Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Possible Duplicate:
Should I have a maximum password length?

According to a recent TNW article:

Microsoft doesn’t like long passwords. In fact, the software giant not only won’t let you use a really long one in Hotmail, but the company recently started prompting users to only enter the first 16 characters of their password.

This practice seems counter-productive.

Would they have made this decision based on a limitation or particular behaviour of their hashing algorithm?

share|improve this question

marked as duplicate by Rook, Scott Pack, Polynomial, Terry Chia, Rory Alsop Sep 24 '12 at 7:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3  
... also Microsoft isn't a good security role model. –  Rook Sep 23 '12 at 20:11
1  
@Rook - You make that statement based on what exactly? –  Ramhound Sep 24 '12 at 12:48

1 Answer 1

up vote 3 down vote accepted

Purely legacy reasons. They are working to increase it.

From: http://windowsteamblog.com/windows_live/b/windowslive/archive/2012/07/15/keeping-your-microsoft-account-more-secure.aspx (see comment made by Eric Doerr in response to @MondayBlues):

Password length - We are working on increasing this. Unfortunately, for historical reasons, the password validation logic is decentralized across different products, so it's a bigger change than it should be and takes longer to get to market. It's also worth noting that the vast majority of compromised accounts are through malware and phishing. The small fraction of brute force is primarily common passwords like "123456" not due to a lack of complexity.

share|improve this answer
    
The first sentence is the answer I was looking for! Thanks. (I didn't consider my question a duplicate because I wasn't asking a theoretical question about a planned system, as the linked one does, but a practical question about one that already exists.) –  msanford Sep 24 '12 at 14:19
1  
I agree, disagree with moderators...not a duplicate to me. –  Eric Fleischman Sep 24 '12 at 14:22
    
@EricFleischman Could you paste a quote of the relevant parts in here, so the answer will remain valid even if the link dies? –  Iszi Sep 24 '12 at 15:46
    
@lszi: paste complete –  Eric Fleischman Sep 24 '12 at 15:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.