18

When a system requires a password between say 6 and 20 characters in length, does it mean the password is stored without using a hashing function, and that the mysql-field (or similar) is 20 characters in length?

Is there any reason to have a maximum length if a hashing function is used?
I'm thinking maybe a DOS-vulnerability when hashing huge passwords. A ~100 character limit should be enough to stop this, without disturbing users. Maybe even cut the password at a specific length before hasing it?

Improve this question

1 Answer 1

Reset to default
24

There are a few reasons that limits might have been imposed:

  • Some developers feel that reasonable limits (e.g. 120 chars) help reduce server load for hashing ludicrously sized passwords. In reality, the transfer overheads are probably more intensive, as the data is reduced down to a fixed length state in the first round of most hashes, so it's a rather moot point.
  • Legacy advice. Really old systems used to have technical limits that required passwords to be short (e.g. 14 chars or less) and this has permeated into advice given to new developers. It's irritating and backwards, but it happens. It also ties into the "we've always done it that way" attitude that a lot of places have.
  • Reducing tech support calls and reset volume. This is by far the most legitimate reason, but it also comes with some caveats that make it largely a bad idea. Users are expected to forget their passwords every so often, and complex / long passwords are seen to increase this rate. However, if you happen to have a "structure" to your password, which involves a fixed length that is too large for this particular service, then it leads to a higher likelihood of resets.

All in all, it doesn't mean that hashing isn't being done. It just means that they're following bad advice and continuing a status quo of poor practices.

Some related questions:

Improve this answer
5
  • 3
    Concerning "we've always done it that way", there's the infamous monkey-ladder-water experiment (though it's actual existence has been discussed on skeptics.stackexchange.com/q/6828/1197)
    – Tobias Kienzler
    Sep 3, 2013 at 11:03
  • Top answer on the first question I linked covers it perfectly.
    – Polynomial
    Sep 3, 2013 at 11:07
  • Ah indeed, and sceptics.SE is linked there as well...
    – Tobias Kienzler
    Sep 3, 2013 at 11:10
  • Ammo for the third point: xkcd.com/936
    – MSalters
    Sep 3, 2013 at 13:50
  • A frequent reason to see this in some business/enertprise systems is because, if the organisation wants unified passwords across systems, they have to cater for the smallest common denominator. In this situation, you cannot imply a lot regarding how the password is stored or what limitaitons may exist.
    – Tim X
    Sep 7, 2013 at 5:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .