3

A quick question - wondering whether this is an accepted security practice or why this would be possible. I use a Shaw.ca email (a Canadian service provider) and I accidentally mistyped my password. I clicked enter and still was able to log in. After some experimentation, I found that if I mistyped only the last character of the login, my information was accepted. For example, if my password is Example123, then Example124, Example12u, and Example12# would all be accepted. Other characters changed don't have a difference. Any idea why this would be the case?

2
  • 3
    Because someone botched their work. What kind of answers do you expect?
    – techraf
    Jul 10, 2016 at 5:41
  • 4
    how many chars is your password? is it 1 more than 8, 10, 16, 20, or 32?
    – schroeder
    Jul 10, 2016 at 11:00

2 Answers 2

8

No, this is not accepted security practice. But it is probably not the only service either which silently cut off the entered password after a fixed number of characters. Check out their documentation if they document this behavior. If this is behavior if not documented please contact them so that they either fix this behavior or at least make this bad behavior obvious for the users.

4

This used to be common practice in the late 70s / early 80s. Back then UNIX systems truncated user passwords to 8 character before encrypting them. Newer operating systems use algorithms which pose no (reasonable) limit on password length, but some operating systems still support the old encryption method for backward compatibility. That means the email system is either one of these:

  • It is really that old and nobody ever bothered to change the password encryption method (to their defense: changing the password encryption method without having all users reset their passwords is often not that easy to do)
  • It got accidentally misconfigured.
  • It got intentionally misconfigured by someone who believes the old method is good enough and the newer would be a waste of resources (which is ridiculous, but I have met people who think that way).

Conclusion: Get a better email provider. When someone controls your email account it often allows them to reset the password for every online service you are using. So it is far too important to leave to people who don't know what they are doing security-wise.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .