Hacker News Reader

Comment by blueatlas | Hacker News Reader

I was a bit surprised by #9.2 - "Don’t put any limitations on the passwords people can use (maximum lengths, disallowing certain characters, etc.)". What's the thinking here?

View on HN

If someone wants to use a 250 character truly random password with crazy characters, let them do it. If they used a long password with an excellent mix of upper-case, lower-case, and special characters, but no numbers, it's a good password, take it.

I had a password for a credit card account which could not be more than 8 characters and couldn't contain 'special' characters or punctuation. This was probably done to either make the password human readable (over-the-phone, horrible idea), or because of some legacy system on their end. At some point the organization got smart and made a minimum of 6 characters, of which two needed to be numbers (but kept the other restrictions). This effectively narrows down pool the possible passwords for an attacker to guess, the opposite of what you want to do.

Have fun running bcrypt on 100TB of /dev/urandom. Insanely large password limit? Sure sounds like good business to me. No password length limit? Sounds like a DOS attack waiting to happen.

What would you suggest as a sane upper bound?

No idea, especially as pass phrases have become more popular the max length of a password that you might see in the wild has gone up quite a bit. Lets say someone is willing to type for 1 min to login to a site. According to Google the fastest typing speed recorded is 216 words per min. According to the words per min Wikipedia entry a "word"(They give examples of "I run" counts as one word, but "rhinoceros" counts as 2) is 5 characters long so that gives us a max password length of 1080 characters. According to wikipedia War and Peace is just shy of 600 thousand words long or approximately 3 million characters.

Therefore 1000 is a good minimum max length but 3 million is way to long.

You're probably good with 1k FWIW Django added a 4k limit (4096 bytes) last September: https://www.djangoproject.com/weblog/2013/sep/15/security/

const int PW_MAX = strlen("correct horse battery staple")

While it's true their changes made the key space smaller and, even with a good KDF, 8 chars was never long enough to begin with, the reduction is negligible. Assume 36 char (alphanumeric, case insensitive) passwords:

Originally:

    36^8 + 36^7 + 36^6 + 36^5 + 36^4 + 36^3 + 36^2 + 36
    2,901,713,047,668 possible passwords
    ~41.4 bits

After:

    (36^8 - 26^2 * (8*7)/2) + (36^7 - 26^2 * (7*6)/2) + (36^6 - 26^2 * (6*5)/2)
    2,901,650,810,624 possible passwords
    still ~41.4 bits

Only 62,237,044 possibilities eliminated. Length is the most important factor, so this was probably a good decision if most of their users were using <= 6 char passwords, or not using numbers at all. And frankly, the financial sector should be using HSMs anyway, making weak KDFs irrelevant.

Making the minimum password length 6 characters reduces the possible outcomes by a negligible ammount.

What is the thinking behind disallowing certain characters? When you create artificial limitations you have to justify them, not the other way around.

There was a discussion here a while back on this matter, where I held very much the same position as you. The other guy convincingly proved that adding the "must use at least one each of these character classes" barely reduces the password space, while promoting increased password complexity for those people who would pick the _really_ easy ones.

What if I want my password to be "one small step for man one giant leap for mankind" (or something less known)? Do I really have to put a dollar in that to make it secure?

Teach good password hygiene. Use keepassx. Use decentralized third party authentication with providers that know what they are doing and use 2FA and such!

But password restrictions achieve very little. Let people use their 12345 if they really want, they won't learn by watching the stove but by touching it. Some people are like that and we should educate, not babysit.

Well the other part of weak passwords is for many websites the users care less about account security then the website operator.

There are many sites which contain none of my personal info but I have to setup an account just to view website content. If my account gets hijacked, it might be used for spamming. But still If I could make a throwaway account with a blank password I would because I don't care about that accounts security. So surely some restrictions need to be in place if you're going to require signups.

Perhaps it's better to suggest using at least one capital, one number and one symbol. You can warn a user that their password doesn't use those and remind them to make it long and not a mere short colocation of dictionary words but ultimately - unless it's risking other's security - you can let them set any password they like?

> What's the thinking here?

I sucks for people that generate individual passwords based on a common password and site-specific data.

Can't speak for OP, but surely putting restrictions on your password just makes people choose weird, eminently forgettable passwords, a la xkcd's complaint http://xkcd.com/936/

As the password should be stored as a hash anyway the actual length of the password does not matter as the hash length will be constant.

In the old days, if you stored the unencrypted password, it had to have a maximum length because somebody decided to make the db column 16 chars....

Same goes for charset limitations (e.g. try storing unicode characters in a database set to US-ASCII charset...) - with a hash your input does not matter - it is just a sequence of bytes that are hashed.

Lastly, the source of disallowing certain characters is the laziness of the implementers that couldn't be bothered to implement proper input encoding in their frontend

In fact, very long passwords can be successfully used to DDOS some setups (i.e Django used to have such vulnerability). It's much simpler to put a sane upper limit, like 1024 characters.

Thanks, I used your number, too. :)

Reply on news.ycombinator.com