How to check an open source product for password handling quality?

Question

I just created an account on Magento Commerce, which is an online shop solution.

During account creation, I entered a password. Personally I prefer longer, generated passwords that do not contain special characters, since the special characters are located in different places, depending on the locale of the keyboard and special characters do not work well across several remote desktop connections.

As I was not allowed to use a 24 character password like this, I read about the password requirements:

The policies are quite strong:

• 1 capital letter
• 1 number
• 1 special character
• minimum 8 characters length
• but then I wondered why there is a maximum length of 16 characters

Basically I know about Password length and complexity, so my question is not whether their requirements result in a higher password quality than mine.

The question is: since I consider using the product and I have the feeling that the understanding of password security by the developers of the product could be (partially) wrong, what are the first things I should check?

I'm not looking for a Magento specific answer. I'd like to know about the general approach for such a check, e.g. for any open source product.

Answer 1

While the password requirements may help you slightly to understand how that particular system may be handling them, it is just the tip of the iceberg. It's true: Having a maximum length for a password raises some flags that something is not good. However there may be other reasons behind that (like bad documentation?).

Even if you have the perfect policies, nothing will ensure you they are not using weak algorithms or bad practices which can lead to severe security issues. The only way (IMO) is to check the code yourself. In case you don't understand their code, it's better to stick to the most active (and with more contributors) projects. It's also a good idea to check vulnerabilities reports about the project, get to know who is behind its development, ask in their forums or mailing lists and very important, how new the code is: Some OS projects are based in really old code (which could be vulnerable to new attack techniques or use deprecated algorithms), or in the other side, very new projects could pose some risks as they haven't been tested enough.

In summary, I would be more worried about the general security policies than just about how passwords are stored.

UPDATE (about Magento)

I checked their codes, and I found for example one of their Encryption interfaces.

Passwords seem to be stored using "sha256" with a fall-back on "md5" (if that setting is on). In that case, the max length of 16 chars it may be related to the GUI or other reasons (perhaps to allow custom settings and extensions).

Magento project seems to be well coded and it has a strong community. which make me assume its security is above average . Their current password hashing implementation its not the best, but its not the worst either --see comments below--, so don't trust it 100%. There is no perfect system and all OS projects are vulnerable (as attackers can see its code), but as you may know, close sourced projects are neither exempt of vulnerabilities.

I would recommend you to ask them directly why the 16-chars limitation. I'm sure they can give you a more detailed explanation.