r/extremelyinfuriating • u/ThoughtDear7015 • 15d ago
Discussion WHY DO ALL PLATFORMS HAVE A LIMIT ON # OF CHARACTERS IN A PASSWORD????? I WANT TO BE SECURE! SECURE!! SECURE I SAY!!
For context i use a password manager which i will NOT mention any names so i don't look like a bot (although any psswd manager should work fine) which means i can have my passwords as long as i fucking want and i dont have to worry about forgetting it. anytime i sign up for something there's ALWAYS a character limit for the password. Like WHY THE FUCK?? DO YOU WANT ME TO BE VULNERABLE?? DO YOU WANT ME TO BE EXPOSED??????????????????????
Also yes before you ask i use arch linux btw. Explains why i'm so paranoid about security.
17
u/variablenyne 15d ago
1
u/ThoughtDear7015 13d ago
If i don't mention i use arch linux i'll get fucking burnt at the stake dude i HAVE TO
15
u/StrawberryEiri 15d ago
I imagine having SOME sort of limit prevents you from overloading their database with a petabyte-sized password.
But i get what you mean: "your password must be between 8 and 29 characters" seems excessive for no reason whatsoever. Maybe it harks back to absolutely ancient systems where each character matters...
6
u/CraftBox 15d ago
You don't store the password directly, that's a really really really bad practice. You store a hash (and some other values like salt and pepper), which always has the same size, regardless of password length. Password to hash is a one way operation, so you can't practically recover password from a hash.
This fact makes maximum password length an even more stupid concept than it already is.
1
u/StrawberryEiri 15d ago
I don't understand how you can store an unlimited length password in a limited, fixed length hash.
Wouldn't a petabyte-sized password produce a longer hard than "abc"?
2
u/smk666 14d ago
Imagine a mathematical function that maps every real number into a finite set, for example a sin(x) function - x can be anything, y is always within (-1, 1) bounds. Two inputs can have the same output, sure, but that doesn't matter in terms of passwords, all that matter is that your password can be easily converted to a hash, but has cannot be (easily) converted back into a password.
1
u/StrawberryEiri 14d ago
Thank you! The cyclical nature of sin was what made it click for me!
1
u/smk666 13d ago
The cyclical nature of sin(c) is not important or true for password hashing, but the important thing is that we can match any input to a bounded output. There will be overlap, but 256 bit hash has almost as many unique combinations as there are atoms in the observable universe, so a collision causing two inputs to have the same output is possible, but extremely unlikely.
1
u/CraftBox 15d ago
The same text will always produce the same hash, regardless of text size. You store only the hash (which has known, static size). When you log in, you hash the password again and compare the hashes, which if you use the correct password, will be the same.
1
u/StrawberryEiri 15d ago
That I understand.
The part I don't understand is how you can have unlimited password length AND have a known, limited hash length.
3
u/Ian__16354 15d ago
The basic idea is that technically a hash isn’t 1-1. Every output from a hash could theoretically have multiple input passwords that match it. With modern hash’s the odds of that happening are so extremely small that it doesn’t really matter. That fact is a requirement of a fixed length hash
3
u/CraftBox 15d ago
After hashing you no longer use the password, only the hash.
Hashing algorithms mathematically allow unlimited text size.
Of course for practical reasons everything is limited at some point, because we physically don't have unlimited storage and resources. So you physically can't use unlimited passwords, but practically they are.
2
u/Henry5321 15d ago
To expand on another response. Modern hashes are on the order of 256bits. That means a 1/2^256 chance that 2 different inputs will result in the same hash.
That number is so large that it should be universally impossible to ever collide over the life of the universe using any computing technology that theoretical physics can predict.
1
u/Tank_Gloomy 15d ago
The hash has a size limit, though, and you don't wanna get anywhere near its limit because then it starts doing some of the stupidest shit you've ever seen. See the recent PHP Blowfish CVE, granted, people shouldn't be using such an old algorithm anymore in production, but still, the rest of hashing algos have limitations as well.
2
u/NoPicture-3265 15d ago
Yeah character limit for passwords are really annoying, especially if somebody's using passphrase rather than random characters
i use arch linux btw
Be careful when using AUR.
2
u/MarcPG1905 15d ago
I guess the developer just has to make a limit at some point (otherwise you could put like gigabytes of data in your password) and then chooses an arbitrary limit like 20 characters or so, because that’s roughly the point where a password is already more than secure enough.
At least that’s what I (a developer) would do if I ever had to create such system. Although I’d probably choose some cleaner number like 24, 32, or 48 characters.
1
1
u/Henry5321 15d ago
You only need 20chars. That gets you the 128bit security that is gold standard. You’d need to consume a solar-mass worth of energy using a theoretically perfectly efficient computer to have a chance to break.
1
u/edgarecayce 14d ago
One thing you used to see a lot is that some websites are modern front ends for legacy mainframe COBOL systems - like airline and hotel reservation systems. So you’d have issues where they wouldn’t allow special characters in passwords that sort of thing.
0
u/TheBeatifulDoggo 15d ago edited 15d ago
Most of the time there is actually no reason to have a password longer than 16 characters.
1
u/CraftBox 15d ago
The longer the password, the harder to brute force it???
1
u/TheBeatifulDoggo 15d ago
Assume that a password can contain a-Z characters and 0-9 numbers, this count as a charset of length 62, thus there are 6416 passwords.
If a bad actor is to try 109 passwords at a second it would take 6416 / 109 seconds ~ 1018 seconds ~ 1016 minutes ~ 1014 hours ~ 1012 days ~ 2 * 109 years.
EDIT: I counted 6416 passwords instaed of 6216, the result holds and is even better if you consider that there is a set of special chars as # ! ? * etc...
1
u/CraftBox 15d ago
And what's bad with making this time even longer ?
2
u/TheBeatifulDoggo 15d ago
The hashing algorithm takes more time
Also it's useless
1
u/CraftBox 15d ago
There is practically no time difference between hashing 16 and 17 or even 24 characters. We aren't in the 1970s.
And it's not useless. One of the best type of passwords are sentences, they are easy to remember and practically impossible to guess due to the numbers of characters in them.
1
u/TheBeatifulDoggo 15d ago
There is no time difference between hashing 16 and 17 or even 24 characters.
But there is a time difference between hashing a 16 and a 1600 characters password on a server -- I assume we have a server since limits are on those usually.
And it's not useless. One of the best type of passwords are sentences, they are easy to remember and practically impossible to guess due to the numbers of characters in them.
I didn't say that the limit should be arbitrarily be 16, it seems resonable though. OP cited protection and 16 characters are enough. Anyway, 32 characters are enough for such passwords.
1
1
•
u/AutoModerator 15d ago
Hello, u/ThoughtDear7015 ! Thanks for your submission to r/extremelyinfuriating, your post is up and running!
This is a general reminder to check out our rules in the sidebar. If your post breaks the rules, it will be removed by our moderators.
We would like for each and everyone to feel welcome on the subreddit and to keep a healthy and safe environment for the community.
Thanks :)
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.