Stop restricting my password - Help these sites get better security.

Re:Stop restricting my password - Help these sites get bette... by dinkumator on Thursday January 21, 2010 @11:20PM (#1069112)

There's really no point in restricting length or non-alphanumeric characters. They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter.

It's really just laziness and incomptence on the part of the programmers.

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by shrughes on Friday January 22, 2010 @04:24AM (#1069382)

They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter.

No, they should be using bcrypt. You didn't think you'd get away with this by posting after tptacek's bedtime, did you?

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by dinkumator on Friday January 22, 2010 @02:33PM (#1070466)

md5, sha, blowfish, bcrypt... name your pick. i didn't mention a specific algorithm. either way, you're still not saving the password to a database.

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by ytinas on Friday January 22, 2010 @03:04AM (#1069319)

And another thing that's incredibly irritating are these stupid sites that force you to type out your password (they don't let FF write it in the text field). How is that more secure! It just forces me to either use a simple password or write it down somewhere. My normal behavior is to use a totally different password for every site and let my browser manage it.

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by gphil on Friday January 22, 2010 @12:30AM (#1069181)

> There's really no point in restricting length or non-alphanumeric characters.

I agree, the only rationale I can think of for this is that these institutions don't want people to forget their passwords, but even then I don't understand why they would want that at the expense of security.

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by wisty on Friday January 22, 2010 @01:06AM (#1069212)

The irritating thing is that forbidding spaces discourages pass phrases. You can't use "the cat sat on my blue suede shoes", which is pretty secure yet easy to remember.

You could use "thecatsatonmybluesuedeshoes", but that may be harder to type accurately.

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by derwiki on Friday January 22, 2010 @03:19AM (#1069333)

The argument I once heard for restricting length of a password (and possibly special characters) is that it would be harder to craft a buffer overflow (or SQL injection attack) with those limitations. I don't agree that this is a good solution, but it's not always good programmers/managers who are making these decisions. It at least sounds plausible.

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by tptacek on Friday January 22, 2010 @01:03PM (#1070228)

That's a really bad argument. If password length is threatening to you, you have no business accepting passwords.

(Length also has almost nothing to do with SQL Injection, and you're plugging a raw password into an SQL query you're doing something very wrong anyways).

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by jfarmer on Friday January 22, 2010 @03:32AM (#1069343)

Hmm? The hash will be a fixed length, which is the only thing you'd be storing.

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by branden on Friday January 22, 2010 @04:11AM (#1069371)

In order to get that hash you'd have to process the password in its entirety. But really, if they're that concerned about the buffer I see no reason to cap it at 8 or 10 rather than 1000.

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by jfarmer on Friday January 22, 2010 @06:17PM (#1070965)

Eh. That seems unlikely, assuming you're not writing your own routines. At most you'd get an out of memory error. I can calculate the SHA1 digest of a 1Bn character string without running into that problem.

So let's cap the length at 100k characters and call it a day.

[ Parent | on HN ]