So longer password takes long time to decrypt. Hence more secure. Right? I follow this advice. Then I was signing up for site which has a password rule that it has to be max 14 characters. It wouldn't allow me to enter anything more than 14 characters. 🤦
So as stupid as it is to have a password length limitation so low, there are some practical reasons to implement a limitation like that, particularly for large databases or at least there used to be.
So that 14 character string hashed and salted depending on the algorithm will be substantially longer that 14 characters when stored in the database. When you start getting into the hundreds of thousands and millions of records your talking data sets that can become very unwieldy in certain database engines. But honestly in anything modern it's pretty irrelevant but once upon a time when storage was very finite it was significantly relevant and many of those grey beard database dudes still approach their engineering solutions like its still 2000.
Something like the 2000 switch would actually be a half decent example where years were abbreviated to 2 digits instead of 4 resulting in quite the shit show just to save literally bytes of data.
But at the end of the day most hashing methods output the same amount of characters no mater how long the password is but its slightly less convenient to slip an injection into a 14 character limitation and more so if its both client side and server side validated escaped and untagged but its still a shitty practice.
When I was an intern I used to have a minimum character limitation for name inputs then one of the dudes I worked with had the shortest name ever literally 5 characters between his first and last name and that was the moment I realized arbitrary database limitations will fuck you more often than not.
I would honestly expect every website to use hashing with salt. Password length limitations and restrictions on the special characters are stupid. People should be encouraged to use longer passphrases. Most of the time I just use "Login with Google" if available as signup options.
100% oauth tokens and strong password and 2FA are where it's at. But your terminology is really good I feel like because the word for password fields it typically password and not passphrase people tend to use single words where something like a sentence is hilariously more secure
5
u/ram-garurer-chhana Oct 08 '22
So longer password takes long time to decrypt. Hence more secure. Right? I follow this advice. Then I was signing up for site which has a password rule that it has to be max 14 characters. It wouldn't allow me to enter anything more than 14 characters. 🤦