The chimpanzee's testimony
More than 15 years ago I worked as a system admin on Tru64 an operating system
developped on top of OSF/1 by Digital Equipment Corporation. This system was built on a 64bit architecture and made many serious advances in fundamental security.
One of them was to permit to use DES to manage passwords up to a length of 16 characters.
Since I was already well informed of the easyness with which it was possible to break a 56 bits DES, I was one of the first to use more serious passwords.
I computed at this time that for me the optimum size of passwords was rather between 12 and 16.
Unfortunately one day... I made a stupid mistake on typing my password
to access remotely on my system. I knew I had wrongly typed a character because I was on a foreign keyboard. And it worked. This was a virtual cold
water shower straight in the brain.
I immediatly stopped my work in progress (and dropped my banana altogether).
I hunted down the ugly bug. One character after the other, I shortened my password to find where was the error.
The limit was quickly discovered: it was at 8. Whatever the characters I
entered after the 8 first correct ones, this truncated password was accepted.
A bug was immediatly filled to DEC, and a lesson was learnt the hard way.
The same day I immediatly advocated all my colleagues and users to stop using
passwords longer than 8 characters, because they were just false security.
They should stay at 8 characters limit since for some server the other
characters weren't part of the authentication process.
Apparently without the origin of the history, a lot of my colleagues transmitted this religious fear until today ☺. Hence you can see prehistorical OS which still can't cross this 8 characters barrier without the ancestral fear to loose their characters.
They won't stay stucked in this fear forever or… perhaps they will.