It’s infuriating to create a “strong password” with letters, numbers, upper and lowercase, symbols, and non-repeating text… but it has to be only 8 to 16 characters long.
That’s not a “strong” password, random characters or not.
Is there a limitation that somehow prevents these sites from allowing more than 16 characters?
I’m talking government websites, not just forums. It seems crazy to me.
There are valid reasons to limit password length. For example when a hashing function is used that requires a lot of processing power and the amount of power required to calculate the hash is related to the length. In that (very common) case, a denial of service attack vector is exposed. By simply spamming insane long passwords into a login form for example, the servers calculating the hash get easily overloaded. Even with rate limiting, only a small number of attacking nodes can be used to pull down a site.
So a maximum number of characters for a password is a valid thing to do. HOWEVER the maximum length for this purpose is usually set at something like 2048 or 4096 characters.
There is no excuse for a max password length of 16, that’s just terrible.
You could put a timeout on the hash function so that it can’t be abused that way, but then… why not just make a limit so it can’t anyway.
I get your point above, and the reason I hate short passwords is that I use passphrases. They are not only easier to type in, but long passphrases of 4+ words (plus a few extra characters and a number) are considerably more secure than the “best” 16-character password made up of random characters.
Per your problem above, is this why some sites send you a 2FA code before asking for your password? To avoid that potential DOS attack?
Yes in your specific scenario, you are righr. But if you even the playing field, apples to apples. If you have 4 words of each 4 letters plus random char at the ebd, lets say equating to 20 characters in total, a random 20 character password is better. Words/phrases are now commonly added to bruteforce attacks unlike before. Use an good password plus a 2fa that isnt sms or email for best protection, or dump passwords if you can for hardware keys.
˙˙˙ɐuuoפ ɹǝʌǝN
Sixteen is the minimum where I work. We upped it at the end of last year. Fortunately, we also fixed our password policy to expire annually. It used to be every three months, which leads to recycling.
NIST recommended to never have passwords expire since like 3 decades. You gotta get rid of that. It makes your org less secure.
Probably best to just fire whoever set that up. They’re clueless
These policies typically come from top management. They’d have to fire themselves.
There’s always recycling. Or changing that final character from a 1 to a 2, etc. The human brain just cant handle the complexity otherwise.
Use a couple words instead of letters, you’ll find it easier to remember and not use repeats. Bicycle Uber Pancake 4* should be more secure than some random bunch of letters you’ll forget.
Just use a password manager. No need to remember anything besides your master password. That works for pretty much everything, except I guess computer logins.
Well yes everyone should use a password manager but some people can’t load a password manager onto their work computer and therefore are more likely to use non-random passwords. It’s easier to remember a passphrase than a random password.
Fortunately, we force everyone to use a password manager at my company. SSO all the things!
We got SSO systems too, unfortunately, there are about 3 of them, lol. The old ADFS, the current Microsoft login (possibly cloud AD, not sure), and our own ID product that we offer to customers.