this post was submitted on 18 Aug 2024
833 points (98.8% liked)

Cybersecurity - Memes

1963 readers
1 users here now

Only the hottest memes in Cybersecurity

founded 1 year ago
MODERATORS
833
submitted 2 months ago* (last edited 2 months ago) by cron to c/cybersecuritymemes@lemmy.world
 

Last week, I tried to register for a service and was really surprised by a password limit of 16 characters. Why on earth yould you impose such strict limits? Never heard of correct horse battery staple?

you are viewing a single comment's thread
view the rest of the comments
[–] wreckedcarzz@lemmy.world 4 points 2 months ago (2 children)

That happens all the fucking time, and it's infuriating. Most recent example was with Kagi, which I eventually found out had a max of 72, truncated, no warning. I bitched out their support and they were like 'nbd, and it should have warned you' and I'm like 'nope, no warning at all' which means they didn't bother checking if a warning actually showed or prevented the input, just 'I wrote it so we must be good'.

They claim to have fixed this, but ugh. Took me a half an hour, and I started with the suspicion that it was being truncated. Test your shit if you're going to be stupid, people.

[–] frezik@midwest.social 1 points 2 months ago

Bcrypt and scrypt have a limit of 72 chars, so it's probably that. Implementations can work around it by putting the password through a pre-hash, but most don't bother. There are tons of reasonably secure password storage systems with that limit.

[–] Rogue@feddit.uk 1 points 2 months ago (1 children)

What are the benefits of a password greater than 72 characters? How high do you try to go?

[–] AA5B@lemmy.world 2 points 2 months ago (1 children)

The longer it is, the harder for anyone to guess, write down, remember, or brute force. For that long a password, someone can actually see my password and then have effectively zero chance of being able to use it.

But maybe it’s more a ”why not?” In one side it’s generated so you can use it equally well, and in the other side it should be hashed to a standard length so they should be able to manage it equally well.

[–] frezik@midwest.social 1 points 2 months ago

When I did the math with a reasonable list of alphanums and symbols on a US standard keyboard, a 40 char randomly generated password had equivalent security to a 256 but block cipher key. Describing the difficulty in brute forcing that starts with the phrase "assume you can convert all the energy from a supernova at 100% efficiency into a thermodynamiclly perfect computer". A roundabout way of saying impossible.

40 chars random is already overkill.