remember web servers have timeout parameters spread across half a dozen config files. You're just asking for trouble. Not worth it. To protect one self-important nitwit's video game password? Even your million character password…

that isn't the point. the point is if there is a limit on character length, its a clear indication that the passwords aren't being properly handled.
Post reply on HN