Is limiting/cutting password-length without notice insecure?

Question

I have encountered that our linux system cuts the length of every password to a certain length, after that length every additional character seems to be ignored.

Does this make our linux system more succeptible to a brute force dictionary attack? Also the length of a password at work isn't 100% a secret, as you will hear someone typing either shortly or quite long. Could someone with malicious intent use this to crack a long password with a dictionary attack of common words, by assuming all complicated characters are at the end?

Answer 1

Absolutely - and "without notice" is pretty bad here.

Your example (a construction that starts with a word and has more complicated bits at the end) is a good one. XKCD's "correct horse battery staple" would also be reduced to just the first word, making the space trivial to brute-force.

If a security-savvy user is aware of this restriction, they could choose a different password construction, but that's a really terrible thing to ask users to do. An security-savvy user who is unaware of this restriction could easily end up with equivalent security to your average hunter2 password.