I just created an account on Magento Commerce, which is an online shop solution.

During account creation, I entered a password. Personally I prefer longer, generated passwords that do not contain special characters, since the special characters are located in different places, depending on the locale of the keyboard and special characters do not work well across several remote desktop connections.

As I was not allowed to use a 24 character password like this, I read about the password requirements:

The policies are quite strong:

  • 1 capital letter
  • 1 number
  • 1 special character
  • minimum 8 characters length
  • but then I wondered why there is a maximum length of 16 characters

Basically I know about Password length and complexity, so my question is not whether their requirements result in a higher password quality than mine.

The question is: since I consider using the product and I have the feeling that the understanding of password security by the developers of the product could be (partially) wrong, what are the first things I should check?

I'm not looking for a Magento specific answer. I'd like to know about the general approach for such a check, e.g. for any open source product.


1 Answer 1


While the password requirements may help you slightly to understand how that particular system may be handling them, it is just the tip of the iceberg. It's true: Having a maximum length for a password raises some flags that something is not good. However there may be other reasons behind that (like bad documentation?).

Even if you have the perfect policies, nothing will ensure you they are not using weak algorithms or bad practices which can lead to severe security issues. The only way (IMO) is to check the code yourself. In case you don't understand their code, it's better to stick to the most active (and with more contributors) projects. It's also a good idea to check vulnerabilities reports about the project, get to know who is behind its development, ask in their forums or mailing lists and very important, how new the code is: Some OS projects are based in really old code (which could be vulnerable to new attack techniques or use deprecated algorithms), or in the other side, very new projects could pose some risks as they haven't been tested enough.

In summary, I would be more worried about the general security policies than just about how passwords are stored.

UPDATE (about Magento)

I checked their codes, and I found for example one of their Encryption interfaces.

Passwords seem to be stored using "sha256" with a fall-back on "md5" (if that setting is on). In that case, the max length of 16 chars it may be related to the GUI or other reasons (perhaps to allow custom settings and extensions).

Magento project seems to be well coded and it has a strong community. which make me assume its security is above average . Their current password hashing implementation its not the best, but its not the worst either --see comments below--, so don't trust it 100%. There is no perfect system and all OS projects are vulnerable (as attackers can see its code), but as you may know, close sourced projects are neither exempt of vulnerabilities.

I would recommend you to ask them directly why the 16-chars limitation. I'm sure they can give you a more detailed explanation.

  • 1
    The code you linked would be a horrible password hash. Oct 13, 2015 at 7:14
  • @CodesInChaos: Sure, if you take the whole file as hash. BTW, the relevant methods are: getHash and hash . (lines 116 and 137)
    – lepe
    Oct 13, 2015 at 7:54
  • 1
    getHash is not a secure password hash. But since I didn't review the rest of magento (not did I verify that this is the current version of it) I don't know if they're actually using it as a password hash. Oct 13, 2015 at 7:59
  • @CodesInChaos: Sorry I misunderstood you the first time. Yes, indeed that hash is not strong as it uses a single iteration and IMO the way they add the salt is not strong either. Probably using PBKDF2, bcrypt or scrypt could be better too. I can confirm that it is the latest version. I'm not familiar with that system or its code, so I may be missing something important.
    – lepe
    Oct 13, 2015 at 8:21
  • 1
    @NeilSmithline: Updated. Some parts of my statement are still valid from my point of view: Magento seems well coded to me (their code is well documented, they use unit tests, they apply OO correctly, etc), and it has a strong community (19 main developers, 1600 forks, 58K twitter followers). Their hash implementation may be weak, but its better than many of the OSS I have used in the past. I'm sure that if an issue is raised, they would update it soon. It is sub par or above? We don't know. We would have to see all OS projects out there...
    – lepe
    Oct 15, 2015 at 1:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .