A question about passwords | characters used in them

Submitted ⁨⁨1⁩ ⁨year⁩ ago⁩ by ⁨FinancesDrone98@programming.dev⁩ to ⁨programming@programming.dev⁩

Why do so many companies and people say that your password has to be so long and complicated, just to then make restrictions?

I am in the process of changing some passwords (I have peen pwnd and it’s the password I use for use-less-er sites) and suddenly they say “password may contain a maximum of 15 characters“… I mean, 15 is long but it’s nothing for a password manager.

And then there’s the problem with special characters like äàáâæãåā ñ ī o ė ß ÿ ç just to name a few, or some even won’t let you type a [space] in them. Why is that? Is it bad programming? Or just a symptom of copy-pasta?

source

Comments

Sort:hotnew top

foo@withachanceof.com ⁨1⁩ ⁨year⁩ ago

Is it bad programming?

With very few exceptions, yes. There should be no restrictions on characters used/length of password (within reason) if you’re storing passwords correctly.

source
- 0xSHODAN@lemmy.world ⁨1⁩ ⁨year⁩ ago
  And if a site does have such restrictions, it could be an indication that they store passwords in plaintext, rather than hashed
  
  source
- Aurenkin@sh.itjust.works ⁨1⁩ ⁨year⁩ ago
  A very high max of something like 500 characters just to make sure you don’t get DOSed by folks hitting your endpoint with kilobytes of data is about the most I would expect in terms of length restrictions. I’m not a security expert or anything though.
  
  source
  - dog@suppo.fi ⁨1⁩ ⁨year⁩ ago
    That’s a misunderstanding of DDoS. 0 byte packets are actually worse than large packets.
    
    Which is why most DDoS (at least was) is extremely slow 0 byte requests until the server throttles/crashes under the number of requests.
    
    source
    -> View More Comments
  - foo@withachanceof.com ⁨1⁩ ⁨year⁩ ago
    Right, that’s why I put the “within reason” in my comment. You still need to guard against malicious inputs so ultimately there is some max length limit, but it should be way beyond what a reasonable password length should be.
    
    source
    -> View More Comments
punkisundead@slrpnk.net ⁨1⁩ ⁨year⁩ ago
And then there are times you set a password and everything just seems to work fine, but later the new password never works. You reset the password, try again and really focus because you think you made some mistake with the password manager. Again the password you set does not work.

You begin to google the problem and see that there is a max password lenght of 12. But you always set passwords of the lenght 20-30 and the interface never complained. But because you are desperate, you try just the first 12 characters of the last password you set. And it works!

I hate HP printers.

source
- InfiniteFlow@lemmy.world ⁨1⁩ ⁨year⁩ ago
  You, you can add that list. Motherfuckers will let you type a password as long as you wish, only to internally truncate it. Was driving me crazy until I tried to log in on the mobile app, where it does prevent you to type more characters…
  
  source
- FinancesDrone98@programming.dev ⁨1⁩ ⁨year⁩ ago
  This explains a whole lot…
  
  source
- dog@suppo.fi ⁨1⁩ ⁨year⁩ ago
  Old Steam calling.
  
  Website and Client used different password rules, what worked for the other didn’t in the other.
  
  source
- owsei@lemmy.world ⁨1⁩ ⁨year⁩ ago
  How “a$$word” saved PayPal
  
  TL;DR: PayPal had reencrypted their database with a new encryption scheme, but it would accidentally cutout passwords larger than 8 characters. However one person in set their passphrase to “a$$word”, saving the day.
  
  source
knobbysideup@lemm.ee ⁨1⁩ ⁨year⁩ ago
The new NIST guidance is to have something long. Special characters don’t matter. So a good passphrase that you can remember > short line noise. NIST also recommends against constant password rotation, but to instead audit for dictionary attacks. See also: netsec.news/summary-of-the-nist-password-recommen…

source
beejjorgensen@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago
Every time I find a site like this, I assume the programming is bad and the security is poor. (They don’t know how to sanitize input? They don’t know how to hash passwords?) It’s a good reason to use random passwords on every site for when that one is compromised.

source
jet@hackertalks.com ⁨1⁩ ⁨year⁩ ago
I hope you’re using a password manager, I recommend bit warden if not.

Password requirements are all attempts at getting people to introduce entropy into their passwords. The length the characters the not allowed characters the allowed characters. All about adding entropy

Restrictions on allowed characters tend to be based on legacy systems and the input state allow. So if you have an input system that only has Latin characters, it would be foolish to allow non-Latin characters into a password, because then people could get stuck unable to login. So typically they reduce to the safest set of characters that all of their systems use. And for some of the older systems that parse passwords, some of the Medicare characters could be problematic.

source
- WtfEvenIsExistence@sopuli.xyz ⁨1⁩ ⁨year⁩ ago
  Speaking of Password Managers, PLEASE DO NOT FORGET THAT PASSWORD.
  
  Because that’s gonna be a bit annoying [Very Annoying].
  
  My story: reddthat.com/post/1115518
  
  😟
  
  source
- MagicShel@programming.dev ⁨1⁩ ⁨year⁩ ago
  It feels like a lot of sites are taking active measures to block the use is password managers, too. I hate those sites. Why I’m the hell would you do that???
  
  source
  - jet@hackertalks.com ⁨1⁩ ⁨year⁩ ago
    Example please? This is not been my experience
    
    source
    -> View More Comments
- Asudox@lemmy.world ⁨1⁩ ⁨year⁩ ago
  I agree. Bitwarden is open source and also provides a pretty good user experience. Now that passkey support is also coming, I like it even more. Currently a premium member. 10€/year isn’t alot for a good service.
  
  source
  - jet@hackertalks.com ⁨1⁩ ⁨year⁩ ago
    Plus you can self host if you want the save the $10 a year, but its worth it to support the ecosystem
    
    source
    -> View More Comments
- incogtino@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  Bitwarden F-Droid repo
  
  mobileapp.bitwarden.com/fdroid/
  
  source
uniqueid198x@lemmy.dbzer0.com ⁨1⁩ ⁨year⁩ ago
Yes its bad programing. These restrictions suggest that the company is either doing improper storage and processing, or does not understand how to deal with passwords.

The proper password storage is a hash. This is a cryptographic function that is easy to do and imbossible to undo. The hash function operates on the underlying binary representation of your password, and doesn’t card what letters or symbols are in it. A program should take your password, hash it, and compare the result to the hash they have in their detebase.

The current recomended hash algorythm is called ‘bcrypt’. Depending on the implementation, the input is between 50 and 70 bytes (the spec was a little unclear so people defined the inputs diferently, but the algorithe is the same). This means a password should be able to take at least 50 normal keyboard characters, including letters, symbols, and spaces. Anything less than that indicates a poor practice on behalf of the website.

(a lot of this is simplified. There is some variation and nuance that I don’t think affects the main idea)

source
- AzzyDev@beehaw.org ⁨1⁩ ⁨year⁩ ago
  What about Argon2id? What are the advantages of bcrypt?
  
  source
  - dog@suppo.fi ⁨1⁩ ⁨year⁩ ago
    Argon2 is the best (secure) crypto currently.
    
    That said, adoption is slow, Bitwarden only recently implemented it for example.
    
    That said, due to Argon2 being security-oriented, the recommended settings for it are pretty heavy.
    
    source
  - uniqueid198x@lemmy.dbzer0.com ⁨1⁩ ⁨year⁩ ago
    I don’t really know the strong points of either, I’m not a cryptographer. Bcrypt gets recommended because its relatively fast, its decent, and most importantly its already in most environments
    
    source
30p87@feddit.de ⁨1⁩ ⁨year⁩ ago
Banks are the worst in this, the one website that should have secure passwords uses standards so low that KeePass can’t even go so low. I have to use a password I can remember, which may not actually be of a low standard but is in this case, considering it’s only 10 chars.

source
- nyan@lemmy.cafe ⁨1⁩ ⁨year⁩ ago
  Banks are the single industry most likely to be handing the passwords over to a 1970s mainframe that expects everything to be encoded in EBCDIC at some point in the validation sequence.
  
  This is an explanation, not an excuse.
  
  source
- FinancesDrone98@programming.dev ⁨1⁩ ⁨year⁩ ago
  That’s the digital equivalent to the key under the rock, but it’s the only rock on your porch.
  
  source
theherk@lemmy.world ⁨1⁩ ⁨year⁩ ago
xkcd.com/936/

source
- Marcbmann@lemmy.world ⁨1⁩ ⁨year⁩ ago
  I’m always reminded of this when I see arbitrarily low caps on password character lengths.
  
  Recently signed up on a site that limited passwords to 11 characters. Why? Like, seriously, why?
  
  source
- FinancesDrone98@programming.dev ⁨1⁩ ⁨year⁩ ago
  Something like that is my master password! Well, it is a sentence with l33tspe4k and numbers, colons and stuff
  
  source
  - dog@suppo.fi ⁨1⁩ ⁨year⁩ ago
    Your password could also just be a long, unique sentence, without any excessive special characters. Maybe even a poem.
    
    Like "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vestibulum eu leo eu nibh efficitur viverra. Integer lacinia tortor est, quis aliquet tortor varius sed. Sed dapibus vel turpis at suscipit. Nulla consequat orci in nibh dapibus sodales. Phasellus at arcu ac dolor suscipit pretium. Curabitur sit amet justo sit amet ipsum scelerisque accumsan ac ac nulla. Nullam accumsan lorem sagittis iaculis varius. Nullam convallis nisi ante, id congue diam tincidunt vel. Aliquam sed iaculis mauris. Nam leo nisi, consequat sed sodales non, tempor vel ante. Nunc eleifend vulputate turpis bibendum bibendum. Morbi nec massa in mi sagittis lacinia id ut metus. Maecenas gravida mi vitae lorem laoreet sagittis. "
    
    That’s alot of common characters and words; yet, it’ll take centuries to crack.
    
    source
    -> View More Comments
JakenVeina@lemm.ee ⁨1⁩ ⁨year⁩ ago
Likely more bad design than bad programming, but that’s not a very meaningful distinction.

It’s downright scary how many “professionals” are onboard with this shit.

source
peter@feddit.uk ⁨1⁩ ⁨year⁩ ago
Some of the restrictions are there to try and protect users from themselves. Most people don’t want to put a space in their password so it’s assumed it was a mistake when they do.

source
- bromine@lemm.ee ⁨1⁩ ⁨year⁩ ago
  
  Most people don’t want to put a space in their password
  
  Source?
  
  source
  - peter@feddit.uk ⁨1⁩ ⁨year⁩ ago
    Just my general experience, I mean how many passwords from leaked password lists contain spaces? The general understanding of passwords is that they contain no spaces
    
    source
    -> View More Comments
zkfcfbzr@lemmy.world ⁨1⁩ ⁨year⁩ ago
My passwords use the full set of characters I can type by hand on a standard US qwerty keyboard, and I’ve only run into a few sites that have complained and made me use something simpler. PayPal is one of them. Some of the others are Zenni Optical, eBay, and FedLoan.

In total that’s about 8% of my accounts. So the vast majority of sites seem to let you use whatever, at least. I only use 15 characters so I have no comments on length. I am equally annoyed when a new site makes me use simpler passwords.

source
Sigmatics@lemmy.ca ⁨1⁩ ⁨year⁩ ago
I always thought banks (of all places) had the most ridiculous requirements. What, a 5 character pin to get read access to most of my financial data? Are you kidding me? That’s like securing your bike with a numbers lock

source
Fuckass@hexbear.net ⁨1⁩ ⁨year⁩ ago
I wish passphrase generators included foreign words. I’d like to mix my password with polish, Spanish, vietnamese, and Latin

source