Linked Questions

1287 votes
23 answers

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
25 votes
5 answers

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
Piotr Müller's user avatar
120 votes
3 answers

Does bcrypt have a maximum password length?

I was messing around with bcrypt today and noticed something: hashpw('testtdsdddddddddddddddddddddddddddddddddddddddddddddddsddddddddddddddddd', salt) Output: '$2a$15$jQYbLa5m0PIo7eZ6MGCzr....
d0ctor's user avatar
  • 1,303
4 votes
3 answers

Why is there a Cap on Password length? [duplicate]

Why when we sign up on sites like Facebook and Gmail do our passwords have to be 8-12 characters in length, or some other cap? 8-12 spaces are finite, but you can make your passwords more "secure" by ...
wanttolearnmoreaboutladders's user avatar
1 vote
3 answers

Are longer passwords safer even if the encryption/database security used is compromised?

Let me preface this that I am having a lot of trouble wording my question. Hopefully my description will help clarify. I have always wondered if long passwords actually provide you any more security ...
rigidmoose's user avatar
-1 votes
3 answers

Can using very long, complex passwords with online accounts be detrimental? [duplicate]

In the case of data breach, long, complex passwords may draw more attention than simpler ones and the attacker might prioritize accounts with the most sophisticated passwords . Given that "it is ...
user598527's user avatar
  • 1,343
31 votes
2 answers

Is there any security risk in not setting a maximum password length?

I'm a listener of the podcast "Security Now" where they often claim that there are no reasons to limit the number of characters a user can use in their passwords when they create an account ...
Thomas's user avatar
  • 420
1 vote
2 answers

All hash algos shatter... so why not switch from golden bullet to scatter shot? [duplicate]

As of this morning any SHA-1 hash can officially be collided for as little as $110k in GPU power on Amazon.
coolaj86's user avatar
  • 593
0 votes
2 answers

Long Passwords: How are they more secure? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? How are long passwords more secure? The only situation in which I can accept long passwords are more secure ...
user avatar
0 votes
0 answers

How long shall a password be to resist a botnet brute force? [duplicate]

Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
Alberto Salvia Novella's user avatar