Hacker News Reader

Comment by Revisor | Hacker News Reader

Unfortunately the silent limits of the password fields are very prevalent.

I found out the hard way after I'd started to use Keepass to generate and manage my passwords.

There are even sites that have different limits for the "Change password" and "Enter password" input fields. Eg change accepts up to 30 characters but enter accepts only 20 chars.

Obviously they don't even know why it matters.

I think the developer just silently presumed that no one would enter such long passwords.

The problem is really prevalent.

View on HN

Limits on password length smell like plain text storage. Hashes tend to make the length of the password irrelevant (although some bad implementations only look at the first n characters of the string and ignore the rest), but when you store it in a relational database row you need to come up with some arbitrary limit.

I believe Active Directory has a maximum length on passwords: http://msdn.microsoft.com/en-us/library/system.web.security.... (See ArgumentException.)

Hope you're not right, as Paypal only let's you use up to 22 chars if I'm not mistaken

I'm not saying that this is the only reason why people come up with a limit on password length, but that I can imagine that some programmers who come up with such a limit do so because of plaintext storage in a fixed length database row (which is the only quasi-technical excuse for a limit I can up with).

Myspace used to not check the length of passwords on signup, but would on changing password. You could log into the website with a long password, but whenever you tried to logon to the IM client (well, pidgin plugin), it would complain. It was a ten character limit I think.

> I think the developer just silently presumed that no one would enter such long passwords.

But they had to make a specific decision to forbid long passwords; "lazy developer" or "silent assumption" doesn't explain the extra effort.

Usually something like this is just a sanity check. 16 characters is definitely a little stingy though, but I'd wager that a very small percentage of their user's ran into this limit (mostly those pre-encrypting locally like I do), so I think we're overblowing the issue a bit.

Those character restrictions are just silly and annoying though.

I have often seen password fields that are only limited by their attribute. Eg

  <input type="password" maxlength=20>

You're right, if they actively limit the character set and the length, it must have been a conscious decision.

Reply on news.ycombinator.com