Linked Questions

-1 votes
3 answers
187 views

Can using very long, complex passwords with online accounts be detrimental? [duplicate]

In the case of data breach, long, complex passwords may draw more attention than simpler ones and the attacker might prioritize accounts with the most sophisticated passwords . Given that "it is ...
user598527's user avatar
  • 1,343
1286 votes
23 answers
288k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
120 votes
3 answers
76k views

Does bcrypt have a maximum password length?

I was messing around with bcrypt today and noticed something: hashpw('testtdsdddddddddddddddddddddddddddddddddddddddddddddddsddddddddddddddddd', salt) Output: '$2a$15$jQYbLa5m0PIo7eZ6MGCzr....
d0ctor's user avatar
  • 1,303
31 votes
2 answers
9k views

Is there any security risk in not setting a maximum password length?

I'm a listener of the podcast "Security Now" where they often claim that there are no reasons to limit the number of characters a user can use in their passwords when they create an account ...
Thomas's user avatar
  • 420
25 votes
5 answers
8k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
Piotr Müller's user avatar
4 votes
3 answers
6k views

Why is there a Cap on Password length? [duplicate]

Why when we sign up on sites like Facebook and Gmail do our passwords have to be 8-12 characters in length, or some other cap? 8-12 spaces are finite, but you can make your passwords more "secure" by ...
wanttolearnmoreaboutladders's user avatar
0 votes
2 answers
5k views

Long Passwords: How are they more secure? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? How are long passwords more secure? The only situation in which I can accept long passwords are more secure ...
user avatar
1 vote
2 answers
398 views

All hash algos shatter... so why not switch from golden bullet to scatter shot? [duplicate]

As of this morning any SHA-1 hash can officially be collided for as little as $110k in GPU power on Amazon. http://shattered.it/ https://arstechnica.com/security/2017/02/at-deaths-door-for-years-...
coolaj86's user avatar
  • 593
1 vote
3 answers
317 views

Are longer passwords safer even if the encryption/database security used is compromised?

Let me preface this that I am having a lot of trouble wording my question. Hopefully my description will help clarify. I have always wondered if long passwords actually provide you any more security ...
rigidmoose's user avatar
0 votes
0 answers
63 views

How long shall a password be to resist a botnet brute force? [duplicate]

Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
Alberto Salvia Novella's user avatar