1

I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with.

After resetting the password, I went to enter my password, and noticed there is an unlimited (or much larger) character allowance in the field.

My question is, is there any actual security advantage to forcing a character-limit on password-reset, and then allowing unlimited characters on login?

To me it seems as if this is more along the lines of what I see people say around here of "Security through Obscurity."

Also, a negative I see to this is if people aren't paying attention to the field not allowing any characters after x, and then try to login with what they "think" is their password, they will be locked out of their account. This is especially important since I didn't notice any warnings of character limits, which you usually see on sites.

I also wanted to mention that this ties into my other question here Why, after a certain character limit, are larger passwords labeled as "weak" on some sites? but wanted to separate them into separate questions.

Improve this question

3 Answers 3

Reset to default
2

It would have a slight advantage that bots or attackers that haven't done their reconnaissance properly may be wasting time on password guesses with passwords that the system can't possibly accommodate. If an attacker can register for their own account, they should have checked the maximum password length and other password rules by trying to reset their own.

This depends greatly though whether truncated passwords are accepted by the input field.

Also note that limiting password lengths in the first place isn't great, and could be an indication that the password is being stored insecurely.

Improve this answer
3
  • Makes sense, but you would think they would have done the proper "reconnaissance." It doesn't seem to truncate passwords, so you will need to enter the exact password. I would hope that this site is securing passwords properly, as they are a big site.
    – XaolingBao
    Jun 27, 2016 at 19:23
  • I'm not saying that this was a conscious decision, just that this is the only advantage of such a method that I can think of.
    – SilverlightFox
    Jun 27, 2016 at 19:26
  • Not too sure... Maybe I should email the company and ask them why:? I feel that asking them... and then posting here, would be a bit out of bounds, so I might not do that...
    – XaolingBao
    Jun 27, 2016 at 19:28
1

The only security disadvantage of password-length restrictions (I.e. "Not too large") is if the software is vulnerable to a buffer-overrun. Those are not difficult to defend against for password fields, so this is just laziness on their part.

Other than that, password length restrictions can only artificially reduce the possible entropy in a password.

Improve this answer
3
  • Thanks for a nice example of "Why" but, as you said, seems to be a part of laziness that someone would do this.... Except... The site in question is a major site that should have high end security, so there should be more to why this is done.
    – XaolingBao
    Jun 27, 2016 at 19:21
  • 1
    I was on the phone with my bank one time because they let me set my password to something longer than the login form would let me enter so it didn't work. The person said "it's for your security, sir." At that point, I lost it: "BS. You're saying that artificially limiting my password to 12 characters is for my security? Artificially limiting the entropy my password can have is for my security? I'm sorry, but that's BS." They have since changed this, I think.
    – iAdjunct
    Jun 27, 2016 at 19:32
  • +1 for smackdown... HAHAHA... I'm pretty sure I saw a post on here saying that their bank used 6 digit pins, and there were answers sayng why that would be secure (I guess login attempts)... It's amazing how many instances of high level security places having horrid digital security. Oh, you have my student loan information, and store my SSN in plain-text? You go girl!
    – XaolingBao
    Jun 27, 2016 at 19:41
0

My question is, is there any actual security advantage to forcing a character-limit on password-reset, and then allowing unlimited characters on login?

I can't see any security benefits to that. Allowing unlimited length at login is probably not a concsious design decicion, but rather the result of the developers not bothering to set the maxlength property of the input field.

By the way, having a 10 character maximum password length in the first place is a really bad idea.

Improve this answer
2
  • Why would you set the maxlength to anything, as that contradicts the notion of your first point "I can't see any security benefits to that?" so why add a max length. 10 characters could be changed to 15, or 20. I would assume any limit would be an issue.
    – XaolingBao
    Jun 27, 2016 at 19:19
  • @XaolingBao I don't advocate a maximum password length. But I don't see any security benefits to allowing unlimited characters on login if you dont allow them in the password anyway. My point is that the webpage allowing this probably has nothing to do with security considerations.
    – Anders
    Jun 27, 2016 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .