Why do so many companies and people say that your password has to be so long and complicated, just to have restrictions?
I am in the process of changing some passwords (I have peen pwnd and it’s the password I use for use-less-er sites) and suddenly they say “password may contain a maximum of 15 characters“… I mean, 15 is long but it’s nothing for a password manager.
And then there’s the problem with special characters like äàáâæãåā ñ ī o ė ß ÿ ç just to name a few, or some even won’t let you type a [space] in them. Why is that? Is it bad programming? Or just a symptom of copy-pasta?
Is it bad programming?
With very few exceptions, yes. There should be no restrictions on characters used/length of password (within reason) if you’re storing passwords correctly.
Underappreciated fact: Bcrypt has a maximum of 72 bytes. It’ll truncate passwords longer than that. Remember that UTF8 encoding of special characters can easily take more than one byte.
That said, this is rarely a problem in practice, except for some very long passphrases.
Bcrypt has a maximum of 72 bytes. It’ll truncate passwords longer than that. Remember that UTF8 encoding of special characters can easily take more than one byte.
Interesting: https://en.wikipedia.org/wiki/Bcrypt#Maximum_password_length
In the worst case a password is limited to 18 characters, when every character requires 4 bytes of UTF-8 encoding. For example: 𐑜𐑝𐑟𐑥𐑷𐑻𐑽𐑾𐑿𐑿𐑰𐑩𐑛𐑙𐑘𐑙𐑒𐑔 (18 characters, 72 bytes)Makes me question if bcrypt deserves to be widely used. Is there really no superior alternative?
Not only that, bcrypt could be run by GPUs and FPGA, that makes it more prone to bruteforcing attacks.
There are 2 modern alternatives: scrypt and argon2. They both require a substantial amount of memory, so gpu and hardware computation is no longer feasible.
And then there are times you set a password and everything just seems to work fine, but later the new password never works. You reset the password, try again and really focus because you think you made some mistake with the password manager. Again the password you set does not work.
You begin to google the problem and see that there is a max password lenght of 12. But you always set passwords of the lenght 20-30 and the interface never complained. But because you are desperate, you try just the first 12 characters of the last password you set. And it works!
I hate HP printers.
This explains a whole lot…
Old Steam calling.
Website and Client used different password rules, what worked for the other didn’t in the other.
Every time I find a site like this, I assume the programming is bad and the security is poor. (They don’t know how to sanitize input? They don’t know how to hash passwords?) It’s a good reason to use random passwords on every site for when that one is compromised.
What is “funny” is that I had the maximum password size thing on several bank websites (and a low one, at that). Fortunately, with 2FA, it doesn’t really matter I guess.
The new NIST guidance is to have something long. Special characters don’t matter. So a good passphrase that you can remember > short line noise. NIST also recommends against constant password rotation, but to instead audit for dictionary attacks. See also: https://www.netsec.news/summary-of-the-nist-password-recommendations-for-2021/
Yes, it is bad programming. Of course, on the backend you must never store passwords in the clear. You should never grow your own hashing algorithm.
Yes its bad programing. These restrictions suggest that the company is either doing improper storage and processing, or does not understand how to deal with passwords.
The proper password storage is a hash. This is a cryptographic function that is easy to do and imbossible to undo. The hash function operates on the underlying binary representation of your password, and doesn’t card what letters or symbols are in it. A program should take your password, hash it, and compare the result to the hash they have in their detebase.
The current recomended hash algorythm is called ‘bcrypt’. Depending on the implementation, the input is between 50 and 70 bytes (the spec was a little unclear so people defined the inputs diferently, but the algorithe is the same). This means a password should be able to take at least 50 normal keyboard characters, including letters, symbols, and spaces. Anything less than that indicates a poor practice on behalf of the website.
(a lot of this is simplified. There is some variation and nuance that I don’t think affects the main idea)
What about Argon2id? What are the advantages of bcrypt?
I don’t really know the strong points of either, I’m not a cryptographer. Bcrypt gets recommended because its relatively fast, its decent, and most importantly its already in most environments
Bcrypt is slow on purpose; all these methods are. More importantly, though, bcrypt is very well studied. Scrypt and argon2 had to catch up, but should be fine at this point.
Argon2 is the best (secure) crypto currently.
That said, adoption is slow, Bitwarden only recently implemented it for example.
That said, due to Argon2 being security-oriented, the recommended settings for it are pretty heavy.
Banks are the worst in this, the one website that should have secure passwords uses standards so low that KeePass can’t even go so low. I have to use a password I can remember, which may not actually be of a low standard but is in this case, considering it’s only 10 chars.
Banks are the single industry most likely to be handing the passwords over to a 1970s mainframe that expects everything to be encoded in EBCDIC at some point in the validation sequence.
This is an explanation, not an excuse.
That’s the digital equivalent to the key under the rock, but it’s the only rock on your porch.
Non-ASCII characters can cause troubles because of different encodings and because you may need to type them on a machine where corresponding keyboard layout is missing.
The password length limit is nothing short of stupid.
My mother’s password for everything got compromised recently. I told her to think of a sentence that will never happen and to write it down and store it somewhere safe.
She remembered it instantly.
Oh, and I made her a password manager
Is it bad programming
No, it’s bad requirements, well ok maybe the programmer came up with the requirements too.
Likely more bad design than bad programming, but that’s not a very meaningful distinction.
It’s downright scary how many “professionals” are onboard with this shit.
Some of the restrictions are there to try and protect users from themselves. Most people don’t want to put a space in their password so it’s assumed it was a mistake when they do.
I always thought banks (of all places) had the most ridiculous requirements. What, a 5 character pin to get read access to most of my financial data? Are you kidding me? That’s like securing your bike with a numbers lock