Maximum length is the biggest red flag to me and was the catalyst for me making the effort to switch to unique passwords per-account years ago. There's just so, so many shitty homerolled security systems out there... and data breaches seem to be a perennial problem these days.

There's just no excuse for limiting the length if you're doing security correctly (other than perhaps a large upper limit just to protect against someone DOSing the backend with a bunch of 100MB strings; 512 characters seems reasonable).

By setting an upper limit, you're basically saying one or more of these things:

We store your password in plaintext
We store a hash but our hashing function has an unnecessarily arbitrarily limited input size
The person/team implementing the backend has no idea what they're doing and/or just copy pasted login code from stack overflow
We tried to get away with minimal password requirements but some middle manager wouldn't rubber stamp it without arbitrary_list_of_bs

[–] pixeltree@lemmy.blahaj.zone 5 points 2 months ago

My senior project for uni was replacing the professor's friend's website. We had a meeting to gather requirements, have him demo the site as different kinds of users, etc. Dude said "Hold on a sec" and went to a page with all accounts and their passwords listed. Was like, dude, the hell