I just created an account on Magento Commerce, which is an online shop solution.
During account creation, I entered a password. Personally I prefer longer, generated passwords that do not contain special characters, since the special characters are located in different places, depending on the locale of the keyboard and special characters do not work well across several remote desktop connections.
As I was not allowed to use a 24 character password like this, I read about the password requirements:
The policies are quite strong:
- 1 capital letter
- 1 number
- 1 special character
- minimum 8 characters length
- but then I wondered why there is a maximum length of 16 characters
Basically I know about Password length and complexity, so my question is not whether their requirements result in a higher password quality than mine.
The question is: since I consider using the product and I have the feeling that the understanding of password security by the developers of the product could be (partially) wrong, what are the first things I should check?
I'm not looking for a Magento specific answer. I'd like to know about the general approach for such a check, e.g. for any open source product.