Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Possible Duplicate:
Should I have a maximum password length?

According to a recent TNW article:

Microsoft doesn’t like long passwords. In fact, the software giant not only won’t let you use a really long one in Hotmail, but the company recently started prompting users to only enter the first 16 characters of their password.

This practice seems counter-productive.

Would they have made this decision based on a limitation or particular behaviour of their hashing algorithm?

share|improve this question

marked as duplicate by Rook, Scott Pack, Polynomial, Terry Chia, Rory Alsop Sep 24 '12 at 7:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

... also Microsoft isn't a good security role model. –  Rook Sep 23 '12 at 20:11
@Rook - You make that statement based on what exactly? –  Ramhound Sep 24 '12 at 12:48
@Ramhound The fact that they limit passwords to 16 characters long. –  Dan Feb 26 at 20:48
@Dan - My password longer then 16 characters disagrees. –  Ramhound Feb 26 at 23:59
@Ramhound I tried to sign up this morning at signup.live.com and it explicitly states: "Your password can't be longer than 16 characters." Try logging in with only the first 16 characters of your password, I bet it will work. –  Dan 2 days ago

1 Answer 1

up vote 4 down vote accepted

Purely legacy reasons. They are working to increase it.

From: http://windowsteamblog.com/windows_live/b/windowslive/archive/2012/07/15/keeping-your-microsoft-account-more-secure.aspx (see comment made by Eric Doerr in response to @MondayBlues):

Password length - We are working on increasing this. Unfortunately, for historical reasons, the password validation logic is decentralized across different products, so it's a bigger change than it should be and takes longer to get to market. It's also worth noting that the vast majority of compromised accounts are through malware and phishing. The small fraction of brute force is primarily common passwords like "123456" not due to a lack of complexity.

share|improve this answer
The first sentence is the answer I was looking for! Thanks. (I didn't consider my question a duplicate because I wasn't asking a theoretical question about a planned system, as the linked one does, but a practical question about one that already exists.) –  msanford Sep 24 '12 at 14:19
I agree, disagree with moderators...not a duplicate to me. –  Eric Fleischman Sep 24 '12 at 14:22
@EricFleischman Could you paste a quote of the relevant parts in here, so the answer will remain valid even if the link dies? –  Iszi Sep 24 '12 at 15:46
@lszi: paste complete –  Eric Fleischman Sep 24 '12 at 15:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.