Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Limiting passwords to 12 characters is "secure enough"

forums.stardock.com

Post reply on HN
Print view View original

71–80 of 111 posts

Re: Limiting passwords to 12 characters is "secure enough"

#71

Post by JoshTriplett »

SideburnsOfDoom wrote: post #66
tomd3v wrote: post #62

Earlier quoted context omitted.

I don't understand why you are so upset. Just edit the HTML and set maxlength to anything you want. It will seal a deal. :D

As far as I can tell, it's checked on the server side too. But I might have another go at it tonight to be sure. The worst that could happen is that I get a longer, more secure password ;)

The worst that can happen when you mess with form field lengths: no validation on entry to the database, but validation later when pulling it out to check it, so you're now locked out of your account.

Re: Limiting passwords to 12 characters is "secure enough"

#72

Post by daGrevis »

kijin wrote: post #18

If a 12-char password is "secure enough" today, then a 16-char password is obviously even more secure and future-proof. Not to mention a 30-char password, or a password that contains more special characters than what your dumb webapp allows. Not to mention that a 30-char purely alphabetic passphrase such as xkcd.com/936 is so much easier to remember (i.e. less likely to be written on a post-it note) and type into tod…

I don't see why you should limit the length of a password.

Re: Limiting passwords to 12 characters is "secure enough"

#74

Post by mosselman »

daGrevis wrote: post #72
kijin wrote: post #18

If a 12-char password is "secure enough" today, then a 16-char password is obviously even more secure and future-proof. Not to mention a 30-char password, or a password that contains more special characters than what your dumb webapp allows. Not to mention that a 30-char purely alphabetic passphrase such as xkcd.com/936 is so much easier to remember (i.e. less likely to be written on a post-it note) and type into tod…

I don't see why you should limit the length of a password.

Exactly. In any way in fact. A special char password of 8 char is not more secure than a a-z phrase of 20 long.

Re: Limiting passwords to 12 characters is "secure enough"

#75

Post by lucb1e »

sp332 wrote: post #10

Even if they were brute-forcing, a new GPU cluster can do 350 billion guesses per second. http://arstechnica.com/security/2012/12/25-gpu-cluster-crack... That means an average of 78 days to crack an individual password, even with no heuristics about which passwords are more likely.

The first step is to convince them that the database is not actually failsafe if even companies like Linkedin can't do it. Then convince them that it matters if the password leaks (you should use unique ones anyway, but everyone knows that not everyone does). Only then this kind of offline brute-forcing is an argument.

Re: Limiting passwords to 12 characters is "secure enough"

#78

Post by blablabla123 »

kijin wrote: post #18

If a 12-char password is "secure enough" today, then a 16-char password is obviously even more secure and future-proof. Not to mention a 30-char password, or a password that contains more special characters than what your dumb webapp allows. Not to mention that a 30-char purely alphabetic passphrase such as xkcd.com/936 is so much easier to remember (i.e. less likely to be written on a post-it note) and type into tod…

>Therefore, if your password policy as any more restrictive than [\x20-\xFE]{8,64}, I'm going to assume that you store my passwords in a plain-text VARCHAR field without proper escaping.

Alternative interpretation: the Website is neither UTF8-safe (or whatever charset you prefer) nor are prepared statements used. Otherwise VARCHAR is fine even without any escaping.

Re: Limiting passwords to 12 characters is "secure enough"

#79

Post by makomk »

SideburnsOfDoom wrote: post #66
tomd3v wrote: post #62

Earlier quoted context omitted.

I don't understand why you are so upset. Just edit the HTML and set maxlength to anything you want. It will seal a deal. :D

As far as I can tell, it's checked on the server side too. But I might have another go at it tonight to be sure. The worst that could happen is that I get a longer, more secure password ;)

It's possible the server will let you set the password to something longer than 12 characters but nott allow you to log-in with it. It's apparently happened on sites before.

Re: Limiting passwords to 12 characters is "secure enough"

#80

Post by kijin »

daGrevis wrote: post #72
kijin wrote: post #18

If a 12-char password is "secure enough" today, then a 16-char password is obviously even more secure and future-proof. Not to mention a 30-char password, or a password that contains more special characters than what your dumb webapp allows. Not to mention that a 30-char purely alphabetic passphrase such as xkcd.com/936 is so much easier to remember (i.e. less likely to be written on a post-it note) and type into tod…

I don't see why you should limit the length of a password.

I think there is some sense in having a lower limit around 6-8 chars. No matter how many special characters you use, it won't be strong if it's too short.

The upper limit of 64 chars is just something that I copy-and-pasted from an actual web app that I wrote some time ago. It works in most cases, but if I were to write the same app now, I'd probably remove the upper limit or make it very large. (By the way, bcrypt only hashes the first 72 bytes of your password [1], so make sure to do something like bcrypt(sha256(password)) if you plan on using longer passwords.)

[1] http://news.ycombinator.com/item?id=4515894

Post reply on HN