Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Limiting passwords to 12 characters is "secure enough"

forums.stardock.com

Post reply on HN
Print view View original

81–90 of 111 posts

Re: Limiting passwords to 12 characters is "secure enough"

#81

Post by SideburnsOfDoom »

JoshTriplett wrote: post #71
SideburnsOfDoom wrote: post #66

Earlier quoted context omitted.

As far as I can tell, it's checked on the server side too. But I might have another go at it tonight to be sure. The worst that could happen is that I get a longer, more secure password ;)

The worst that can happen when you mess with form field lengths: no validation on entry to the database, but validation later when pulling it out to check it, so you're now locked out of your account.

Interesting, I didn't know that. So the worst that could happen is that I'd be locked out of their horribly insecure site and forced to use something better. I don't re-use passwords, and I declined to let them store my credit card details, so when they get hax0red, I won't lose anything worth stealing.

Re: Limiting passwords to 12 characters is "secure enough"

#82

Post by zxcdw »

guard-of-terra wrote: post #51

Passwords are bullshit. We should have a start-up about having a better way of keeping your digital identity other than hundreds of logins/passwords, but obviously everyone is too busy with figuring out better ways of sharing lolcats. Not that lolcats are bad. They are good. It's just they aren't fun anymore once your identity is stolen. Or your mom's.

Startup? A for-profit company providing the service? No thank you, I trust my brain more than I trust anyone else be that person or a company. Or a non-profit organzation.

Re: Limiting passwords to 12 characters is "secure enough"

#83

Post by cantos »

kijin wrote: post #18

If a 12-char password is "secure enough" today, then a 16-char password is obviously even more secure and future-proof. Not to mention a 30-char password, or a password that contains more special characters than what your dumb webapp allows. Not to mention that a 30-char purely alphabetic passphrase such as xkcd.com/936 is so much easier to remember (i.e. less likely to be written on a post-it note) and type into tod…

Here are two real world issues that could arise

http://vbuterin.blogspot.ca/2011/08/password-strength-rebutt...

I think some cryptographers and security people have given rebuttals as well but I can't find them at the moment.

Re: Limiting passwords to 12 characters is "secure enough"

#84

Post by newman314 »

idupree wrote: post #38
eksith wrote: post #16

Get a whole heap of passwords from random.org. Create a text file with the sites you use with the usernames/passwords. PGP Encrypt the whole ensamble with a good strong password. The only one you really need to remember. Forget your password? Once you reset via email, as soon as you get access to that encrypted file, get a new random password and reset it again. Save the new password in the encrypted file. Password m…

(my tinfoil hat mode: I don't even have any important secrets but I believe in knowing how to protect them) Use /dev/urandom, not a website. Make sure you have configured your text editor not to automatically save any backup files, cut buffers, or the like, and never write it to disk in unencrypted form. (I use vim >= 7.3 and its blowfish encryption; see encryptedvimrc and random_alnum in my scripts https://github.co…

I think you mean LastPass or 1Password.

Startup idea: the email equivalent of 1Password.

You give each site a completely unique, distinct yet valid email address. They forward to your real email address and vice versa.

This way if one email is compromised you know where the spam is coming from plus it reduces email tracking and correlation.

Re: Limiting passwords to 12 characters is "secure enough"

#85

Post by kijin »

blablabla123 wrote: post #78
kijin wrote: post #18

If a 12-char password is "secure enough" today, then a 16-char password is obviously even more secure and future-proof. Not to mention a 30-char password, or a password that contains more special characters than what your dumb webapp allows. Not to mention that a 30-char purely alphabetic passphrase such as xkcd.com/936 is so much easier to remember (i.e. less likely to be written on a post-it note) and type into tod…

>Therefore, if your password policy as any more restrictive than [\x20-\xFE]{8,64}, I'm going to assume that you store my passwords in a plain-text VARCHAR field without proper escaping. Alternative interpretation: the Website is neither UTF8-safe (or whatever charset you prefer) nor are prepared statements used. Otherwise VARCHAR is fine even without any escaping.

Sorry, that was supposed to be \x7E but I can't edit anymore. Now you only need to deal with printable ASCII characters.

Re: Limiting passwords to 12 characters is "secure enough"

#86

Post by Cthulhu_ »

citricsquid wrote: post #6
jimrandomh wrote: post #5

As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain-text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given. But if a site rejects the password t…

The worst thing is when password boxes have paste protection so site-specific randomly generated passwords become a pain to use. A few sites have started doing it recently, it's nonsensical.

$("#input[type='password']").val("secret");

Re: Limiting passwords to 12 characters is "secure enough"

#87

Post by derobert »

akg_67 wrote: post #41

Reading comments in this thread have been very enlightening. I am wondering if there is a best practices or guidelines for password storage for web service operators. I currently manage a web service that has about 1,000 registered users. I have taken the most restrictive path to storing password in database except I need to make sure user/password database is portable from one host to another. Reading the comments,…

You should become familiar with the Open Web Application Security Project https://www.owasp.org/ , who are working on all kinds of best practices for web apps.

OWASP has a draft on password storage https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet and also one on password complexity https://www.owasp.org/index.php/Password_length_%26_complexi... .

They have plenty more, like guides on common security vulnerabilities, etc.

Re: Limiting passwords to 12 characters is "secure enough"

#88

Post by kijin »

cantos wrote: post #83
kijin wrote: post #18

If a 12-char password is "secure enough" today, then a 16-char password is obviously even more secure and future-proof. Not to mention a 30-char password, or a password that contains more special characters than what your dumb webapp allows. Not to mention that a 30-char purely alphabetic passphrase such as xkcd.com/936 is so much easier to remember (i.e. less likely to be written on a post-it note) and type into tod…

Here are two real world issues that could arise http://vbuterin.blogspot.ca/2011/08/password-strength-rebutt... I think some cryptographers and security people have given rebuttals as well but I can't find them at the moment.

Interesting, but I think the author is focusing too much on the desktop experience. Try typing 'Tr0ub4dor&3' vs. 'correct horse battery staple' on a phone. Having to shift between alternate layouts every other character is not only annoying but also makes you prone to forget which character you were trying to type. With a full-size keyboard, on the other hand, you can rely on muscle memory to get it right without even thinking. As for shoulder surfing, I find it rather difficult to shoulder-surf someone who is typing on a glossy 4-inch screen, and you can always choose unusual words/spellings to throw off people who try to guess. Corrupt hearse buttery scalpels!

Re: Limiting passwords to 12 characters is "secure enough"

#89

Post by cantos »

kijin wrote: post #88
cantos wrote: post #83

Earlier quoted context omitted.

Here are two real world issues that could arise http://vbuterin.blogspot.ca/2011/08/password-strength-rebutt... I think some cryptographers and security people have given rebuttals as well but I can't find them at the moment.

Interesting, but I think the author is focusing too much on the desktop experience. Try typing 'Tr0ub4dor&3' vs. 'correct horse battery staple' on a phone. Having to shift between alternate layouts every other character is not only annoying but also makes you prone to forget which character you were trying to type. With a full-size keyboard, on the other hand, you can rely on muscle memory to get it right without eve…

I agree that it would be a better system for phones. I'm not sure about full size keyboards. Muscle memory will allow you to learn the password with only simple characters more quickly but eventually both will be learned. Then the only factor that matters is how accurately the user can type. I don't think muscle memory could ever get 100% accuracy for typing one character correctly. Anything less than 100% and longer passwords will be worse. If you type a key correctly 99.9% of the time then you will lose about twice as much of your time to wrong password entries with an 11 vs 20 char password.
Post reply on HN