Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

enter image description here

I recently ran across this when logging into MSDN. (I saw this screen after typing my initial credentials.)

I have a 20+ digit password, however there's apparently a new requirement for Microsoft accounts for password to be no more than 16 digits in length. If I type in the first 16 digits of my password, I'm able to log in.

That got me thinking: if passwords are being stored as one-way hashes, a hash from a 16-digit password and a 20-digit one are not remotely similar. You cannot validate a 20-digit hash using only the first 16 digits.

If Microsoft is properly-storing passwords (salt & hash), how can they validate a shorter version of my password?

share|improve this question
add comment

3 Answers

up vote 11 down vote accepted

Three possibilities:

  1. Microsoft was always truncating it and you just were not aware. Can you use the old system with a 16 character password and wrong characters at the end?

  2. They were storing the passwords in plaintext (or equivalently encrypting the passwords, allowing them to decrypt the password to truncate it).

  3. When you first migrated accounts (or secretly in anticipation of you eventually migrating), they required you to enter the full 18-character password, checked that you were who you said you were against that, and then created and stored a new 16-character hash of the truncated password for the new system. This is unlikely but possible.

Regardless, truncating passwords or forcing short password lengths is bad password policy. It prevents easy-to-remember moderately strong passphrases; e.g., correct horse battery staple which is 28 characters long. Password lengths should not be truncated until at least ~50 characters or so. If your database requires a fixed maximum length, it probably makes sense to truncate somewhere around 100 characters or so at which point it is allows passphrases which probably have more entropy than can fit into a 128/256 bit hash which are perfectly strong hash lengths.

share|improve this answer
    
I can't find a Microsoft service which lets me enter my old password anymore, all of them ask for the first 16 characters. –  orange Aug 21 '12 at 20:53
add comment

This is possible in a couple ways. First if the password is being stored using some kind of reversible encryption allowing a plaintext comparison. Second if the hashing algorithm used to store the password only acts on the first 16 characters.

share|improve this answer
add comment

Whilst I have no direct knowledge of Microsofts password storage policy, I would suggest a couple of likely scenarios

  1. Most likely - They're truncating the password before they hash it. So if your password is 'iamaverylongpasswordandover16characters' the site just cuts it down to the first 16 chars before running it through the hashing function. TBH not a huge reduction in security, but still not desirable as it weakens peoples passwords
  2. less likely - They're storing in the clear. Obvious bad practice.
  3. even less likely - They're using an HSM and storing them in there with 2-way encryption, so they can retrieve the plain text to compare the first 16 chars.

If I were a betting man, my money would be on number 1.

share|improve this answer
1  
But they don't ask you to enter your old password the first time, so is your assumption that they've always truncated the password and now it's just official? –  Brendan Long Aug 21 '12 at 21:37
    
yep it's an assumption but it makes sense. I've seen quite a few systems that silently truncate passwords due to backend restrictions.. –  Rоry McCune Aug 22 '12 at 8:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.