You must log in or register to comment.
Anytime you see a password length cap you know they are not following current security standards. If they aren’t following them for something so simple and visible, you’d better believe it’s a rat infested pile of hot garbage under the hood, as evidenced here.
you have to limit it somewhere or you’re opening yourself up for a DoS attack
password hashing algorithms are literally designed to be resource intensive
Edited to remove untrue information. Thanks for the corrections everyone.
Incorrect.
They’re designed to be resource intensive to calculate to make them harder to brute force, and impossible to reverse.
Some literally have a parameter which acts as a sliding scale for how difficult they are to calculate, so that you can increase security as hardware power advances.
I was incorrect but I still disagree with you. The hashing function is not designed to be resource intensive but to have a controlled cost. Key stretching by adding rounds repeats the controlled cost to make computing the final hash more expensive but the message length passed to the function isn’t really an issue. After the first round it doesn’t matter if the message length was 10, 128, or 1024 bytes because each round after is only getting exactly the number of bytes the one way hash outputs.
It depends on the hash. E.g., OWASP only recommends 2 iterations of Argon2id as a minimum.
Yes, a hashing function is designed to be resource intensive, since that’s what makes it hard to brute force. No, a hashing function isn’t designed to be infinitely expensive, because that would be insane. Yes, it’s still a bad thing to provide somebody with a force multiplier like that if they want to run a denial-of-service.
I’m a bit behind on password specific hashing techniques. Thanks for the education.
My background more in general purpose one way hashing functions where we want to be able to calculate hashes quickly, without collisions, and using a consistent amount of resources.
If the goal is to be resource intensive why don’t modern hashing functions designed to use more resources? What’s the technical problem keeping Argon2 from being designed to eat even more cycles?
Argon2 has parameters that allow you to specify the execution time, the memory required, and the degree of parallelism.
But at a certain point you get diminishing returns and you’re just wasting resources. It seems like a similar question to why not just use massive encryption keys.
Hashes are one way functions. You can’t get from hash back to input
Only if the hash function is designed well
True. I was all kinds of incorrect in my hasty typing. I’ll update it to be less wrong.
Are you saying that any site which does not allow a 27 yobibyte long password is not following current security standards?
I think a 128 character cap is a very reasonable compromise between security and sanity.Atleast this is reasonable, I have seen some website don’t allow more than 6 character.
WTF? Are they trying to get hit with brute force attacks?
At least it’s 128
I had a phone carrier that changed from a pin to a “password” but it couldn’t be more than 4 characters
my bank…
In theory yes. But in practice the DB will almost always have some cap on the field length. They could just be exposing that all the way forward. Especially depending on their infastructure it could very well be that whatever modeling system they use is tightly integrated with their form generation too. So the dev (junior or otherwise) thought it would be a good idea to be explicit about the requirement
That said, you are right that this is still wrong. They should use something with a large enough cap that it doesn’t matter and also remove the copy telling the use what that cap is
You misunderstand the issue. The length of the password should not have any effect on the size of the database field. The fact that it apparently does is a huge red flag. You hash the password and store the hash in the db. For example, a sha256 hash is always 32 bytes long, no matter how much data you feed into it (btw, don’t use sha256 to hash passwords, it was just an example. It’s not a suitable password hashing algorithm as it’s not slow enough).
ur absolutely right. Idk why I was thinking about it like a normal text/char field
Do you really need more than 128 characters?
[This comment has been deleted by an automated system]
I’m going to ruin this man’s whole database
I know it’s annoying that the password “doesn’t match”, but … a 128 character limit?! I’d like to see THAT fully utilized lol.
(PS: the sentence above is exactly 128 characters, just for a comparison.)
…and I bet once you want to change it you get the “your new password can not be the old password” error message just because.
An acquaintance of mine has a 36 characters long passcode for his tablet that he manually puts in every time he wants to use it.
And you can use password managers to make secure passwords without ever having to input them yourself.
That is a very good idea if you want to disincentivise yourself from using your tablet
He doesnt use it outside of school stuff and even then prefers to write things on paper, I dont think that he has to make disincentives.
Damn at that point I rather use a passphrase
My favorite was when I changed my password and they allowed different restrictions on the change password screen than they did when logging in. I changed my password to a 24 character one but log in screen only allows for max 16. I think they were truncating somewhere but I could not figure it out. Also could not change it again as it said it was incorrect.
Yikes… This thread is a wasteland of misinformation and mininformers arguing with other mininformers about who’s misinformation is less ill informed.
This thread is:
- 50% technology illiteracy
- 25% Dunning Kruger valley
- 10% Actual knowledge
- Everyone else just here for the ride
Seems like they don’t consider a period to be a “special character”
That’s not the issue here as the special character check passes. It’s the validation between the two fields that’s broken.
OP here, reading all the comments and theories as to why the I or L or whatever isn’t a match. I copy and pasted it after it didn’t like my typing skills, tried it twice and no go… I believe the periods aren’t an acceptable special character even though they technically are. It also would not accept spaces in-between words, I was first gonna use “I hate password” for my password but no go there.
The password it accepted was weak AF, two “stupid-words” strung together.
No, one is an uppercase “I” while the other is a lowercase “L.” lI — you can see the difference when you compare it to the nearby “h.”
Ah, so OP was up to shenanigans??? I should have suspected as much from that mischievous miscreant!!!
Yeah I think that’s the main issue. It wouldn’t take it with spaces so I put the periods instead. Rage face
Did one get an autocorrect space after the .?
User error can still be mildly infuriating, I’m not removing this post. Thanks!
How do hackers break into things? Inject codes into the password field and attack a vulnerability. Buffer overflow, application fuzzing.
