Timeline for What technical reasons are there to have low maximum password lengths?
Current License: CC BY-SA 4.0
37 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 26, 2023 at 14:36 | comment | added | user213769 | skeptics.stackexchange.com/questions/6828/… - please don't use monkeys (which are very smart and quick to adapt) as a metaphor for human mental retardation. It's not fair vs the monkeys. With monkeys, to quote an expert, "If you have bananas on a pole, you'll lose your bananas." tl;dr stop spreading this fake story please! | |
| Aug 25, 2022 at 14:42 | comment | added | Ctorres | Thank you for providing this genius answer. I love it. | |
| Apr 3, 2020 at 16:29 | review | Suggested edits | |||
| Apr 3, 2020 at 21:30 | |||||
| S Aug 31, 2018 at 15:22 | history | suggested | learnAsWeGo | CC BY-SA 4.0 |
old link is dead
|
| Aug 31, 2018 at 14:36 | review | Suggested edits | |||
| S Aug 31, 2018 at 15:22 | |||||
| Dec 27, 2017 at 21:48 | history | bounty ended | MD XF | ||
| Mar 10, 2017 at 16:28 | comment | added | utnapistim | +1; Last time I heard this explanation, it ended with "This is what we call <<company policy>>". | |
| Jun 22, 2016 at 4:05 | comment | added | Sid | Something similar to how religion works. Made me smile. Thanks for the amazing analogy. | |
| Apr 24, 2015 at 0:05 | comment | added | binar | @LeoKing This is security.stackexchange, so people don't merely stop at 666, they aim for Strong Primes. | |
| Oct 17, 2014 at 22:41 | review | Suggested edits | |||
| Oct 17, 2014 at 23:23 | |||||
| Jun 10, 2014 at 21:51 | comment | added | Longpoke | b..but, i thought my bank restricts me to 8 characters for my protection | |
| Feb 13, 2014 at 19:41 | history | bounty ended | Mike Graham | ||
| Dec 2, 2013 at 2:16 | history | bounty ended | zerkms | ||
| Aug 13, 2013 at 7:07 | review | Suggested edits | |||
| Aug 13, 2013 at 7:34 | |||||
| Apr 5, 2013 at 14:47 | comment | added | MD Sayem Ahmed | I have created my account on this site just to upvote your answer. Awesome explanation! You sir, are a true genius!! | |
| Apr 4, 2013 at 23:38 | comment | added | Tim X | OMG, the net is full of chimps. Just for the record, I am currently working on a project to remove 8 character limit on passwords for a client who has over 40,000 users and a lot of applications. Things are not as simple as many of you would like to think. Yes, the crypt() limit is the basic reason for the 8 character limit. Crypt was required to support legacy apps. The 8 char limit made sense when it was originally imposed (CPU, net, I/O speed). | |
| Apr 3, 2013 at 15:43 | comment | added | Chad | How do the chimps get into the tubes though? | |
| Apr 3, 2013 at 6:14 | comment | added | Adi | @PPC Anecdotal evidence FTW!! | |
| Apr 2, 2013 at 20:35 | comment | added | LarsH |
"That's the banana." What's the banana, the fact that crypt() used to ignore any characters after the first 8? That doesn't seem to fit the analogy, where the banana is the reward everyone can see is desirable, but which chimps have learned by tradition that they shouldn't go after. Seems to me, the banana is something like "higher security by allowing longer passwords". The limitations of legacy crypt() might be the waterhose rather than the banana. (Correspondence between the analogy and reality is of course hypothetical.)
|
|
| Apr 2, 2013 at 17:13 | comment | added | Joe Z. | You can even remove the water hoses, and the chimps will still beat up anyone who touches the stepladder. | |
| Apr 2, 2013 at 15:59 | comment | added | PPC | @LarsH: One day I asked a chimp (level 2 technical support for resetting passords, on the phone) why the passwords had to be 6 digits and no more (no letter), generated by the system and sent via untracked paper mail. The answer was "We are a bank and cannot take any security risks". Gave up the banana. | |
| Apr 2, 2013 at 9:49 | comment | added | Adi | @LarsH & Kevin, Whaat?! Are you actually thinking? No no no, you should blindly upvote and agree. It's a bit ironic, you see, you won't get an answer for that, you're expected to behave much like the chimpanzees in the answer itself. | |
| Apr 1, 2013 at 13:57 | review | Suggested edits | |||
| Apr 1, 2013 at 14:02 | |||||
| Mar 31, 2013 at 20:51 | comment | added | Kevin | I'm with @LarsH. Are we sure that all of this can actually be traced back to the crypt function? | |
| Mar 31, 2013 at 10:24 | comment | added | Arkh | That's why you should not document the how but the why. And that goes for all rules. | |
| Mar 31, 2013 at 10:02 | comment | added | ewanm89 | In other words, modern algorithms implemented properly and there is absolutely no reason for a maximum password limit, other than to make it not completely insane (lets see, say a 1MB long password?). Old Windows NT LANMAN hashes had similar problems with being a maximum of 14 characters which are split into 2x 7 character passwords and hashed without salting. | |
| Mar 31, 2013 at 9:47 | comment | added | philippe lhardy | .. That's the banana... i would more state that DES-crypt using first 8 characters is the water hose. For your story to be complete you should remove the water hoses, and see who dare to challenge again... | |
| Mar 31, 2013 at 8:56 | comment | added | Jeff Ferland♦ | @kush truncation upon submission doesn't prevent hashing, though hashing does remove the point of truncating upon submission. | |
| Mar 31, 2013 at 8:11 | comment | added | kush | @Joe that shakes my confidence in the service. Never store my passwords in plain text. Would you be happy to see this? thenextweb.com/microsoft/2012/09/21/… | |
| Mar 31, 2013 at 6:52 | comment | added | Joe Phillips | Simple solution... let me set my password to whatever I want and just truncate it when I submit it. At least give me the illusion that I am actually choosing my password. Then again you couldn't enforce numbers and weird character rules (good thing in my opinion) | |
| Mar 31, 2013 at 4:38 | comment | added | Journeyman Geek | By the nature of the answer though, the <strikethrough> chimpanzee</strikethrough> developer should no longer be there. | |
| Mar 31, 2013 at 1:56 | comment | added | LarsH | Is there any evidence that this is indeed the reason? E.g. has anyone actually asked someone who designed a system with a max password length why they did it that way? | |
| Mar 31, 2013 at 0:28 | comment | added | Lorenzo Von Matterhorn | several chimps were harmed during the making of this answer. ( btw, loved the explanation!) | |
| Mar 31, 2013 at 0:08 | comment | added | KutuluMike | I like this story also; never let the facts get in the way of a good morality tale: skeptics.stackexchange.com/questions/6828/… :) | |
| Mar 30, 2013 at 21:54 | comment | added | Rory Alsop♦ | Oh, and I thought the bears were taking over the internets... | |
| Mar 30, 2013 at 21:52 | history | edited | Thomas Pornin | CC BY-SA 3.0 |
added 1 characters in body
|
| Mar 30, 2013 at 21:48 | history | answered | Tom Leek | CC BY-SA 3.0 |