5

I have encountered that our linux system cuts the length of every password to a certain length, after that length every additional character seems to be ignored.

Does this make our linux system more succeptible to a brute force dictionary attack? Also the length of a password at work isn't 100% a secret, as you will hear someone typing either shortly or quite long. Could someone with malicious intent use this to crack a long password with a dictionary attack of common words, by assuming all complicated characters are at the end?

|improve this question
  • 2
    The tale of passwords being truncated to X characters makes me think that the affected systems use a really old and insecure password hashing system. I really hope to be wrong though, because it's quite worrying to see such old and extremely insecure technology still being used. – André Borie Mar 14 '16 at 18:47
6

Absolutely - and "without notice" is pretty bad here.

Your example (a construction that starts with a word and has more complicated bits at the end) is a good one. XKCD's "correct horse battery staple" would also be reduced to just the first word, making the space trivial to brute-force.

If a security-savvy user is aware of this restriction, they could choose a different password construction, but that's a really terrible thing to ask users to do. An security-savvy user who is unaware of this restriction could easily end up with equivalent security to your average hunter2 password.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.